PT-2023-27266 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: A possible lock screen bypass exists due to a missing permission check in the keyguardGoingAway function of ActivityTaskManagerService.java. This could lead to local escalation of privilege...

Amazon Linux 2 : xorg-x11-server (ALAS-2023-2352)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2352 advisory. A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration a multi-screen setup with multiple protocol screens, also known as Zaphod...

PT-2023-28447 · Samsung +1 · Samsung Voice Recorder +3

Name of the Vulnerable Software and Affected Versions: Samsung Voice Recorder versions prior to 21.4.15.01 in Android 12 and Android 13 Samsung Voice Recorder versions prior to 21.4.50.17 in Android 14 Description: The issue is related to improper access control in the Samsung Voice Recorder,...

Medium: kernel

Issue Overview: A use-after-free flaw was found in vcsread in drivers/tty/vt/vcscreen.c in vcscreen in the Linux Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal kernel information. CVE-2023-3567 In the Linux kernel, the following...

ASB-A-288896339

In keyguardGoingAway of ActivityTaskManagerService.java, there is a possible lock screen bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Use After Free

xorg-server is vulnerable to Use After Free. The vulnerability is caused when using X server in Zaphod mode a multi-screen setup with multiple protocol screens when the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is...

PT-2023-7436 · Phoenix · Phoenix Securecore Technology

Name of the Vulnerable Software and Affected Versions: Phoenix SecureCore Technology version 4 Description: The issue is related to improper input validation in the processing of user-supplied splash screens during system boot. This could potentially allow an attacker to cause a denial-of-service...

The Lethal Advancement of DarkGate Malware-as-a-Service

Summary: DarkGate, a formidable Remote Access Trojan RAT, functions as a Malware-as-a-Service MaaS and is masterminded by the elusive RastaFarEye within the underground cybercrime landscape. The latest iteration, DarkGate 5.0.19, advances upon its predecessors with sophisticated evasion technique...

The vulnerability in the full-screen mode of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, allows attackers to carry out clickjacking attacks.

The vulnerability in the full-screen mode of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to carry out a clickjacking attack...

ALPINE-CVE-2023-48161

Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c...

AZL-34729 CVE-2023-48161 affecting package giflib for versions less than 5.2.1-7

Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c...

UBUNTU-CVE-2023-48161

Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c...

GIFLIB Security Vulnerability

GIFLIB is a library for reading and editing gif images. A security vulnerability exists in GIFLIB version 5.2.1, which originated from a vulnerability that allows local attackers to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c. The vulnerability is caused by the use o...

xorg-x11-server: Use-after-free bug in DestroyWindow

A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration a multi-screen setup with multiple protocol screens, also known as Zaphod mode if the pointer is warped from within a window on one screen to the root window of the othe...

The Continued Evolution of the DarkGate Malware-as-a-Service

The Continued Evolution of the DarkGate Malware-as-a-Service By Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll and Vinoo Thomas · November 21, 2023 On September 2023, the Trellix Security Operations Center SOC successfully detected and stopped an attack against Musarubra, the holding...

Mozilla Firefox Security Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation. A security vulnerability exists in Mozilla Firefox versions prior to 120, Firefox ESR versions prior to 115.5, and Thunderbird versions prior to 115.5.0, which originates from the use of full-screen transitions in the...

Fedora 37 : tigervnc (2023-4708733ccc)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-4708733ccc advisory. Fixes CVEs reported against Xserver. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Login Screen Manager <= 3.5.2 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

FreeBSD : typo3 -- Multiple vulnerabilities (7cc003cb-83b9-11ee-957d-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7cc003cb-83b9-11ee-957d-b42e991fc52e advisory. - TYPO3 is an open source PHP based web content management system released under the GNU GPL. ...

Design/Logic Flaw

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory e.g. /var/www/html/var/transient/. This applies to composer-based scenarios only...