1930 matches found
CVE-2024-31316
In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-31316
In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-34723
In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
CVE-2024-31316
In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2024-26137 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android versions affected versions not specified Description: The issue is related to a logic error in the code of ParcelableListBinder.java, specifically in the onTransact method. This error could allow an attacker to steal the...
PT-2024-23964 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android versions affected versions not specified Description: The issue is related to a parcel mismatch in the onResult method of AccountManagerService.java, which could allow an arbitrary background activity launch. This could lead to local...
CVE-2024-31316: Undefined Security Weakness
In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
New Support Website - July 15th 2024
New Support Website - July 15th 2024 Support.Citrix.com is migrating to a new platform. This is the main website for hosting public CTX knowledge articles and for customers to create and view their support cases. This new platform will launch on July 15th 2024 Callback and LiveChat are dependent ...
CVE-2024-20891
Improper access control in launchFullscreenIntent of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities...
CVE-2024-34585
Improper access control in launchApp of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities...
CVE-2024-39314 toy-blog administrative token leaked through the command line parameter
toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass --read-bearer-token-from-stdin to the...
CVE-2024-39314
The CVE-2024-39314 issue affects toy-blog versions 0.4.3 to before 0.5.0, where the administrative password was leaked via a command line parameter (root cause: command line exposure). A fix is available in version 0.5.0. As a workaround, versions 0.4.14 and later can pass the bearer token via st...
CVE-2024-39314 toy-blog administrative token leaked through the command line parameter
toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass --read-bearer-token-from-stdin to the...
ASB-A-317048338
In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
Custom virtual channels | App not launching if .dll file name is too long or contains underscores
App launch hangs after "connecting with ..."...
CVE-2024-4748
The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which...
CVE-2024-4748
CVE-2024-4748 affects CRUDDIY/Cruddiy. The vulnerability is a shell command injection triggered by sending a crafted POST request to the application server. The exploitation risk is described as limited because CRUDDIY is designed to be launched locally, but a user running the project could be ta...
CVE-2024-4748 RCE in Cruddiy
The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which...
CVE-2024-6041 itsourcecode Gym Management System manage_user.php sql injection
A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file manageuser.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploi...