CVE-2021-0391

CVE-2021-0391 affects Android Open Source Project: the vulnerability resides in the UI flow of ChooseTypeAndAccountActivity (onCreate in ChooseTypeAndAccountActivity.java). It allows learning whether an account exists via a tapjacking/overlay attack, without requiring permissions. Impact: local e...

PT-2021-13069 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-8.1 through Android-11 Description: The issue allows an attacker to learn the existence of an account without permissions due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User...

Windows Overlay Filter Elevation of Privilege Vulnerability

...

Windows App-V Overlay Filter Elevation of Privilege Vulnerability

...

Microsoft Windows 安全漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A security vulnerability exists in the Windows App-V Overlay Filter. The following products and versions are affected:Windows 10 Version 1809 for 32-bit Systems,Windows 10 Version 1809 fo...

PT-2021-2358 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insecure privilege management in the Windows Overlay Filter component. It allows an attacker to elevate their privileges. Recommendations: At the moment, there is no...

PT-2021-2353

Name of the Vulnerable Software and Affected Versions Windows App-V Overlay Filter affected versions not specified Description The issue is related to insecure privilege management in the Windows App-V Overlay Filter component. It allows attackers to elevate their privileges, potentially affectin...

The vulnerability of the file system overlays the Linux operating system’s kernel allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the file system that overlays the Linux operating system’s kernel is related to improper handling of permissions. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Checkout Skimmers Powered by Chip Cards

Easily the most sophisticated skimming devices made for hacking terminals at retail self-checkout lanes are a new breed of PIN pad overlay combined with a flexible, paper-thin device that fits inside the terminals chip reader slot. What enables these skimmers to be so slim? They draw their power...

Unprivileged overlay + shiftfs read access

...

Bluetooth Overlay Skimmer That Blocks Chip

As a total sucker for anything skimming-related, I was interested to hear from a reader working security for a retail chain in the United States who recently found Bluetooth-enabled skimming devices placed over top of payment card terminals at several stores. Interestingly, these skimmers...

DEBIAN-CVE-2020-16120

Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a...

CVE-2020-16120

Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a...

CVE-2021-0333

In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay that obscures the phonebook permissions dialog when a Bluetooth device is connecting. This could lead to local escalation of privilege with User execution privileges needed. User...

CVE-2021-0331

In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure default value. This could lead to local escalation of privilege and notification access with User execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2021-0331

In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure default value. This could lead to local escalation of privilege and notification access with User execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2021-0333

In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay that obscures the phonebook permissions dialog when a Bluetooth device is connecting. This could lead to local escalation of privilege with User execution privileges needed. User...

CVE-2021-0314

In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2021-0314

In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product:...

Design/Logic Flaw

In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product:...