Information disclosure

In ContentService, there is a possible way to check if an account exists on the device due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

PT-2022-18776 · Sourcecodester · Sourcecodester Loan Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Zoo Management System affected versions not specified Description: A critical issue has been found in the SourceCodester Zoo Management System, allowing for unrestricted file upload. This is due to the manipulation of the...

Google Android security vulnerabilities

Google Android is a Linux-based open source operating system from the American company Google. A security vulnerability exists in Google Android 13, which stems from a possible method to determine if an application is installed without querying permissions due to side channel information leakage ...

CVE-2022-20320

CVE-2022-20320 affects Android 13 and involves the ActivityManager. The issue enables a local attacker to infer whether an app is installed without query permissions, via a side-channel information disclosure. The exploitation is described as requiring local access (no user interaction) and not n...

CVE-2022-20307

Summary (CVE-2022-20307) : In Android 13, AlarmManagerService allows a side-channel leakage that can reveal whether an app is installed without query permissions, enabling local information disclosure with no extra execution privileges and no user interaction. Affected : Android 13 (AlarmManagerS...

CVE-2022-20251

In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-20242

In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

Information disclosure

In USB Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure of installed packages with no additional execution privileges needed. User interaction is not...

CVE-2022-20272

In PermissionController, there is a possible misunderstanding about the default SMS application's permission set due to misleading text. This could lead to local information disclosure with User privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

CVE-2022-20261

The CVE-2022-20261 entry concerns the Android LocationManager component. A missing permission check could allow an attacker to obtain location information, causing local information disclosure. Exploitation requires System privileges but not user interaction, with a local attack vector. Affected ...

CVE-2022-2736

creationtimestamp| type| source ---|---|--- 2022-08-11 12:32:04+00:00| seen| https://t.me/cibsecurity/47939...

PT-2022-9127 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android version 13 Description: In PackageManager, there is a possible way to get information about installed packages ignoring limitations introduced in Android 11 due to a missing permission check. This could lead to local information...

CVE-2022-20346

In updateAudioTrackInfoFromESDSMPEG4Audio of MPEG4Extractor.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

Malicious Package

Overview pancake-info-api is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

PT-2022-37173 · Git +1 · Ndpi

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash, specifically a Segv on an unknown address. The crash state includes functions such as ndpi free flow data, ndpi flow fre...

CVE-2022-35821

CVE-2022-35821 affects Microsoft Azure Sphere. The Azure Sphere Information Disclosure Vulnerability is due to insufficient protection of service data in the Azure Sphere OS. CVSSv3 metrics in the initial record indicate a Medium severity (4.4), with Local attack vector, Low attack complexity, an...

CVE-2022-30197

Technical details for CVE-2022-30197 are not provided in the supplied documents. Public information appears limited to a generic Windows Kernel information disclosure context; monitor official advisories and vendor updates for any concrete details or fixes.

CVE-2022-30134

CVE-2022-30134 is documented as an Exchange Server vulnerability linked to August 2022 updates. Connected sources list affected products as Microsoft Exchange Server 2016 CU23, 2019 CU11/CU12, and 2019 CU12 variants, with the update KB5015322 describing it among vulnerabilities fixed in that roll...

subscription-manager bug fix and enhancement update

An update is available for subscription-manager. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The subscription-manager packages provide programs and libraries...

Malicious code in pancake-info-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0443a608b4568e8dc8b0e39a3b58804dac2a63c570a30f7752c5ca6ba41ce8d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...