CVE-2022-36871

Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent...

CVE-2022-36870

Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent...

CVE-2022-36875

Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 allows attacker to access the file without permission...

ShirneCMS 路径遍历漏洞

ShirneCMS is an open source backend management system of Shirne Software Shirnecn. ShirneCMS version 1.2.0 has a path traversal vulnerability. Attackers use this vulnerability to read arbitrary files via /static/ueditor/php/controller.php...

CVE-2022-36871: Improper Authorization

Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent...

PT-2022-23675 · Samsung · Samsung Pay

Name of the Vulnerable Software and Affected Versions: Samsung Pay versions prior to 5.0.63 for KR and 5.1.47 for Global Description: The issue allows attackers to access files without permission via implicit Intent, exploiting a Pending Intent hijacking vulnerability in NotiCenterUtils...

PT-2022-23668 · Samsung · Samsung Email

Name of the Vulnerable Software and Affected Versions: Samsung Email versions prior to 6.1.70.20 Description: The issue is related to improper access control and intent redirection, allowing an attacker to access a specific formatted file and execute privileged behavior. Recommendations: For...

CVE-2022-36872: Improper Authorization

Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent...

CVE-2022-36869: Improper Access Control

Improper access control vulnerability in ContactsDumpActivity of?Contacts Provider prior to version 12.7.59 allows attacker to access the file without permission...

CVE-2022-36870: Improper Authorization

Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent...

PT-2022-23679 · Unknown · Waterplugin

Name of the Vulnerable Software and Affected Versions: Waterplugin versions prior to 2.2.11.22081151 Description: The issue is related to improper restriction of broadcasting Intent in SaWebViewRelayActivity, allowing an attacker to access files without permission. Recommendations: For versions...

SmartVista Cardgen 路径遍历漏洞

SmartVista Cardgen is a complete subsystem for magnetic and smart chip EMV card personalization from SmartVista. A security vulnerability exists in SmartVista Cardgen version v3.28.0, which stems from a problem with the IGB file and OutfileService functionality that allows an attacker to list and...

ovirt-log-collector: RHVM admin password is logged unfiltered

A flaw was found in the ovirt-log-collector, which led to the logging of plaintext passwords in the log file. This flaw allows an attacker with sufficient privileges to read the log file, leading to a loss of confidentiality...

Path Traversal

github.com/golang/go is vulnerable to path traversal. The vulnerability exists because the JoinPath function of url.go does not properly remove the relative elements from the start of the path when the first path element is "", allowing an attacker to access files outside the expected directory...

Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.9

Summary Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 8.0.0.9 and IBM WebSphere Application Server Hypervisor 8.0.0.9 Vulnerability Details CVE ID:CVE-2013-6323 PI04777 and PI04880 DESCRIPTION: The Administration Console of IBM WebSphere Application...

CVE-2022-36082 mangadex-downloader vulnerable to unauthorized file reading

mangadex-downloader is a command-line tool to download manga from MangaDex. When using file: command and is a web URL location http, https, mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains...

mangadex-downloader 输入验证错误漏洞

mangadex-downloader is a command line tool for downloading comics from MangaDex by the individual developer Rahman Yusuf. An input validation error vulnerability exists in versions of mangadex-downloader prior to 1.7.2, which stems from an attempt to open and read a file on local disk for each li...

PT-2022-23171 · Unknown · Mangadex-Downloader

Name of the Vulnerable Software and Affected Versions: mangadex-downloader versions 1.3.0 through 1.7.2 Description: The issue occurs when using the file: command with a web URL location, causing the mangadex-downloader to attempt to open and read a file on the local disk for each line of website...

CVE-2022-36082: Improper Input Validation

mangadex-downloader is a command-line tool to download manga from MangaDex. When using file: command and is a web URL location http, https, mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains...

CVE-2022-2434 String Locator <= 2.5.0 - Cross-Site Request Forgery to PHAR Deserialization

The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and including 2.5.0. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site...