Information disclosure

In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06511030; Issue ID: ALPS06511030...

CVE-2022-21748

CVE-2022-21748 affects MediaTek telephony on MediaTek chips. The root cause is a missing permission check in the telephony path, enabling local information disclosure. Exploitation would require user interaction, with the attacker already at User execution privileges; no remote access. Patch ALPS...

CVE-2022-21748

In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06511030; Issue ID: ALPS06511030...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, a US company. The vulnerability stems from a missing permission check in onbind in ShannonRcsService.java. An attacker could use this vulnerability to obtain sensitive information...

PT-2022-15089 · Mediatek +1 · Mt6739 +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no...

PT-2022-15088 · Mediatek +1 · Mt6580 +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. Us...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an information disclosure vulnerability caused by a missing permission check in the handleramdump function in pixelloader.c. The vulnerability can be exploited to obtain sensitive...

PUB-A-220737634

In setPackageOrComponentEnabled of NotificationManagerService.java, there is a missing permission check. This could lead to local information disclosure about enabled notification listeners with User execution privileges needed. User interaction is not needed for exploitation...

PUB-A-222348453

In handleramdump of pixelloader.c, there is a possible way to create a ramdump of non-secure memory due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

PUB-A-171495100

In registerRemoteBugreportReceivers of DevicePolicyManagerService.java, there is a possible reporting of falsified bug reports due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

PUB-A-212695058

In updateApState of SoftApManager.java, there is a possible leak of hotspot state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

BigBlueButton 授权问题漏洞

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. bigBlueButton has an authorization issue vulnerability that stems from the application's lack of required permission checks, which could be exploited by an attacker to bypass access restrictions in order to...

GHSA-Q6RQ-4WHR-R879 Missing permission check in Jenkins Active Directory Plugin allows accessing domain health check page

Jenkins Active Directory Plugin 2.19 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to access the domain health check diagnostic page. Jenkins Active Directory Plugin 2.20 requires Overall/Administer permission to access the...

GHSA-HJ36-V72X-CC6J Missing permission checks in Jenkins Database Plugin

A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified database server using attacker-specified credentials. Database Plugin 1.7 requires Overall/Administer permission for the affected form...

Missing permission checks in Pipeline GitHub Notify Step Plugin allows capturing credentials

A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Jenkins Kubernetes CI/CD Plugin vulnerable to Credential Enumeration

A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Note: Jenkins has suspended distribution of this plugin...

Jenkins iceScrum Plugin vulnerable to Missing Authorization

A missing permission check in Jenkins iceScrum Plugin prior to version 1.1.6 allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. This issue is patched in version 1.1.6...

Jenkins Project Inheritance Plugin vulnerable to Cross-Site Request Forgery

Project Inheritance Plugin allows the creation of projects based on templates defined in the plugin configuration. A missing permission check in the HTTP endpoint triggering project creation allowed users with Overall/Read permission to create these projects. Additionally, the HTTP endpoint did n...

GHSA-76X4-HR82-CG3M Jenkins ElectricFlow Plugin cross-site request forgery vulnerability

A missing permission check in a form validation method in CloudBees CD Plugin allowed users with Overall/Read permission to initiate a connection test to an attacker-specified server with attacker-specified username and password. Additionally, the form validation method did not require POST...

GHSA-PWRM-8MVM-P2F2 Jenkins Agiletestware Pangolin Connector for TestRail Plugin CSRF vulnerability and missing permission checks

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint...