Google Android CarSetings elevation of privilege vulnerability

Google Android is a Linux-based open source operating system from Google. Google Android CarSetings suffers from an elevation of privilege vulnerability that stems from a lack of privilege checking. An attacker exploits the vulnerability to bypass user consent to pair a BT device, resulting in a...

AlmaLinux 8 : flatpak (ALSA-2022:1792)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:1792 advisory. - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions...

CVE-2021-39738

In CarSetings, there is a possible to pair BT device bypassing user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10...

CVE-2021-39738

In CarSetings, there is a possible to pair BT device bypassing user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10...

Design/Logic Flaw

In CarSetings, there is a possible to pair BT device bypassing user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10...

flatpak: Permissions granted to applications can be hidden from the user at install time

An incorrect authorization vulnerability was found in Flatpak. Flatpak does not properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime in the case that there's a null byte in the metadata file of an app...

Google Android CarSetings 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android CarSetings suffers from an elevation of privilege vulnerability that stems from a lack of privilege checking. An attacker exploits the vulnerability to bypass user consent to pair a BT device, resulting in a...

A week in security (April 25 – May 1)

Last week on Malwarebytes Labs: Why MITRE matters to SMBs Apple’s child safety features are coming to a Messages app near you Why software has so many vulnerabilities, with Tanya Janca: Lock and Code S03E09 Watch out for this SMS phish promising a tax refund Rogue ads phishing for cryptocurrency:...

Android Automotive OS Update Bulletin—May 2022Stay organized with collectionsSave and categorize content based on your preferences.

The Android Automotive OS AAOS Update Bulletin contains details of security vulnerabilities affecting the Android Automotive OS platform. The full AAOS update comprises the security patch level of 2022-05-05 or later from the May 2022 Android Security Bulletin in addition to all issues in this...

“Reject All” cookie consent button is coming to European Google Search and YouTube

Google will soon be giving European countries a "Reject All" button in the Search and YouTube cookie consent banner. This change, which was revealed by Googles Product Manager for Privacy, Safety & Security Sammit Adhya in a blog post, has already been rolled out in France and will be cascaded to...

Google Android has an unspecified vulnerability (CNVD-2022-55157)

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android, which stems from a lack of permission checking in the setup of AndroidManifest.xml, which could allow pairing of Bluetooth devices without user consent. An attacker...

WordPress Cookie Information - Free GDPR Consent Solution Plugin < 2.0.8 XSS Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-39768

In Settings, there is a possible way to add an auto-connect WiFi network without the user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2021-39768

In Settings, there is a possible way to add an auto-connect WiFi network without the user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

Design/Logic Flaw

In onCreate of SetupLayoutActivity.java, there is a possible way to setup a work profile bypassing user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2022-0147

The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-0147

The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-0147

The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue...

Cross site scripting

The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-0147

The CVE describes a Reflected Cross-Site Scripting vulnerability in the WordPress plugin “Cookie Information / Free GDPR Consent Solution” prior to version 2.0.8. The issue arises because user data is not escaped before being output in admin-dashboard attributes, enabling script injection in the ...