CVE-2020-1984

Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with ‘create folders or append data’ access to the root of the OS disk C: to gain system privileges if the path does not already exist or is writable. This issue affects all versions of Secdo f...

CVE-2018-21056: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered on Samsung mobile devices with O8.x software. The Smartwatch displays Secure Folder Notification content. The Samsung ID is SVE-2018-12458 September 2018...

CVE-2018-21062: Improper Authentication

An issue was discovered on Samsung mobile devices with N7.x and O8.x software. When biometric authentication is disabled, an attacker can view Streams content e.g., a Gallery slideshow of a locked Secure Folder via a connection to an external device. The Samsung ID is SVE-2018-11766 August 2018...

CVE-2018-21068: Improper Input Validation

An issue was discovered on Samsung mobile devices with O8.0 software. Execution of an application in a locked Secure Folder can occur without a password via a split screen. The Samsung ID is SVE-2018-11669 July 2018...

CVE-2018-21038: Improper Authentication

An issue was discovered on Samsung mobile devices with N7.x software. The Secure Folder app's startup logic allows authentication bypass. The Samsung ID is SVE-2018-11628 December 2018...

CVE-2020-11601: Undefined Security Weakness

An issue was discovered on Samsung mobile devices with P9.0 and Q10.0 software. There is unauthorized access to applications in the Secure Folder via floating icons. The Samsung ID is SVE-2019-16195 April 2020...

PT-2020-8700

Name of the Vulnerable Software and Affected Versions Samsung mobile devices with O8.x software Description An issue was discovered where the Smartwatch displays Secure Folder Notification content on Samsung mobile devices. Recommendations For Samsung mobile devices with O8.x software, consider...

PT-2020-8682

Name of the Vulnerable Software and Affected Versions Samsung mobile devices with N7.x software Description An issue was discovered that allows authentication bypass in the Secure Folder app's startup logic. Recommendations For Samsung mobile devices with N7.x software, consider disabling the...

PT-2020-8706

Name of the Vulnerable Software and Affected Versions Samsung mobile devices with N7.x software Samsung mobile devices with O8.x software Description An issue allows an attacker to view Streams content, such as a Gallery slideshow, of a locked Secure Folder on a Samsung mobile device when biometr...

CVE-2018-21041: Missing Authentication for Critical Function

An issue was discovered on Samsung mobile devices with O8.x software. Access to Gallery in the Secure Folder can occur without authentication. The Samsung ID is SVE-2018-13057 December 2018...

PT-2020-12717

Name of the Vulnerable Software and Affected Versions Samsung mobile devices with P9.0 and Q10.0 software Description An issue allows unauthorized access to applications in the Secure Folder via floating icons. Recommendations For Samsung mobile devices with P9.0 software, update to a version tha...

CVE-2020-11606: Undefined Security Weakness

An issue was discovered on Samsung mobile devices with Q10.0 software. Information about application preview in the Secure Folder leaks on a locked device. The Samsung ID is SVE-2019-16463 April 2020...

CVE-2020-7613

clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the isclamavbinary function located within Index.js. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that wil...

CVE-2020-7613

clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the isclamavbinary function located within Index.js. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that wil...

Unspecified vulnerability in CIPPlanner CIPAce (CNVD-2020-21817)

CIPPlanner CIPAce is a suite of business process automation and application development platforms from the US-based CIPPlanner. A security vulnerability exists in CIPPlanner CIPAce version 9.1 Build 2019092801. An attacker can exploit the vulnerability by sending an API request to obtain the uplo...

CVE-2020-11595

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the upload folder path that includes the hostname in a UNC path...

Path traversal

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the upload folder path that includes the hostname in a UNC path...

CVE-2020-11595

An unauthenticated attacker can invoke the CIPPlanner CIPAce 9.1 Build 2019092801 API and obtain an upload folder path that reveals the hostname in a UNC path, indicating information disclosure via the API endpoint handling uploads. Affected product: CIPPlanner CIPAce (9.1, build 2019092801). Roo...

CVE-2020-11595

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the upload folder path that includes the hostname in a UNC path...

PT-2020-12711

Name of the Vulnerable Software and Affected Versions CIPPlanner CIPAce version 9.1 Build 2019092801 Description An issue allows an unauthenticated attacker to make an API request to obtain the upload folder path, which includes the hostname in a UNC path. Recommendations For CIPPlanner CIPAce...