CVE-2022-36007 Partial Path Traversal in com.github.jlangch:venice

Venice is a Clojure inspired sandboxed Lisp dialect with excellent Java interoperability. A partial path traversal issue exists within the functions load-file and load-resource. These functions can be limited to load files from a list of load paths. Assuming Venice has been configured with the lo...

CVE-2022-20318

In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-20260

In the Phone app, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-220865698...

Information disclosure

In ActivityManager, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android I...

CVE-2022-20369

In v4l2m2mquerybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid...

PT-2022-14465 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: In Core Utilities, there is a possible log information disclosure. This could lead to local information disclosure of sensitive browsing data with System execution privileges needed. User interaction i...

PT-2022-14475 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue concerns a side channel information disclosure in PackageManager, allowing an attacker to determine whether an app is installed without requiring query permissions. This could lead to local...

Privilege escalation

In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10...

CVE-2022-20350

The CVE-2022-20350 issue affects Android’s NotificationAccessConfirmationActivity.java. It describes an input validation flaw that can trick a user into granting notification access to the wrong app, causing local information disclosure with high confidentiality impact. Affected Android versions:...

CVE-2022-20349

CVE-2022-20349 affects Android 10–12(12L) and concerns the WifiScanningPreferenceController and BluetoothScanningPreferenceController. The issue is a possible admin restriction bypass caused by a missing permission check, enabling local elevation of privilege with no additional execution privileg...

Design/Logic Flaw

It is possible to crash panic an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 previously known as avro-rs. Users should update to apache-avro version 0.14.0 which addresses this issue...

PT-2022-23290 · Storeapps · Storeapps Affiliate For Woocommerce

Name of the Vulnerable Software and Affected Versions: StoreApps Affiliate For WooCommerce premium plugin versions = 4.7.0 Description: The issue allows an attacker to change the PayPal email due to an authenticated IDOR vulnerability. This can be exploited when the WooCommerce PayPal Payments...

PT-2022-23254 · Unknown · Bigtree Cms

Name of the Vulnerable Software and Affected Versions: BigTree CMS version 4.4.16 Description: The issue allows attackers to execute arbitrary code via a crafted PDF file, exploiting an arbitrary file upload vulnerability. Recommendations: For BigTree CMS version 4.4.16, update to a version that...

PT-2022-4530 · D Link · D-Link Dir-818Lw

Name of the Vulnerable Software and Affected Versions: D-LINK DIR-818LW version DIR818L FW105b01 Description: The issue is related to a remote code execution vulnerability via the ssdpcgi main function. This vulnerability is associated with coding errors in the firmware of D-LINK DIR-818LW router...

CVE-2022-31185 Email addresses are not hidden regardless of selected state in mprweb

mprweb is a hosting platform for the makedeb Package Repository. Email addresses were found to not have been hidden, even if a user had clicked the Hide Email Address checkbox on their account page, or during signup. This could lead to an account's email being leaked, which may be problematic if...

CVE-2022-31185

CVE-2022-31185 affects the mprweb hosting platform (makedeb Package Repository). The issue is an information-disclosure where email addresses were not hidden as configured, potentially leaking user emails. The vulnerability is mitigated for official mprweb instances, while self-hosted deployments...

Out-of-bounds

In mailbox, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07032553; Issue ID: ALPS07032553...

PUB-A-225178325

In cdCodeMsg of cdcodec.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-212804042

In several functions of maligrallocreference.cpp, there is a possible arbitrary code execution due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...

PUB-A-229621649

In BuildDevIDResponse of miscdatabuilder.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...