CVE-2021-0685

In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2021-0685

In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

ASB-A-191055353

In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Baby clothing giant Carter’s exposed trove of shoppers data

By Waqas Carter’s failure to implement proper authentication protocols on the store’s parcel tracking pages exposed data and shoppers to scams. This is a post from HackRead.com Read the original post: Baby clothing giant Carter’s exposed trove of shoppers data...

WordPress Parcel Tracker eCourier <= 1.0.1 - Plugin Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Plugin Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in WordPress Parcel Tracker Courier versions = 1.0.1. Solution Update the WordPress Parcel Tracker eCourier to the latest available version at least 1.0.2...

Parcel Tracker eCourier < 1.0.2 - Plugin's Settings Update via CSRF

The plugin did not properly check for CSRF, allowing attackers to make a logged in administrator update the plugin's settings PoC...

Parcel Tracker eCourier < 1.0.2 - Plugin's Settings Update via CSRF

The plugin did not properly check for CSRF, allowing attackers to make a logged in administrator update the plugin's settings...

Google Android 缓冲区错误漏洞

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA. Google Android Parcel.cpp is vulnerable to information disclosure. An attacker could use this vulnerability to obtain sensitive information...

CVE-2021-0394

CVE-2021-0394 is an out-of-bounds read in android_os_Parcel_readString8 caused by a missing bounds check, enabling local information disclosure without extra privileges. Affected: Android 11, 10, 9, 8.1; exploitation is local and does not require user interaction. Mitigation per the Android Secur...

ASB-A-172655291

In androidosParcelreadString8 of androidosParcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2020-27044

In restartWrite of Parcel.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-15706656...

GHSA-5J4M-89XF-MF5P Missing Origin Validation in parcel-bundler

Withdrawn: Duplicate of GHSA-37q6-576q-vgr7...

Missing Origin Validation in parcel-bundler

Withdrawn: Duplicate of GHSA-37q6-576q-vgr7...

CVE-2019-14093

Array out of bound access can occur in display module due to lack of bound check on input parcel received in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009,...

CVE-2020-0136

In multiple locations of Parcel.cpp, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege in the system server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Google Android Code Execution Vulnerability (CNVD-2020-19577)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. System is one of the system components.VPN is one of the VPN Virtual Private Network components.Bluetooth is one of the Bluetooth components. A security vulnerability exists in the...

CVE-2020-0086

In readCString of Parcel.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to arbitrary code execution if IntSan were not enabled, which it is by default. No additional execution privileges are required. User interaction is not needed for exploitation...

CVE-2020-0026

In Parcel::continueWrite of Parcel.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1...

@achil/parcel-bundler (>=1.11.1, <=1.12.34), @acies/core (>=1.2.89, <=1.2.215) +133 more potentially affected by CVE-2019-10769 via safer-eval (>=1.2.3, <=1.3.6)

safer-eval NPM version =1.2.3, =1.11.1, =1.2.89, =0.1.0, =4.0.0, =4.1.0, =4.1.2, =0.9.2-pre.41, =2.0.2-pre.3, =1.0.0, =1.9.3-ext.1, =0.3.0, =1.12.3, =1.0.0, =0.0.1, =3.4.4 and more Source cves: CVE-2019-10769 Source advisory: OSV:GHSA-V63X-XC9J-HHVQ...

CVE-2019-2118

In various functions of Parcel.cpp, there are uninitialized or partially initialized stack variables. These could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8...