Design/Logic Flaw

There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2021-37103

CVE-2021-37103 involves an improper permission management vulnerability in Huawei HUAWEI EMUI/Magic UI Wallet apps (UIWallet). The root cause described across connected records is incorrect handling of privileges by the Wallet UI components, potentially enabling confidentiality impacts on service...

CVE-2021-37103

There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerability may affect service confidentiality...

The vulnerability of the Click-to-Run package services for Microsoft Office and Microsoft 365 Apps for Enterprise allows a perpetrator to execute arbitrary code.

The vulnerability of the Click-to-Run package services for Microsoft Office and Microsoft 365 Apps for Enterprise is related to improper code generation management. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

HUAWEI EMUI安全漏洞

Huawei HUAWEI EMUI is an Android-based mobile operating system developed by Huawei China. HUAWEI EMUI/Magic UI has an improper privilege management vulnerability, which stems from UIWallet apps not properly managing privileges and could be exploited by attackers to affect service confidentiality...

Mobile device monitoring services do not authenticate API requests

Overview The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR Insecure Direct Object Reference vulnerability. These services and their associated apps can be used to perform non-consensual,...

CVE-2021-20315

A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOME extensions are enabled. This flaw allows a physical attacker who has access to a locked system to kill existing applications and start n...

Red Hat CentOS Stream 安全漏洞

Red Hat CentOS Stream is a predevelopment, continuous delivery distribution from Red Hat, Inc. that is positioned midstream between Fedora Linux and RHEL. Red Hat CentOS Stream 8 suffers from a security vulnerability that could be exploited by a physical attacker to gain access to a locked system...

The Unbearable Lightness of Unaudited Supply Chains

An acute need expressed by a majority of CISOs at a roundtable in Italy sparks an idea to use one of our lesser-known compliance apps to manage supply chain security assurance efforts. In the 1984 novel The Unbearable Lightness of Being, author Milan Kundera ponders the fleeting nature of man’s...

ScratchOAuth2 授权问题漏洞

Kenny2github ScratchOAuth2 is a Kenny2github open source application. Verify that a Scratch account is authentic for authorization or identification purposes. ScratchOAuth2 has a security vulnerability that stems from a problem with the key authorization mechanism in the SpecificApps REST API,...

PT-2022-6343 · Microsoft · 365 Apps +1

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Microsoft 365 Apps affected versions not specified Description: The issue is related to a buffer overflow in memory, allowing an attacker to disclose protected information using a specially...

CVE-2022-23997

Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to disable theater mode without a proper permission...

CVE-2022-24923

Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview...

CVE-2022-23998

Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R11, 10.5.03.77 in Android Q10 and 9.0.6.68 in Android P9 allows untrusted applications to take a picture in screenlock status...

CVE-2022-24923

Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview...

CVE-2022-23994

An Improper access control vulnerability in StBedtimeModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to change bedtime mode without a proper permission...

CVE-2022-23996

Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to enable bedtime mode without a proper permission...

CVE-2022-22292

Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity...

CVE-2021-39658

ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permissions of the caller，resulting in permission leaks。Third-party apps can use this service to arbitrarily modify and set system properties。Product:...

PT-2022-16395 · Google · Wear Os

Name of the Vulnerable Software and Affected Versions: Wear OS version 3.0 prior to Firmware update Feb-2022 Release Description: The issue is related to an improper access control in StBedtimeModeReceiver, allowing untrusted applications to change bedtime mode without proper permission...