6029 matches found
CVE-2019-15690
LibVNCServer up to version 0.9.12 contains a HandleCursorShape integer/heap-based overflow in libvncclient/cursor.c triggered by oversized cursor dimensions, potentially enabling remote code execution. The CVE-2019-15690 vulnerability affects LibVNCServer 0.9.12 and earlier; multiple connected so...
CVE-2018-9405
CVE-2018-9405 describes a potential out-of-bounds write in BnDmAgent::onTransact (dm_agent.cpp) due to a missing bounds check, enabling local privilege escalation to System level without user interaction. Affected context shown in multiple sources (Android Pixel/Nexus bulletin references and vend...
CVE-2018-9401
CVE-2018-9401 describes a kernel memory access vulnerability in user space caused by an incorrect bounds check, enabling local privilege escalation without extra execution privileges and with no user interaction. Connected documents indicate this CVE is associated with Google Pixel/Nexus devices ...
CVE-2018-9406
CVE-2018-9406 concerns a vulnerability in NlpService where a missing permission check could allow access to location information, enabling local privilege escalation without additional execution privileges. The exploit requires only local access and does not require user interaction. Affected com...
CVE-2018-9389
CVE-2018-9389 affects the Linux kernel IPv6 code path, specifically ip6_append_data in ip6_output.c. The vulnerability is described as a heap-based buffer overflow that could enable local code execution, resulting in privilege escalation with no additional privileges required and no user interact...
CVE-2018-9387
CVE-2018-9387 affects the mnh-sm.c component and describes a heap/heap-buffer overflow caused by an integer overflow. The vulnerability enables local escalation of privilege with no additional execution privileges and does not require user interaction. Connected sources (Red Hat, NVD, CVE lists, ...
CVE-2018-9464
CVE-2018-9464 is an Elevation of Privilege in the Google Android Kernel (Taimen bootloader) identified across multiple trackers. The vulnerability arises from a missing permission check, enabling local access to read protected files and escalate privileges with no additional execution privileges ...
CVE-2018-9461
The CVE-2018-9461 entry describes a race-condition vulnerability in the ShareIntentActivity.java on Android, enabling an app to read files in the Messages app and leading to local privilege escalation without extra execution privileges or user interaction. Several sources (NVD, Red Hat, CVE lists...
CVE-2018-9447
CVE-2018-9447 affects Android devices (Pixel/Nexus context) via a vulnerability in EmergencyCallbackModeExitDialog.java where a missing null check in onCreate can crash emergency callback mode, enabling local denial of service without extra privileges. Descriptions across multiple sources confirm...
CVE-2018-9434
CVE-2018-9434 is evidenced by a Binder Parcel overlap flaw in Android: Parcel data can overlap binder-object metadata, causing kernel pointers to be inserted into attacker-controlled buffers during unmarshalling. This enables information disclosure and an ASLR bypass, potentially allowing local p...
CVE-2018-9382
CVE-2018-9382 affects Android Wi‑Fi service (WifiServiceImpl.java). A missing permission check can allow activating a Wi‑Fi hotspot from a non‑owner profile, enabling local privilege escalation with no extra execution privileges and no user interaction required. Public data confirms the issue is ...
CVE-2018-9379
The CVE-2018-9379 issue affects the Media framework component MiniThumbFile.java on Google Pixel/Nexus devices. Description from multiple sources states a confused-deputy path could allow viewing thumbnails of deleted photos, causing local information disclosure without additional privileges and ...
CVE-2018-9375
CVE-2018-9375 affects Google Android’s UserDictionaryProvider.java, enabling a confused deputy to add/delete words in the user dictionary and cause local privilege escalation without extra execution privileges. Public sources (Android Pixel/Nexus bulletin) list this as a local, low-ex Complexity ...
CVE-2018-9384
CVE-2018-9384 is documented in the Pixel/Android security context as a kernel‑level issue (Kernel components → Upstream kernel) that could enable bypassing KASLR, potentially allowing local information disclosure with SYSTEM privileges. The description consistently notes a “unusual root cause” an...
CVE-2018-9383
CVE-2018-9383 is a vulnerability in the Linux kernel where the asn1_ber_decoder in lib/asn1_decoder.c allows an out-of-bounds read due to a missing bounds check. This can lead to local information disclosure and, per the description, system execution privileges could be required for exploitation;...
CVE-2024-55954 OpenObserve Improper Authorization Allows Admin User to Remove Root User
OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint /api/orgid/users/emailid allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the...
CVE-2025-22146 Improper authentication on SAML SSO process allows user impersonation in sentry
Sentry is a developer-first error tracking and performance monitoring tool. A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a...
CVE-2023-27531
CVE-2023-27531 affects the Kredis JSON deserialization path. Vulnerable: Kredis versions prior to 1.3.0.1 where untrusted JSON data can be deserialized, potentially leading to deserialization of unexpected objects. Impact: any applications using Kredis with JSON are affected. Mitigation: upgrade ...
CVE-2024-27980
Due to the improper handling of batch files in childprocess.spawn / childprocess.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled...