CVE-2023-21245

In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lock screen during device setup due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...

australianlock.com.au Cross Site Scripting vulnerability OBB-3507719

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-18031 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: A logic error in the showNextSecurityScreenOrFinish function of KeyguardSecurityContainerController.java allows access to the lock screen during device setup. This could lead to local...

Barberry Security Advisory - regarding x/auth periodic vesting accounts

Impact In PeriodicVestingAccount, defined in x/auth, an attacker can initialize a victim's account as a malicious vesting account, which allows deposits but does not allow withdrawals. When the user then deposits funds into their account, those funds are locked forever, and the user is not able t...

SAMSUNG Mobile device 缓冲区错误漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile device SMR Jul-2023 Release 1 version, which originates from an out-of-bounds write in the...

Bad accounting on ERC4626MultiToken.sol leads to user funds stuck in the contract

Lines of code Vulnerability details Summary Bad accounting on ERC4626MultiToken.sol leads to user funds stuck in the contract on deposit and withdraw logic. Vulnerability Detail The UlyssesToken unified liquidity tokens are derived from ERC4626Multitoken. This is an standard tokenized vault with...

CVE-2023-21225

there is a possible way to bypass the protected confirmation screen due to Failure to lock display power. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID...

CVE-2023-21189

In startLockTaskMode of LockTaskController.java, there is a possible bypass of lock task mode due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

CVE-2023-21189

In startLockTaskMode of LockTaskController.java, there is a possible bypass of lock task mode due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

CVE-2023-21189

In startLockTaskMode of LockTaskController.java, there is a possible bypass of lock task mode due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

Important: kernel-livepatch-4.14.314-237.533

Issue Overview: dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference. CVE-2023-28466 Affected Packages: kernel-livepatch-4.14.314-237.533 Issue Correction: Please ensur...

PT-2023-17976 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android version 13 Description: A logic error in the LockTaskController.java code allows for a possible bypass of lock task mode. This could lead to local escalation of privilege with no additional execution privileges needed, requiring user...

CVE-2023-21189

In startLockTaskMode of LockTaskController.java, there is a possible bypass of lock task mode due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

CVE-2023-21225

there is a possible way to bypass the protected confirmation screen due to Failure to lock display power. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID...

Important: kernel-livepatch-4.14.313-235.533

Issue Overview: dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference. CVE-2023-28466 Affected Packages: kernel-livepatch-4.14.313-235.533 Issue Correction: Please ensur...

CVE-2023-34098 Dependency configuration exposed in Shopware

Shopware is an open source e-commerce software. Due to an incorrect configuration in the .htaccess file, the configuration file of the Javascript could be read in production environments themes/package-lock.json. With this information, the specific Shopware version in a deployment might be...

PT-2023-24670 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 5.7.18 Description: The issue arises from an incorrect configuration in the .htaccess file, allowing the configuration file of Javascript dependencies to be read in production environments, specifically the...

June 27, 2023—KB5027293 (OS Build 19045.3155) Preview

None None...

Shopware 信息泄露漏洞

Shopware is a set of open source e-commerce software from the German company Shopware. An information disclosure vulnerability exists in Shopware versions prior to 5.7.18, which stems from an incorrect configuration in the htaccess file, which can read the Javascript configuration file...

CVE-2023-36631

Malwarebytes Binisoft Windows Firewall Control (wfc.exe) version 6.9.2.0 is affected by a lack of access control that lets local, unprivileged users bypass Windows Firewall restrictions through the Rules tab in the UI. The vendor notes this as intended behavior when the application is password-lo...