CVE-2021-1005

In getDeviceIdWithFeature of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User...

CVE-2021-1005

In getDeviceIdWithFeature of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User...

CVE-2021-1013

In checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission of PermissionManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no...

CVE-2021-0995

In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges...

CVE-2021-0994

In requestRouteToHostAddress of ConnectivityService.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interactio...

CVE-2021-0995

In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges...

Information disclosure

In getSerialForPackage of DeviceIdentifiersPolicyService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed...

Description of the security update for Office Web Apps Server 2013: December 14, 2021 (KB5002103)

Description of the security update for Office Web Apps Server 2013: December 14, 2021 KB5002103 Applies To Office Web Apps Server 2013 Summary This security update resolves a Microsoft Excel remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common...

December 14, 2021—KB5008206 (OS Build 18363.1977)

December 14, 2021—KB5008206 OS Build 18363.1977 Applies To Windows 10 Enterprise, version 1909 Windows 10 Enterprise and Education, version 1909 Windows 10 IoT Enterprise, version 1909 EXPIRATION NOTICE As of 9/12/2023, KB5008206 is only available from Windows Update. This update is no longer...

December 14, 2021—KB5008207 (OS Build 14393.4825) - EXPIRED

December 14, 2021—KB5008207 OS Build 14393.4825 - EXPIRED Applies To Windows 10, version 1607, all editions Windows Server 2016, all editions EXPIRATION NOTICE As of 9/12/2023, KB5008207 is no longer available from Windows Update, the Microsoft Update Catalog, or other release channels. We...

KLA12386 Multiple vulnerabilities in Microsoft Apps

Multiple vulnerabilities were found in Microsoft Apps. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Microsoft Office app can be exploited remotely to...

Microsoft Office code injection vulnerability

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A code injection vulnerability exists in Microsoft Office. The following products and edition...

Microsoft Office security vulnerabilities

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A security vulnerability exists in Office Developer Platform. The following products and...

Security update for icu.691 (important)

openSUSE Security Update: Security update for icu.691 Announcement ID: openSUSE-SU-2021:4063-1 Rating: important References: 1158955 1159131 1161007 1162882 1167603 1182252 1182645 SLE-17893 Affected Products: openSUSE Leap 15.3 An update that contains security fixes and contains one feature can...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4JExploitation-VulnerabiliyCVE-2021-44228. !Untitled...

HarmonyOS Privilege Management Error

The vulnerability of HarmonyOS’ system applications is related to privilege management errors. Exploiting this vulnerability allows a malicious actor to remotely change a user’s username...

HarmonyOS Privilege Escalation

The vulnerability of system applications in the HarmonyOS operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to increase their privileges...

Citrix Security Advisory for CVE-2021-44228, CVE-2021-45046, CVE-2021-45105 and CVE-2021-44832.

Citrix is aware offourvulnerabilitiesaffectingApache Log4j2, threeof whichmayallowan attackertoexecute arbitrary code. Thesethreevulnerabilitieshavebeen given the followingidentifiers: CVE-2021-44228 CVE-2021-45046 CVE-2021-44832 Thefourthvulnerabilitymay allowan attackertocause a denial of...

Law Enforcement Access to Chat Data and Metadata

A January 2021 FBI document outlines what types of data and metadata can be lawfully obtained by the FBI from messaging apps. Rolling Stone broke the story and its been written about elsewhere. I dont see a lot of surprises in the document. Lots of apps leak all sorts of metadata: iMessage and...

Chromium: CVE-2021-4052 Use after free in web apps

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...