134 matches found
CVE-2024-38353 CodiMD - Missing Image Access Controls and Unauthorized Image Access
CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing an unauthenticated attacker to gain unauthorised access to image data uploaded to CodiMD. CodiMD does not require valid authentication to...
PT-2024-25414 · Siemens · Simcenter Femap
Name of the Vulnerable Software and Affected Versions: Simcenter Femap versions prior to V2406 Description: A vulnerability has been identified in the affected applications, which contain an out of bounds read past the end of an allocated structure while parsing specially crafted BMP files. This...
PT-2024-12854 · Softwarex · Softwarex
Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue is related to a confused deputy in the applyCustomDescription function of SaveUi.java, allowing an attacker to view other users' images. This could lead to local information...
SAMSUNG Mobile devices security vulnerability
SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices, which stems from a security issue in Samsung Gallery that could allow a physical attacker to...
CVE-2023-40081
In loadMediaDataInBgForResumption of MediaDataManager.kt, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2023-27256 · Google · Android
Name of the Vulnerable Software and Affected Versions: MediaDataManager.kt affected versions not specified Description: The issue is related to a confused deputy in the loadMediaDataInBgForResumption function of MediaDataManager.kt, allowing potential access to another user's images. This could...
PT-2023-27265 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue is related to a confused deputy in the verifyShortcutInfoPackage function of ShortcutService.java. This could lead to local information disclosure, allowing an attacker to see...
CVE-2023-40134
In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2023-27290 · Fillui · Fillui
Name of the Vulnerable Software and Affected Versions: FillUi affected versions not specified Description: The issue in FillUi allows an attacker to view another user's images due to a confused deputy, potentially leading to local information disclosure without requiring additional execution...
CVE-2023-21291
In visitUris of Notification.java, there is a possible way to reveal image contents from another user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation...
GHSA-64X5-55RW-9974 cross-site inclusion (XSSI) of files in jupyter-server
Impact Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". Patches Jupyter Server 2.7.2 Workarounds Use lower performance...
PT-2023-24379 · Unknown +1 · Erofs-Utils +1
Name of the Vulnerable Software and Affected Versions: erofs-utils version 1.6 Description: The issue is related to a Heap Buffer Overflow in the erofsfsck dirent iter function in fsck/main.c. This allows remote attackers to execute arbitrary code via a crafted erofs filesystem image...
CVE-2023-31679
Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter...
Improper access control
Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter...
PT-2023-23416 · Videogo · Videogo
Name of the Vulnerable Software and Affected Versions: Videogo version 6.8.1 Description: The issue is related to incorrect access control, allowing attackers to access images from other devices by modifying the Device Id parameter. Recommendations: For Videogo version 6.8.1, update to a version...
CVE-2022-25275
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However,...
SUSE CVE-2008-5012
Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are no...
SUSE CVE-2010-1190
thumb.php in MediaWiki before 1.15.2, when used with access-restriction mechanisms such as imgauth.php, does not check user permissions before providing scaled images, which allows remote attackers to bypass intended access restrictions and read private images via unspecified manipulations...
CVE-2023-20912
In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
CVE-2023-20912
In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...