CVE-2024-36062

The com.callassistant.android aka AI Call Assistant & Screener application 1.174 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.callassistant.android.ui.call.incall.InCallActivity component...

CVE-2024-36064

The NLL com.nll.cb aka ACR Phone application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.nll.cb.dialer.dialer.DialerActivity component...

CVE-2024-36064

The CVE concerns the NLL com.nll.cb (ACR Phone) Android app, up to version 0.330-playStore-NoAccessibility-arm8. The vulnerability is that any installed app with no permissions can trigger a call by sending a crafted intent to the DialerActivity (com.nll.cb.dialer.dialer.DialerActivity), enabling...

CVE-2024-36063

The Goodwy com.goodwy.dialer aka Right Dialer application through 5.1.0 for Android enables any application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.goodwy.dialer.activities.DialerActivity component...

PT-2024-26875 · Unknown · Com.Goodwy.Dialer

Name of the Vulnerable Software and Affected Versions: com.goodwy.dialer aka Right Dialer versions through 5.1.0 Description: The issue allows any application to place phone calls without user interaction by sending a crafted intent via the com.goodwy.dialer.activities.DialerActivity component...

CVE-2024-36063

Summary: CVE-2024-36063 affects the Android app Goodwy Right Dialer (com.goodwy.dialer) up to version 5.1.0. Root cause: the DialerActivity component accepts a crafted intent that enables any app (no permissions) to initiate phone calls without user interaction. Impact: unauthenticated phone call...

CVE-2024-36062

The CVE-2024-36062 affects the Android app com.callassistant.android (AI Call Assistant & Screener) v1.174. A crafted intent sent to com.callassistant.android.ui.call.incall.InCallActivity from any installed app (no permissions required) enables placing a phone call without user interaction. This...

CVE-2024-36063

The Goodwy com.goodwy.dialer aka Right Dialer application through 5.1.0 for Android enables any application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.goodwy.dialer.activities.DialerActivity component...

CVE-2024-36064

The NLL com.nll.cb aka ACR Phone application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.nll.cb.dialer.dialer.DialerActivity component...

GHSA-JJXQ-FF2G-95VH Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled

Description In a sandbox, and attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the isset method is now called after the security check. This is a BC break. Resolution The sandbox mode now ensures...

GHSA-6377-HFV9-HQF6 Twig has unguarded calls to `__toString()` when nesting an object into an array

Description In a sandbox, an attacker can call toString on an object even if the toString method is not allowed by the security policy when the object is part of an array or an argument list arguments to a function or a filter for instance. Resolution The sandbox mode now checks the toString meth...

Twig has unguarded calls to `__toString()` when nesting an object into an array

Description In a sandbox, an attacker can call toString on an object even if the toString method is not allowed by the security policy when the object is part of an array or an argument list arguments to a function or a filter for instance. Resolution The sandbox mode now checks the toString meth...

CVE-2024-51754 Unguarded calls to __toString() when nesting an object into an array in Twig

Twig is a template language for PHP. In a sandbox, an attacker can call toString on an object even if the toString method is not allowed by the security policy when the object is part of an array or an argument list arguments to a function or a filter for instance. This issue has been patched in...

SUSE CVE-2024-7883

When using Arm Cortex-M Security Extensions CMSE, Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns a floating-point value and when this is the first use of floating-point since entering Secure state...

PT-2024-34885 · Twig +3 · Twig +3

Name of the Vulnerable Software and Affected Versions: Twig versions prior to 3.11.2 Twig versions prior to 3.14.1 Description: In a sandbox, an attacker can call toString on an object even if the toString method is not allowed by the security policy when the object is part of an array or an...

DEBIAN-CVE-2024-50093

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int340x: processor: Fix warning during module unload The processorthermal driver uses pcimdeviceenable to enable a PCI device, which means the device will be automatically disabled on driver detach. Thus there is ...

CVE-2024-50093 thermal: intel: int340x: processor: Fix warning during module unload

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int340x: processor: Fix warning during module unload The processorthermal driver uses pcimdeviceenable to enable a PCI device, which means the device will be automatically disabled on driver detach. Thus there is ...

CVE-2024-50093

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int340x: processor: Fix warning during module unload The processorthermal driver uses pcimdeviceenable to enable a PCI device, which means the device will be automatically disabled on driver detach. Thus there is ...

CVE-2024-38419

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node...

CVE-2024-38419

CVE-2024-38419 corresponds to memory corruption when invoking IOCTL calls from user-space for the HGSL memory node in Qualcomm chipsets. The issue affects a memory node in HGSL, with a local attack vector and low privileges required; exploitation status is not detailed in the provided documents. ...