CVE-2020-22475

"Tasks" application version before 9.7.3 is affected by insecure permissions. The VoiceCommandActivity application component allows arbitrary applications on a device to add tasks with no restrictions...

Design/Logic Flaw

A vulnerability in the automatic update process of Cisco Umbrella Roaming Client for Windows could allow an authenticated, local attacker to install arbitrary, unapproved applications on a targeted device. The vulnerability is due to insufficient verification of the Windows Installer. An attacker...

CVE-2019-16000 Cisco Umbrella Roaming Client for Windows Install Vulnerability

A vulnerability in the automatic update process of Cisco Umbrella Roaming Client for Windows could allow an authenticated, local attacker to install arbitrary, unapproved applications on a targeted device. The vulnerability is due to insufficient verification of the Windows Installer. An attacker...

CVE-2019-16000

CVE-2019-16000 affects the Cisco Umbrella Roaming Client for Windows. The issue is in the automatic update process where Windows Installer verification is insufficient, allowing an authenticated, local attacker to place a file in a specific location and bypass policy to install unapproved applica...

CVE-2019-20597

An issue was discovered on Samsung mobile devices with N7.1, O8.x, and P9.0 software. SPENgesture allows arbitrary applications to read or modify user-input logs. The Samsung ID is SVE-2019-14170 June 2019...

Code injection

An issue was discovered on Samsung mobile devices with N7.1, O8.x, and P9.0 software. SPENgesture allows arbitrary applications to read or modify user-input logs. The Samsung ID is SVE-2019-14170 June 2019...

CVE-2019-20597

CVE-2019-20597 affects Samsung mobile devices running N(7.1), O(8.x), and P(9.0). The vulnerability exists in the SPENgesture component, which can allow arbitrary applications to read or modify user-input logs. This impacts confidentiality and integrity (CVSSv3.1: 9.1, CRITICAL; CVSSv2: 6.4, MEDI...

CVE-2020-6797

By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is restricted as they are unable to download non-quarantined files or supply command line arguments to the application, limiting the impact...

Cisco Umbrella Roaming Client for Windows Install Vulnerability

A vulnerability in the automatic update process of Cisco Umbrella Roaming Client for Windows could allow an authenticated, local attacker to install arbitrary, unapproved applications on a targeted device. The vulnerability is due to insufficient verification of the Windows Installer. An attacker...

ASUS ZenFone 3 Max has an unspecified vulnerability

ASUS ZenFone 3 Max is an Android-based smartphone from ASUS. Pre-installation in ASUS ZenFone 3 Max Build fingerprint used is asus/USPhone/ASUSX0081:7.0/NRD90M/USPhone-14.14.1711.92-20171208:user/release-keys A security vulnerability exists in the com.asus.dm.installer.DMInstallerService service ...

NordVPN Elevation of Privilege Vulnerability

NordVPN for Windows is a Windows-based VPN software for anonymous access to the Internet. A lifting vulnerability in version 6.12.7.0 of NordVPN for Windows-based platforms stems from a NetNamedPipe endpoint created by the 'nordvpn-service' service that allows arbitrary installed applications to...

Privilege escalation

VPN Unlimited 4.2.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper tool implements an XPC interface, which allows arbitrary applications to execute system commands as root...

HP Instant Support 1.0.22 - 'HPISDataManager.dll' 'StartApp' ActiveX Control Insecure Method Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/29533/info HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to an insecure-method vulnerability. Successfully exploiting this issue allows remote attackers to launch arbitrary applications with the...

Code injection

Console in Apple Mac OS X before 10.9 allows user-assisted remote attackers to execute arbitrary applications by triggering a log entry with a crafted attached URL...

CVE-2013-5168

CVE-2013-5168 affects Apple Mac OS X before 10.9. The vulnerability in the Console component allows a user-assisted remote attacker to execute arbitrary applications by triggering a log entry with a crafted attached URL. This payload mechanism relies on the Console/logging workflow to run arbitra...

Open redirect

Apple iOS 6.1.3 does not follow redirects during determination of the hostname to display in an iOS Enterprise Deployment installation dialog, which makes it easier for remote attackers to trigger installation of arbitrary applications via a download-manifest itms-services:// URL that leverages a...

Input validation

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to...

JBoss: authentication bypass when running under JACC with ignoreBaseDecision on JBossWebRealm

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to...

JBoss: authentication bypass when running under JACC with ignoreBaseDecision on JBossWebRealm

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to...

JBoss: authentication bypass when running under JACC with ignoreBaseDecision on JBossWebRealm

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to...