CVE-2023-21184

CVE-2023-21184 affects Android 13 and is tied to CarrierPrivilegesTracker.java in getCurrentPrivilegedPackagesForAllUsers, where a logic error enables a local privilege bypass with no extra execution privileges and no user interaction required. Public documents consistently describe a permission ...

CVE-2023-21187

CVE-2023-21187 affects Android 13 and is caused by a logic error in UsbAccessoryUriActivity.java onCreate that can let an attacker escape the Setup Wizard, enabling local privilege escalation with no user interaction required. Public documents consistently describe the impact as local escalation ...

CVE-2023-21183

In ForegroundUtils of ForegroundUtils.java, there is a possible way to read NFC tag data while the app is still in the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

Oracle Linux 6 : kernel (ELSA-2023-12527)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-12527 advisory. 2.6.32-754.35.1.0.8.el6.OL6 - Fix epoll: Keep a reference on files added to the check list Julian Pidancet CVE-2020-0466 Orabug: 34625224 Tenable has extracted...

CVE-2023-0971

A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered...

CVE-2023-0971 Command Authentication Bypass in Z/IP Gateway

A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered...

FreeBSD-SA-23:05.openssh

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-23:05.openssh Security Advisory The FreeBSD Project Topic: ssh-add does not honor per-hop destination constraints Category: contrib Module: openssh Announced:...

FreeBSD -- ssh-add does not honor per-hop destination constraints

Problem Description: When using ssh-add1 to add smartcard keys to ssh-agent1 with per-hop destination constraints, a logic error prevented the constraints from being sent to the agent resulting in keys being added to the agent without constraints. Impact: A malicious server could leverage the key...

CVE-2023-21128

In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2023-21131

In checkKeyIntentParceledCorrectly of ActivityManagerService.java, there is a possible bypass of Parcel Mismatch mitigations due to a logic error in the code. This could lead to local escalation of privilege and the ability to launch arbitrary activities in settings with no additional execution...

Code injection

In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Design/Logic Flaw

In checkKeyIntentParceledCorrectly of ActivityManagerService.java, there is a possible bypass of Parcel Mismatch mitigations due to a logic error in the code. This could lead to local escalation of privilege and the ability to launch arbitrary activities in settings with no additional execution...

CVE-2023-29294 Bypass Purchase Order Approval using Company User in Adobe Commerce B2B

Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation ...

CVE-2023-21128

In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2023-21131

CVE-2023-21131 concerns a logic error in ActivityManagerService.checkKeyIntentParceledCorrectly() that can bypass Parcel Mismatch mitigations, enabling local escalation of privilege to launch arbitrary activities in settings without extra privileges. Affected: Android 11–13 (Android-11, Android-1...

fossbilling 安全漏洞

fossbilling is a free open source solution for efficient billing and customer management. A security vulnerability exists in fossbilling versions prior to 0.5.0 that stems from a business logic error...

fossbilling 安全漏洞

fossbilling is a free open source solution for efficient billing and customer management. A security vulnerability exists in fossbilling versions prior to 0.5.0 that stems from an error in the business logic...

PT-2023-23702 · Unknown · Fossbilling

Name of the Vulnerable Software and Affected Versions: fossbilling versions prior to 0.5.0 Description: The issue concerns Business Logic Errors in the GitHub repository fossbilling/fossbilling. Recommendations: For versions prior to 0.5.0, update to version 0.5.0 or later to resolve the issue...

CVE-2023-21102

A vulnerability was found in the efirtasmwrapper of the efi-rt-wrapper.S in the Linux kernel, where there is a possible bypass of shadow stack protection due to a logic error in the code. This flaw could lead to local escalation of privilege without additional execution privileges needed...

Amazon Linux 2 : poppler (ALAS-2023-2075)

The version of poppler installed on the remote host is prior to 0.26.5-43. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2075 advisory. A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service DoS via a...