CVE-2023-38302: Exposure of Sensitive Information to an Unauthorized Actor

A certain software build for the Sharp Rouvo V device SHARP/VZWSTTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN00530:user/release-keys leaks the Wi-Fi MAC address and the Bluetooth MAC address to system properties that can be accessed by any local app on the device without any permissions or special...

CVE-2023-38291

An issue was discovered in a third-party component related to ro.boot.wifimacaddr, shipped on devices from multiple device manufacturers. Various software builds for the following TCL devices 30Z and 10L and Motorola devices Moto G Pure and Moto G Power leak the Wi-Fi MAC address to a system...

CVE-2023-38296

Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers...

CVE-2023-38296

Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers...

CVE-2023-38298

Various software builds for the following TCL devices 30Z, A3X, 20XE, 10L leak the device IMEI to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device...

CVE-2023-38296

Various software builds for TCL 30Z and TCL A3X devices are vulnerable to a security flaw where the ICCID is leaked to a system property. Specifically, a high-privilege process exposes this identifier, allowing any local app to indirectly obtain it without any permissions or special privileges by...

CVE-2023-38298

Various software builds for TCL devices (30Z, A3X, 20XE, and 10L) contain a vulnerability where a high-privilege process leaks the device IMEI to a system property. This allows any local application to indirectly obtain the identifier without any permissions or special privileges, bypassing Andro...

PT-2024-12703 · Tcl +1 · Tcl 30Z +4

Name of the Vulnerable Software and Affected Versions: TCL 30Z versions 12/SP1A.210812.016/LV8E through 12/SP1A.210812.016/vU6X TCL A3X versions 11/RKQ1.201202.002/vAAZ through 11/RKQ1.201202.002/vABS TCL 20XE versions 11/RP1A.200720.011/PB7I-0 through 11/RP1A.200720.011/PB83-0 TCL 10L versions...

PT-2024-12701 · Tcl · Tcl A3X +1

Name of the Vulnerable Software and Affected Versions: TCL 30Z versions TCL/4188R/Jetta ATT:12/SP1A.210812.016/LV8E:user/release-keys through TCL/T602DL/Jetta TF:12/SP1A.210812.016/vU6X:user/release-keys TCL A3X versions TCL/A600DL/Delhi TF:11/RKQ1.201202.002/vAAZ:user/release-keys through...

PT-2024-12696 · Motorola +1 · Motorola Moto G Pure +3

Name of the Vulnerable Software and Affected Versions: TCL 30Z affected versions not specified TCL 10L affected versions not specified Motorola Moto G Pure affected versions not specified Motorola Moto G Power affected versions not specified Description: An issue was discovered in a third-party...

CVE-2023-38301

An issue was discovered in a third-party component related to vendor.gsm.serial, shipped on devices from multiple device manufacturers. Various software builds for the BLU View 2, Boost Mobile Celero 5G, Sharp Rouvo V, Motorola Moto G Pure, Motorola Moto G Power, T-Mobile Revvl 6 Pro 5G, and...

CVE-2023-38301

A security vulnerability exists in a third-party component related to vendor.gsm.serial affecting multiple Android devices, including BLU View 2 , Boost Mobile Celero 5G , Sharp Rouvo V , Motorola Moto G Pure , Motorola Moto G Power , T-Mobile Revvl 6 Pro 5G , and T-Mobile Revvl V+ 5G . The issue...

CVE-2023-38291

A third-party component vulnerability in the ro.boot.wifimacaddr property allows various software builds of TCL (30Z, 10L) and Motorola (Moto G Pure, Moto G Power) devices to leak the Wi-Fi MAC address . Because this property is accessible by any local app without permissions or special privilege...

Ignite Realtime Openfire privilege escalation vulnerability

An issue in Ignite Realtime Openfire v.4.8.0 and before allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component...

CVE-2024-25420

An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component...

CVE-2024-25420: Improper Check for Dropped Privileges

An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component...

CVE-2024-25420

Ignite Realtime Openfire (versions before 4.8.1 ) is vulnerable to a privilege escalation flaw. A remote attacker can exploit the admin.authorizedJIDs system property component to gain elevated permissions. Additionally, reports indicate a vulnerability in the ROOM_CACHE component allowing unauth...

CVE-2024-25420

An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component...

GeoServer log file path traversal vulnerability

Impact This vulnerability requires GeoServer Administrator with access to the admin console to misconfigured the Global Settings for log file location to an arbitrary location. This can be used to read files via the admin console GeoServer Logs page. It is also possible to leverage RCE or cause...

PT-2024-9579

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions prior to 11.0.2, 10.1.34, or 9.0.98. Description The Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default...