12109 matches found
CVE-2020-14121
The CVE-2020-14121 issue affects Xiaomi Mi App Store. Affected component: the store’s business logic with incomplete product permission checks, allowing bypass and a local silent installation. Root cause: insufficient permission enforcement enables an attacker to install without user-visible prom...
Xiaomi Mi App Store 授权问题漏洞
Xiaomi Mi App Store 小米应用商店 is an application store by the Chinese company Xiaomi. A security vulnerability exists in Xiaomi Mi App Store, which is caused by an incomplete bypassed product permission check and can be exploited by an attacker to perform a local silent installation...
Slackware: Security Advisory (SSA:2018-208-01)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Xiaomi Mi App Store 输入验证错误漏洞
A security vulnerability exists in Xiaomi Mi App Store, an app store of Xiaomi, a Chinese company. The vulnerability is due to the Xiaomi App Store not verifying the validity of incoming data, which could be exploited by an attacker to cause the app store to automatically download and install app...
CWA 2202 : Published desktop fails to launch when CWA is used
-- Issue with CWA only -- Same endpoint works when same VDA is launched from Store URL -- Issue with 1 end point only -- Never worked on the CWA -- First time set up Details...
A week in security (April 11 – 17)
Last week on Malwarebytes Labs: Credential-stealing malware disguises itself as Telegram, targets social media users Old Play Store apps served notice by upcoming API level changes Denonia cryptominer is first malware to target AWS Lambda Ransomware: March 2022 review Why identity management...
Microsoft Patch Tuesday, April 2022 Edition
Microsoft on Tuesday released updates to fix roughly 120 security vulnerabilities in its Windows operating systems and other software. Two of the flaws have been publicly detailed prior to this week, and one is already seeing active exploitation, according to a report from the U.S. National...
GHSA-V2WF-C3J6-WPVW Session fixation
Impact The use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability. Workarounds Call...
expat: Integer overflow in storeRawNames()
An integer overflow was found in expat. The issue occurs in storeRawNames by abusing the mbuffer expansion logic to allow allocations very close to INTMAX and out-of-bounds heap writes. This flaw can cause a denial of service or potentially arbitrary code execution...
Microsoft Windows App Store 权限许可和访问控制问题漏洞
Microsoft Windows App Store is an application store for downloading software from Microsoft Corporation USA. A vulnerability exists in the Microsoft Windows App Store with privilege license and access control issues. The following products and editions are affected: Windows 10 Version 20H2 for...
Samsung Galaxy S21 输入验证错误漏洞
SAMSUNG Galaxy Apps is a pre-installed application store program for Samsung mobile devices from Samsung South Korea. An input validation error vulnerability exists in Samsung Galaxy S21 versions prior to 4.5.40.5. An attacker can exploit the vulnerability to execute arbitrary code...
The vulnerability of the software platform for developing and managing online stores Magento Commerce arises from insufficient validation of input data. This allows attackers to execute arbitrary code.
The vulnerability of the Magento Commerce software platform for developing and managing online stores exists due to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...
CVE-2022-28542
Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access privileged content providers as Galaxy Store permission...
CVE-2022-28544
Path traversal vulnerability in unzip method of InstallAgentCommonHelper in Galaxy store prior to version 4.5.40.5 allows attacker to access the file of Galaxy store...
CVE-2022-28542
Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access privileged content providers as Galaxy Store permission...
CVE-2022-28544
Path traversal vulnerability in unzip method of InstallAgentCommonHelper in Galaxy store prior to version 4.5.40.5 allows attacker to access the file of Galaxy store...
CVE-2022-28776
Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications from Galaxy Store without user interactions...
CVE-2022-28776
Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications from Galaxy Store without user interactions...