CVE-2023-21187: Incorrect Default Permissions

In onCreate of UsbAccessoryUriActivity.java, there is a possible way to escape the Setup Wizard due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2023-21184

CVE-2023-21184 affects Android 13 and is tied to CarrierPrivilegesTracker.java in getCurrentPrivilegedPackagesForAllUsers, where a logic error enables a local privilege bypass with no extra execution privileges and no user interaction required. Public documents consistently describe a permission ...

PT-2023-17976 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android version 13 Description: A logic error in the LockTaskController.java code allows for a possible bypass of lock task mode. This could lead to local escalation of privilege with no additional execution privileges needed, requiring user...

Oracle Linux 6 : kernel (ELSA-2023-12527)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-12527 advisory. 2.6.32-754.35.1.0.8.el6.OL6 - Fix epoll: Keep a reference on files added to the check list Julian Pidancet CVE-2020-0466 Orabug: 34625224 Tenable has extracted...

CVE-2023-0971

A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered...

CVE-2023-0971 Command Authentication Bypass in Z/IP Gateway

A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered...

FreeBSD-SA-23:05.openssh

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-23:05.openssh Security Advisory The FreeBSD Project Topic: ssh-add does not honor per-hop destination constraints Category: contrib Module: openssh Announced:...

FreeBSD -- ssh-add does not honor per-hop destination constraints

Problem Description: When using ssh-add1 to add smartcard keys to ssh-agent1 with per-hop destination constraints, a logic error prevented the constraints from being sent to the agent resulting in keys being added to the agent without constraints. Impact: A malicious server could leverage the key...

CVE-2023-21131

In checkKeyIntentParceledCorrectly of ActivityManagerService.java, there is a possible bypass of Parcel Mismatch mitigations due to a logic error in the code. This could lead to local escalation of privilege and the ability to launch arbitrary activities in settings with no additional execution...

CVE-2023-21128

In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Design/Logic Flaw

In checkKeyIntentParceledCorrectly of ActivityManagerService.java, there is a possible bypass of Parcel Mismatch mitigations due to a logic error in the code. This could lead to local escalation of privilege and the ability to launch arbitrary activities in settings with no additional execution...

Code injection

In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2023-29294 Bypass Purchase Order Approval using Company User in Adobe Commerce B2B

Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation ...

CVE-2023-21131

CVE-2023-21131 concerns a logic error in ActivityManagerService.checkKeyIntentParceledCorrectly() that can bypass Parcel Mismatch mitigations, enabling local escalation of privilege to launch arbitrary activities in settings without extra privileges. Affected: Android 11–13 (Android-11, Android-1...

CVE-2023-21128

In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2023-29294: Undefined Security Weakness

Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation ...

CVE-2023-21128: Incorrect Default Permissions

In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2023-21128

In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2023-21131

In checkKeyIntentParceledCorrectly of ActivityManagerService.java, there is a possible bypass of Parcel Mismatch mitigations due to a logic error in the code. This could lead to local escalation of privilege and the ability to launch arbitrary activities in settings with no additional execution...

PT-2023-23702 · Unknown · Fossbilling

Name of the Vulnerable Software and Affected Versions: fossbilling versions prior to 0.5.0 Description: The issue concerns Business Logic Errors in the GitHub repository fossbilling/fossbilling. Recommendations: For versions prior to 0.5.0, update to version 0.5.0 or later to resolve the issue...