131 matches found
CVE-2022-39903
CVE-2022-39903 describes an improper access control vulnerability in Samsung RCS calls prior to SMR Dec-2022 Release 1. The issue allows local attackers to access the RCS incoming call number (information disclosure). Affected component: RCS call handling on Samsung mobile devices; root cause: im...
CVE-2022-39903
Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number...
Elon Musk Confirms Twitter 2.0 will Bring End-to-End Encryption to Direct Messages
Twitter chief executive Elon Musk confirmed plans for end-to-end encryption E2EE for direct messages on the platform. The feature is part of Musk's vision for Twitter 2.0, which is expected to be what's called an "everything app." Other functionalities include longform tweets and payments,...
[SECURITY] Fedora 36 Update: reposurgeon-4.32-3.fc36
Reposurgeon enables risky operations that version-control systems don't want to let you do, such as editing past comments and metadata and removing commits. It works with any version control system that can export and import git fast-import streams, including git, hg, fossil, bzr, CVS and RCS. It...
[SECURITY] Fedora 35 Update: reposurgeon-4.31-2.fc35
Reposurgeon enables risky operations that version-control systems don't want to let you do, such as editing past comments and metadata and removing commits. It works with any version control system that can export and import git fast-import streams, including git, hg, fossil, bzr, CVS and RCS. It...
[SECURITY] Fedora 36 Update: reposurgeon-4.32-2.fc36
Reposurgeon enables risky operations that version-control systems don't want to let you do, such as editing past comments and metadata and removing commits. It works with any version control system that can export and import git fast-import streams, including git, hg, fossil, bzr, CVS and RCS. It...
CISA Warns of Active Exploitation of 'PwnKit' Linux Vulnerability in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency CISA this week moved to add a Linux vulnerability dubbed PwnKit to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. The issue, tracked as CVE-2021-4034 CVSS score: 7.8, came to light in January 2022 and...
Google Says ISPs Helped Attackers Infect Targeted Smartphones with Hermit Spyware
A week after it emerged that a sophisticated mobile spyware dubbed Hermit was used by the government of Kazakhstan within its borders, Google said it has notified Android users of infected devices. Additionally, necessary changes have been implemented in Google Play Protect — Android's built-in...
Google Warns Spyware Being Deployed Against Android, iOS Users
Google is warning victims in Kazakhstan and Italy that they are being targeted by Hermit, a sophisticated and modular spyware from Italian vendor RCS Labs that not only can steal data but also record and make calls. Researchers from Google Threat Analysis Group TAG revealed details in a blog post...
PT-2022-14401 · Google · Android Kernel
Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a missing permission check in the onbind method of ShannonRcsService.java. This could lead to local information disclosure without requiring additional execution privileges. User interaction...
CVE-2021-39734
In sendMessage of OneToOneChatImpl.java ? TBD, there is a possible way to send an RCS message without permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
Design/Logic Flaw
In sendMessage of OneToOneChatImpl.java ? TBD, there is a possible way to send an RCS message without permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
PUB-A-208650395
In sendMessage of OneToOneChatImpl.java ? TBD, there is a possible way to send an RCS message without permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
rcs.ac.uk Cross Site Scripting vulnerability OBB-2127025
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Privilege Escalation
cvs is vulnerable to Privilege Escalation. Array index error in the applyrcschange function in rcs.c in CVS allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow...
CVE-2019-20573
An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. There is local SQL injection in the RCS Content Provider. The Samsung IDs are SVE-2019-14059, SVE-2019-14685 August 2019...
CVE-2019-20552
An issue was discovered on Samsung mobile devices with P9.0 software. Attackers can bypass Factory Reset Protection FRP via an RCS call. The Samsung ID is SVE-2019-15035 October 2019...
Design/Logic Flaw
An issue was discovered on Samsung mobile devices with P9.0 software. Attackers can bypass Factory Reset Protection FRP via an RCS call. The Samsung ID is SVE-2019-15035 October 2019...
Sql injection
An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. There is local SQL injection in the RCS Content Provider. The Samsung IDs are SVE-2019-14059, SVE-2019-14685 August 2019...
CVE-2019-20573
An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. There is local SQL injection in the RCS Content Provider. The Samsung IDs are SVE-2019-14059, SVE-2019-14685 August 2019...