166 matches found
com.heytap.browser
취약점 보고서 개요: Android 플랫폼의 com.heytap.browser 애플리케이션에서 취약점이 발견되었습니다. 이 취약점으로 인해 공격자는 별도의 권한 없이 애플리케이션 컨텍스트 내에서 임의의 JavaScript 코드를 실행할 수 있습니다. 애플리케이션 세부 정보: 공급업체: - ColorOS 애플리케이션 이름: 'Internet Browser' com.heytap.browser 버전: 45.10.3.4.1 컴포넌트: com.android.browser.RealBrowserActivity 취약점 세부 정보: 취약점...
PYSEC-2026-2657 MLFlow allows Tracing + Assessments Access
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the store method of sub-form Livewire components used in the product editor. An attacker can modify product pricing, stock, SEO metadata, shipping dimensions, and attached media for any product by tampering with...
MLFlow allows Tracing + Assessments Access
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...
CVE-2025-15381
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...
PT-2026-28274
Name of the Vulnerable Software and Affected Versions mlflow/mlflow affected versions not specified Description When the basic-auth application is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, even those with NO PERMISSIO...
CVE-2021-0987
In getNeighboringCellInfo of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User...
CVE-2021-0391
In onCreate of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for...
A New Attack Lets Hackers Steal 2-Factor Authentication Codes From Android Phones
The malicious app required to make a “Pixnapping” attack work requires no permissions...
EUVD-2021-26123
Malware in sbrugna...
EUVD-2018-6881
Malware in sbrugna...
EUVD-2022-25512
Malicious code in bioql PyPI...
EUVD-2023-25467
Malicious code in bioql PyPI...
EUVD-2023-25516
Malicious code in bioql PyPI...
EUVD-2023-25470
Malicious code in bioql PyPI...
EUVD-2023-25496
Malicious code in bioql PyPI...
EUVD-2023-25500
Malicious code in bioql PyPI...
EUVD-2023-25513
Malicious code in bioql PyPI...