CVE-2023-38294

The CVE-2023-38294 issue affects Itel Vision 3 Turbo devices with a pre-installed vulnerable app com.transsion.autotest.factory (versionCode 7, versionName 1.8.0(220310_1027)). The root cause is inadequate access control in this component, enabling local third‑party apps to execute arbitrary shel...

CVE-2023-38292

CVE-2023-38292 affects TCL 20XE devices with vulnerable pre-installed app com.tct.gcs.hiddenmenuproxy (versionCode 2, versionName v11.0.1.0.0201.0). The issue allows local third-party apps to initiate a programmatic factory reset by sending a broadcast to the exported com.tct.gcs.hiddenmenuproxy/...

CVE-2023-38290

CVE-2023-38290 affects BLU View 2 and Sharp Rouvo V Android devices due to a vulnerable pre-installed com.evenwell.fqc app. The issue: inadequate access control lets local third-party apps execute arbitrary shell commands in the app’s system context without special permissions, enabling actions s...

CVE-2023-38301

An issue was discovered in a third-party component related to vendor.gsm.serial, shipped on devices from multiple device manufacturers. Various software builds for the BLU View 2, Boost Mobile Celero 5G, Sharp Rouvo V, Motorola Moto G Pure, Motorola Moto G Power, T-Mobile Revvl 6 Pro 5G, and...

PT-2024-12700 · Tcl +1 · Tcl 30Z +2

Name of the Vulnerable Software and Affected Versions: TCL 30Z versions v5.2120.02.12008.1.T through v5.2120.02.12008.2.T TCL 10L version v3.2014.12.1012.B Description: The issue concerns certain software builds for TCL Android devices that contain a vulnerable pre-installed app. This app relies ...

CVE-2023-38300

CVE-2023-38300 affects the Orbic Maui device (Orbic/RC545L/RC545L:10/ORB545L_V1.4.2_BVZPP/230106:user/release-keys). A high-privilege process leaks non-resettable identifiers by exposing IMEI via persist.sys.verizon_test_plan_imei and ICCID via persist.sys.verizon_test_plan_iccid to system proper...

CVE-2023-38297

CVE-2023-38297 affects the pre-installed com.factory.mmigroup app (version 2.1) on multiple Android devices. The component runs as the system user and exposes zero-permission capabilities to local apps, including arbitrary AT command execution, programmatic factory reset, IMEI/serial leakage, pow...

PT-2024-12696 · Motorola +1 · Motorola Moto G Pure +3

Name of the Vulnerable Software and Affected Versions: TCL 30Z affected versions not specified TCL 10L affected versions not specified Motorola Moto G Pure affected versions not specified Motorola Moto G Power affected versions not specified Description: An issue was discovered in a third-party...

CVE-2023-38297

An issue was discovered in a third-party com.factory.mmigroup component, shipped on devices from multiple device manufacturers. Certain software builds for various Android devices contain a vulnerable pre-installed app with a package name of com.factory.mmigroup versionCode='3', versionName='2.1...

CVE-2023-38294

Certain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsion.autotest.factory versionCode='7', versionName='1.8.02203101027' that allows local third-party apps to execute arbitrary shell commands in its context syst...

CVE-2023-38293

Certain software builds for the Nokia C200 and Nokia C100 Android devices contain a vulnerable, pre-installed app with a package name of com.tracfone.tfstatus versionCode='31', versionName='12' that allows local third-party apps to execute arbitrary AT commands in its context radio user via AT...

CVE-2023-38295

Certain software builds for the TCL 30Z and TCL 10 Android devices contain a vulnerable, pre-installed app that relies on a missing permission that provides no protection at runtime. The missing permission is required as an access permission by components in various pre-installed apps. On the TCL...

PT-2024-12697 · Google +1 · Android +1

Name of the Vulnerable Software and Affected Versions: TCL 20XE Android device versions with software build fingerprints TCL/5087Z BO/Doha TMO:11/RP1A.200720.011/PB7I-0:user/release-keys and TCL/5087Z BO/Doha TMO:11/RP1A.200720.011/PB83-0:user/release-keys Description: The issue concerns a...

CVE-2023-38292

Certain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmenuproxy versionCode='2', versionName='v11.0.1.0.0201.0' that allows local third-party apps to programmatically perform a factory reset due to inadequate acces...

How Attackers Can Own a Business Without Touching the Endpoint

Attackers are increasingly making use of "networkless" attack techniques targeting cloud apps and identities. Here's how attackers can and are compromising organizations – without ever needing to touch the endpoint or conventional networked systems and services. Before getting into the details of...

Oracle Application Testing Suite (April 2024 CPU)

The versions of Oracle Application Testing Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory: - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager component: Load Testing for Web Apps...

OpenJDK: long Exception message leading to crash (8319851)

A flaw was found in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalV...

Mattermost Mobile Apps 安全漏洞

Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. A security vulnerability exists in Mattermost Mobile Apps version 2.13.0 and earlier, which stems from the use of polynomial regular expressions to parse certain deep links, allowing an unauthenticated, remote attacker ...

Texting Secrets: How Messenger Apps Guard Your Chats

By Uzair Amir Worried about prying eyes? We explain how messenger apps keep your chats confidential with features like encryption & multi-factor authentication. Learn about security risks & emerging technologies for a safer digital future. This is a post from HackRead.com Read the original post:...

Windows Apps Vulnerable to Command Injection via “BatBadBut” Flaw

By Deeba Ahmed Critical 'BatBadBut' Flaw in Windows Lets Hackers Inject Commands Patch Now! This is a post from HackRead.com Read the original post: Windows Apps Vulnerable to Command Injection via "BatBadBut" Flaw...