RTLS Systems Found Vulnerable to MiTM Attacks and Location Tampering

Researchers have disclosed multiple vulnerabilities impacting Ultra-wideband UWB Real-time Locating Systems RTLS, enabling threat actors to launch adversary-in-the-middle AitM attacks and tamper with location data. "The zero-days found specifically pose a security risk for workers in industrial...

GLSA-202208-32 : Vim, gVim: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202208-32 Vim, gVim: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in Vim and gVim. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block...

The vulnerability of the ZmMailMsgView.getAttachmentLinkHtml() function in the Zimbra Collaboration Suite email management system allows a hacker to execute arbitrary code.

The vulnerability of the ZmMailMsgView.getAttachmentLinkHtml function in the Zimbra Collaboration Suite email management system is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a...

Denial Of Service (DoS)

vim is vulnerable to denial of service. The vulnerability exist because there is an out of bounds read in github repository which can allow the attacker to read sensitive information from other memory location or cause a crash when the code reads a variable amount of data and assumes that a...

CVE-2022-20327

In Wi-Fi, there is a possible way to retrieve the WiFi SSID without location permissions due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Androi...

CVE-2022-20261

In LocationManager, there is a possible way to get location information due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

CVE-2022-20261

In LocationManager, there is a possible way to get location information due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

Fast and Secure VPN on a Budget? Private Internet Access VPN Has You Covered

Back when the internet consisted of a handful of computers networked together across a few research institutions, nobody could have imagined that it would one day form the backbone of a new digital way of life. And that probably explains why none of the researchers who thought up its core...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in the Google Android LocationManager component that stems from a lack of privilege checking and has a possible way to obtain location information...

PT-2022-14485 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a missing permission check in the LocationManager, which could lead to local information disclosure. This requires System execution privileges and does not need user interaction...

PT-2022-14553 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android version 13 Description: There is a possible way to retrieve the WiFi SSID without location permissions due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User...

CVE-2022-20348

In updateState of LocationServicesWifiScanningPreferenceController.java, there is a possible admin restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-20352

In addProviderRequestListener of LocationManagerService.java, there is a possible way to learn which packages request location information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not...

CVE-2022-20352

In addProviderRequestListener of LocationManagerService.java, there is a possible way to learn which packages request location information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not...

CVE-2022-20348

In updateState of LocationServicesWifiScanningPreferenceController.java, there is a possible admin restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-20352

In addProviderRequestListener of LocationManagerService.java, there is a possible way to learn which packages request location information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not...

PT-2022-14573 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-10 through Android-12L Description: In the updateState method of LocationServicesWifiScanningPreferenceController.java, there is a possible admin restriction bypass due to a missing permission check. This could lead t...

PT-2022-14578 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-12 through Android-12L Description: A local information disclosure issue exists due to a missing permission check in the addProviderRequestListener method of LocationManagerService.java. This allows an attacker to lea...

CVE-2022-26342

A buffer overflow vulnerability exists in the confsrv ucloudsetnodelocation functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted network packet can lead to a buffer overflow. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2022-26009

A stack-based buffer overflow vulnerability exists in the confsrv ucloudsetnodelocation functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability...