Design/Logic Flaw

Samsung devices with Android KK4.4 or L5.0/5.1 allow local users to cause a denial of service IAndroidShm service crash via crafted data in a service call...

CVE-2016-4546

Samsung devices with Android KK4.4 or L5.0/5.1 allow local users to cause a denial of service IAndroidShm service crash via crafted data in a service call...

Code injection

Array index error in the msmsensorconfig function in kernel/SM-G9008VCHNKKOpensource/Kernel/drivers/media/platform/msm/camerav2/sensor/msmsensor.c in Samsung devices with Android KK4.4 or L and an APQ8084, MSM8974, or MSM8974pro chipset allows local users to have unspecified impact via the...

CVE-2016-4038

The CVE-2016-4038 issue affects Samsung devices running Android KK (4.4) or L on APQ8084, MSM8974, or MSM8974pro, due to an array bounds issue in msm_sensor_config (kernel/drivers/media/platform/msm/camera_v2/sensor/msm_sensor.c). Local users could exploit gpio_config.gpio_name to cause unspecifi...

Code injection

Samsung Note devices with KK4.4, L5.0/5.1, and M6.0 software allow attackers to crash the system by creating an arbitrarily large number of active VR service threads. The Samsung ID is SVE-2016-7650...

CVE-2017-5351

CVE-2017-5351 affects Samsung Note devices running KK (4.4), L (5.0/5.1), and M (6.0). Reported flaw: the system can be crashed by creating an arbitrarily large number of active VR service threads due to a failure to limit these threads. Root cause is described as uncontrolled/unchecked growth of...

KK Launcher -Lollipop launcher - Customized SSL, Exported ContentProvider, Runtime privilege escalation vulnerabilities

HackApp vulnerability scanner discovered that application KK Launcher -Lollipop launcher published at the 'play' market has multiple vulnerabilities...

KK Phone (KK Dialer, Lollipop) - Customized SSL, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application KK Phone KK Dialer, Lollipop published at the 'play' market has multiple vulnerabilities...

KK Contacts (Lollipop Contact) - Customized SSL, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application KK Contacts Lollipop Contact published at the 'play' market has multiple vulnerabilities...

Movable Type Pro 5.13en - Persistent Cross-Site Scripting

Movable Type Pro 5.13en - Persistent Cross-Site Scripting -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Source URL: http://www.cloudscan.me/2012/10/cve-2012-1503-movable-type-pro-513en.html Keywords: CVE-2012-1503, Movable Type Pro 5.13en, Stored XSS, JavaScript Injection, Vendor Unresponsive,...

Movable Type Pro 5.13en - Persistent Cross-Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Source URL: http://www.cloudscan.me/2012/10/cve-2012-1503-movable-type-pro-513en.html Keywords: CVE-2012-1503, Movable Type Pro 5.13en, Stored XSS, JavaScript Injection, Vendor Unresponsive, Full Disclosure Introduction Movable Type MT started as on...

Movable Type Pro 5.13en Cross Site Scripting

Our researchers discovered a persistent XSS vulnerability, allowing an attacker to inject arbitrary script code into the comment section of any existing Mt5.13en installation. Source URL: http://www.cloudscan.me/2012/10/cve-2012-1503-movable-type-pro-513en.html Keywords: CVE-2012-1503, Movable Ty...

Movable Type Pro 5.13en Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Source URL: http://www.cloudscan.me/2012/10/cve-2012-1503-movable-type-pro-513en.html Keywords: CVE-2012-1503, Movable Type Pro 5.13en, Stored XSS, JavaScript Injection, Vendor Unresponsive, Full Disclosure Introduction Movable Type MT started as on...

JVN#36673836: Movable Type vulnerable to cross-site scripting

Movable Type, a web log system from Six Apart KK, contains a cross-site scripting vulnerability. This vulnerability is different than the previous vulnerabilities disclosed on JVN. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the...

JVN#92854093 Movable Type vulnerable to cross-site scripting

Movable Type, a web log system from Six Apart KK, contains a cross-site scripting vulnerability. This vulnerability is different than the previous vulnerabilities disclosed on JVN. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the...

JVN#08369659 Movable Type access restriction bypass vulnerability

Movable Type, a web log system from Six Apart KK, contains a vulnerability that allows a remote attacker to bypass access restrictions. Impact A remote attacker may send unsolicited email to arbitrary addresses or view information stored in Movable Type. Solution Update the Software Update to the...

JVN#97248625 Movable Type cross-site scripting vulnerability

Movable Type, a web log system from Six Apart KK, contains a cross-site scripting vulnerability. This vulnerability is a different vulnerability than past reports on JVN. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest versio...

JVN#71945722 Movable Type Enterprise cross-site scripting vulnerability

Movable Type Enterprise, a web log system from Six Apart KK for business users, contains a cross-site scripting vulnerability. This vulnerability is different from JVN02216739. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest...

JVN#02216739 Movable Type Enterprise cross-site scripting vulnerability

Movable Type Enterprise, a web log system from Six Apart KK for business users, contains a cross-site scripting vulnerability. This vulnerability is different from JVN30385652 and JVN81490697. Impact An arbitrary script may be executed on an user's web browser. Solution Update the Software Update...

JVN#81490697: Movable Type cross-site scripting vulnerability

Movable Type, a web log system from Six Apart KK, contains a vulnerability resulting from the improper handling of the management page that can lead to cross-site scripting. This vulnerability is different from JVN30385652. Impact An arbitrary script may be executed on the blog administrator's we...