CVE-2021-25441

Improper input validation vulnerability in AR Emoji Editor prior to version 4.4.03.5 in Android Q10.0 and above allows untrusted applications to access arbitrary files with an escalated privilege...

Input validation

Improper input validation vulnerability in AR Emoji Editor prior to version 4.4.03.5 in Android Q10.0 and above allows untrusted applications to access arbitrary files with an escalated privilege...

Improper access control

Improper access control vulnerability in FactoryCameraFB prior to version 3.4.74 allows untrusted applications to access arbitrary files with an escalated privilege...

CVE-2021-25441

Improper input validation vulnerability in AR Emoji Editor prior to version 4.4.03.5 in Android Q10.0 and above allows untrusted applications to access arbitrary files with an escalated privilege...

CVE-2021-25440

Improper access control vulnerability in FactoryCameraFB prior to version 3.4.74 allows untrusted applications to access arbitrary files with an escalated privilege...

Samsung Mobile AR Emoji Editor 输入验证错误漏洞

Samsung AR Emoji Editor is an emoji editor from Samsung South Korea. An input validation error vulnerability exists in Samsung Mobile AR Emoji Editor. An attacker could use this vulnerability to allow an untrusted application to access arbitrary files with escalated privileges...

Privilege escalation

A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0dc, the first dword passed in the input buffer is the device port to write to and the word at offset 4 is the value to write via...

Cross site scripting

Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's ListItem component used in the pages and files section for example displayed HTML in page titles as it is. This could be used for cross-site scripting XSS attacks. Malicious authenticated Panel users can...

Samsung CallBGProvider Improper Access Control Vulnerability

Samsung CallBGProvider is an app from Samsung South Korea. A security vulnerability exists in Samsung CallBGProvider that stems from CallBGProvider's failure to properly access control components in CallBGProvider prior to SMR JUN-2021 Release 1 version. A local attacker can exploit the...

Spy Emergency 25.0.650 - (Multiple) Unquoted Service Path Vulnerability

Exploit Title: Spy Emergency 25.0.650 - Unquoted Service Path Discovery by: Erick Galindo Vendor Homepage: https://www.spy-emergency.com/ Software Link: https://www.spy-emergency.com/download/download.php?id=1 Tested Version: 25.0.650.0 Vulnerability Type: Unquoted Service Path Tested on OS:...

Spy Emergency 25.0.650 - 'Multiple' Unquoted Service Path

Exploit Title: Spy Emergency 25.0.650 - Unquoted Service Path Discovery by: Erick Galindo Discovery Date: 2021-06-11 Vendor Homepage: https://www.spy-emergency.com/ Software Link: https://www.spy-emergency.com/download/download.php?id=1 Tested Version: 25.0.650.0 Vulnerability Type: Unquoted...

Spy Emergency 25.0.650 Unquoted Service Path

Exploit Title: Spy Emergency 25.0.650 - Unquoted Service Path Discovery by: Erick Galindo Discovery Date: 2021-06-11 Vendor Homepage: https://www.spy-emergency.com/ Software Link: https://www.spy-emergency.com/download/download.php?id=1 Tested Version: 25.0.650.0 Vulnerability Type: Unquoted...

CVE-2021-25410

Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files with an escalated privilege...

Improper access control

Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files with an escalated privilege...

CVE-2021-25410

Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files with an escalated privilege...

Samsung Mobile CallBGProvider 访问控制错误漏洞

Samsung CallBGProvider is an app from Samsung South Korea. A security vulnerability exists in Samsung CallBGProvider that stems from CallBGProvider's failure to properly access control components in CallBGProvider prior to SMR JUN-2021 Release 1 version. A local attacker can exploit the...

Insufficient Session Expiration in OpenStack Keystone

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. Th...

DiskBoss Service 12.2.18 - (diskbsa.exe) Unquoted Service Path Vulnerability

Exploit Title: DiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service Path Discovery by: Erick Galindo Vendor Homepage: https://www.diskboss.com Software : https://www.diskboss.com/setupsx64/diskbosssetupv12.2.18x64.exe Tested Version: 12.2.18 Vulnerability Type: Unquoted Service Path Tested o...

DiskBoss Service 12.2.18 Unquoted Service Path

Exploit Title: DiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service Path Discovery by: Erick Galindo Discovery Date: 2021-05-21 Vendor Homepage: https://www.diskboss.com Software : https://www.diskboss.com/setupsx64/diskbosssetupv12.2.18x64.exe Tested Version: 12.2.18 Vulnerability Type:...

BOOTP Turbo 2.0.0.1253 - (bootpt.exe) Unquoted Service Path Vulnerability

Exploit Title: BOOTP Turbo 2.0.0.1253 - 'bootpt.exe' Unquoted Service Path Discovery by: Erick Galindo Vendor Homepage: https://www.weird-solutions.com Software : https://www.weird-solutions.com/download/products/bootptdemox64.exe Tested Version: 2.0.0.1253 Vulnerability Type: Unquoted Service Pa...