CVE-2017-18673

An issue was discovered on Samsung mobile devices with N7.x software. An attacker can disable the Location service on a locked device, making it impossible for the rightful owner to find a stolen device. The Samsung ID is SVE-2017-8524 May 2017...

CVE-2017-18673

CVE-2017-18673 affects Samsung mobile devices running N(7.x) software. The issue allows an attacker to disable the Location service on a locked device, preventing the rightful owner from locating a stolen device. The Samsung ID is SVE-2017-8524 (May 2017). Public documents do not provide details ...

WHO COVID-19 Mobile App: Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify Users

Summary: Note: I noticed that that the team has fixed issues like an XSS that's caused only from a header value typically OOS since it's not directly exploitable https://github.com/WorldHealthOrganization/app/pull/855, so in the spirit of this I'm also reporting another "good-to-fix" issue. On th...

How Just Visiting A Site Could Have Hacked Your iPhone or MacBook Camera

If you use an Apple iPhone or a MacBook, we have a piece of alarming news for you. Turns out merely visiting a website — not just malicious but also legitimate sites unknowingly loading malicious ads as well — using Safari browser could have let remote attackers secretly access your device's...

Directory Traversal

ansible is vulnerable to directory traversal. When extracting a collection of .tar.gz file, neither install nor the called extracttarfile performs any validation or sanitization of the filenames. This allows a malicious collection of .tar.gz file to be written in arbitrary location on the file...

Denial Of Service

LibreOffice is vulnerable to denail of service DoS. It is possible because of an insufficient URL encoding flaw in allowed script location check...

Telerik UI for Silverlight Path Traversal Vulnerability

Telerik UI for Silverlight is a suite of UI User Interface controls for application development from Telerik Bulgaria. A security vulnerability exists in Telerik UI for Silverlight versions prior to 2020.1.330. The vulnerability can be exploited by an attacker to upload a file to an arbitrary...

RHEL 7 : libreoffice (RHSA-2020:1151)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1151 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor...

kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS

A flaw was found in the Linux kernel’s implementation of the WiFi station handoff code. An attacker within the radio range could use this flaw to deny a valid device from joining the access point...

libreoffice: Unsafe URL assembly flaw in allowed script location check

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...

libreoffice: Insufficient URL encoding flaw in allowed script location check

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...

CVE-2019-13495

In firmware version 4.50 of Zyxel XGS2210-52HP, multiple stored cross-site scripting XSS issues allows remote authenticated users to inject arbitrary web script via an rpSys.html Name or Location field...

CVE-2019-13495

In firmware version 4.50 of Zyxel XGS2210-52HP, multiple stored cross-site scripting XSS issues allows remote authenticated users to inject arbitrary web script via an rpSys.html Name or Location field...

Directory traversal

An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330. The RadUploadHandler class in RadUpload for Silverlight expects a web request that provides the file location of the uploading file along with a few other parameters. The uploading file location should be inside the...

Debian: Security Advisory (DLA-2162-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ProjectOpal - Stealth Post-Exploitation Framework For Wordpress

Stealth post-exploitation framework for Wordpress CMS Official ProjectOpal Repository. What is it and why was it made? We intentionally made it for our penetration testing jobs however its getting grey hairs now so we thought we would like to pass it on to the public!. ProjectOpal or Opal. Is a...

CVE-2020-6808

When a JavaScript URL javascript: is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented. Previously, this document's URL as reported by the document.location property, for example was the originating javascript: URL which could lead to...

npmjs-url-parse: Improper validation of protocol of the returned URL

An input validation flaw exists in the node.js-url-parse, which results in the URL being incorrectly set to the document location protocol instead of the URL being passed as an argument. An attacker could use this flaw to bypass security checks on URLs...

Samsung Mobile Device Information Disclosure Vulnerability (CNVD-2020-32872)

Android is a free and open source operating system from Google based on the Linux kernel without GNU components. Samsung mobile devices have an information disclosure vulnerability that can be exploited by attackers to share location information from a locked screen...

CVE-2019-20579

An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. Gallery allows attackers to enable Location information sharing from the lock screen. The Samsung ID is SVE-2019-14462 August 2019...