CVE-2022-38194

The CVE-2022-38194 entry affects Esri Portal for ArcGIS version 10.8.1, where a system property is not properly encrypted, potentially allowing a local user to read sensitive information from a properties file. The connected PT-2022-24271 entry reinforces this by recommending updating Esri Portal...

CVE-2020-10710

CVE-2020-10710 affects Red Hat Satellite components (Candlepin) where the plaintext Candlepin password can be disclosed during updates via the satellite-installer. The flaw enables an attacker with sufficiently high privileges (e.g., root) to retrieve the Candlepin plaintext password, with confid...

CVE-2022-37441

...

Black Hat and DEF CON Roundup

There was nothing typical this year at BSides LV, Black Hat USA and DEF CON – also known collectively as Hacker Summer Camp. The weeklong collection of cybersecurity conferences featured an eclectic mix of attendees to learn, network, hack and have fun. The week even included a rare Las Vegas fla...

CVE-2022-2818

The CVE-2022-2818 entry concerns Cockpit/Cockpit Content Platform prior to version 2.2.2, where an authentication vulnerability allows bypassing 2FA. The GitHub/GHSA advisory and related OSV/NVD entries confirm that the issue enables unauthorized access and, in some reports, exposure of the 2FA s...

CVE-2022-2379

CVE-2022-2379 affects the WordPress Easy Student Results plugin (versions ≤ 2.2.8). The REST API lacks proper authorization, allowing unauthenticated users to retrieve sensitive data: courses, exams, departments, student grades, and PII (email, physical address, phone). The CVSSv3.1 base score is...

CVE-2020-21365

CVE-2020-21365 affects wkhtmltopdf up to version 0.12.5, enabling a directory traversal that allows reading local files via crafted HTML processed with default settings. Public advisories from Debian, Mageia, and Ubuntu confirm the vulnerability and note fixes/remediations: Debian DLA-3158 and US...

Threat Source newsletter (Aug. 11, 2022) — All of the things-as-a-service

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. Everyone seems to want to create the next “Netflix” of something. Xbox’s Game Pass is the “Netflix of video games.” Rent the Runway is a “Netflix of fashion” where customers subscribe to a rotation of fancy clothes. A...

CVE-2022-20342

CVE-2022-20342 affects Android 13. An insecure default in WiFi could disclose the WiFi password to the end user, enabling local information disclosure without extra privileges or user interaction. The issue is categorized under Android 13 security release notes; no exploitation details or active ...

CVE-2022-20296

This CVE affects Android 13 ContentService. The issue is a missing permission check that allows an attacker with local access to determine whether an account exists on the device, enabling local information disclosure. Exploitation is rated as LOCAL with LOW exploit complexity and requires LOW pr...

CVE-2022-20284

CVE-2022-20284 affects Android 13 Telephony. A missing permission check enables local information disclosure of phone accounts; no user interaction is required. Exploitation requires user privileges (LOW) and local access (UI:N). Impact is confined to confidentiality (HIGH); integrity/availabilit...

CVE-2022-20278

CVE-2022-20278 affects Android 13, in Accounts, due to insufficient log filtering that could write sensitive data to the system log. This enables local information disclosure with system privileges, no user interaction required. The issue is addressed in Android 13 security fixes; devices with pa...

CVE-2022-20407

Product: AndroidVersions: Android kernelAndroid ID: A-210916981References: N/A...

CVE-2022-20406

Product: AndroidVersions: Android kernelAndroid ID: A-184676385References: N/A...

CVE-2022-20272

CVE-2022-20272 affects Android 13 and is tied to the PermissionController component. The issue stems from misleading text about the default SMS app’s permission set, which could lead to local information disclosure. Impact is limited to information exposure with user privileges required and explo...

CVE-2022-20252

CVE-2022-20252 is a vulnerability in Android 13’s PackageManager where an attacker can deduce whether an app is installed without query permissions due to a side-channel information disclosure. This enables local information disclosure with no extra execution privileges required; exploitation req...

CVE-2022-20241

CVE-2022-20241 affects Android 13 Messaging, where improper input validation allows attaching a private file to an SMS, enabling local information disclosure without extra privileges. Impact is Information Disclosure (C) with Local attack vector and no user interaction required per NVD metrics (C...

CVE-2022-20381

Summary (concrete details available): CVE-2022-20381 is mapped to the Android kernel in Google Pixel devices and is classified as an Elevation of Privilege (EoP) issue within the kernel component. The vulnerability is tracked in the NVD entry with a high-impact profile (CVSSv3.1: CVSS:3.1/AV:N/AC...

PT-2022-14591 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel affected versions not specified Description: The issue affects the Android kernel. No further details are provided about the nature of the problem or its potential impact. Recommendations: At the moment, there is no information...

CVE-2022-34659

The CVE-2022-34659 vulnerability affects Simcenter STAR-CCM+ (all versions) when the Power-on-Demand public license server is used. The issue is an information disclosure where applications expose the user, host, and display name of users, enabling an attacker to retrieve this data. Mitigations f...