CVE-2023-44126 Call management - Implicit intents disclose telephony data such as phone numbers, call states, contacts

The vulnerability is that the Call management "com.android.server.telecom" app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers,...

CVE-2023-44124 Screen recording - Theft of arbitrary files with system privilege

The vulnerability is to theft of arbitrary files with system privilege in the Screen recording "com.lge.gametools.gamerecorder" app in the "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java" file. The main problem is that the app launches implicit intents that can be...

CVE-2023-44124

The CVE-2023-44124 issue affects the Screen recording app (com.lge.gametools.gamerecorder). The root cause is that the app launches implicit intents that can be intercepted by other apps on the device, and the returned data goes to onActivityResult, enabling theft of arbitrary files. The app stor...

CVE-2023-44122 LockScreenSettings - Theft arbitrary files with system privilege

The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings "com.lge.lockscreensettings" app in the "com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java" file. The main problem is that the app launches implicit intents that can be...

CVE-2023-44121 LG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhere

The vulnerability is an intent redirection in LG ThinQ Service "com.lge.lms2" in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action...

CVE-2023-44121 LG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhere

The vulnerability is an intent redirection in LG ThinQ Service "com.lge.lms2" in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action...

PT-2023-29121 · Google · Com.Android.Server.Telecom

Name of the Vulnerable Software and Affected Versions: com.android.server.telecom affected versions not specified Description: The issue is related to the Call management app patched by LG, which launches implicit intents that disclose sensitive data to all third-party apps installed on the same...

PT-2023-29120 · Google · Com.Android.Server.Telecom

Name of the Vulnerable Software and Affected Versions: com.android.server.telecom affected versions not specified Description: The issue is related to the Call management app patched by LG, which sends numerous LG-owned implicit broadcasts. These broadcasts disclose sensitive data, including call...

PT-2023-29115 · Lg · Lg Thinq Service

Name of the Vulnerable Software and Affected Versions: LG ThinQ Service affected versions not specified Description: The issue is an intent redirection in the LG ThinQ Service, specifically in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This could be exploited by a...

PT-2023-29118 · Lg Electronics +1 · Lg V60 Thin Q 5G +1

Name of the Vulnerable Software and Affected Versions: Screen recording app affected versions not specified Description: The issue concerns the theft of arbitrary files with system privilege in the Screen recording app. The main problem is that the app launches implicit intents that can be...

Cache Poisoning org.eclipse.jetty:jetty-server in Jira Software Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.20.0, 9.4.0, 9.5.0, 9.6.0, 9.7.0, 9.8.0, 9.9.0, 9.10.0, 9.10.1, and 9.11.0 of Jira Software Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

Info Disclosure org.eclipse.jetty:jetty-util in Jira Software Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.20.0, 9.4.0, 9.5.0, 9.6.0, 9.7.0, 9.8.0, 9.9.0, 9.10.0, 9.10.1, and 9.11.0 of Jira Software Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

org.apache.velocity Vulnerability in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 7.21.0, 7.21.1, 7.21.2, 7.21.3, 7.21.4, 7.21.5, 7.21.6, and 7.21.7 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 8.8 and a CVSS Vector of...

The Rise of the Malicious App

Security teams are familiar with threats emanating from third-party applications that employees add to improve their productivity. These apps are inherently designed to deliver functionality to users by connecting to a "hub" app, such as Salesforce, Google Workspace, or Microsoft 365. Security...

Trend Micro Addresses Zero-Day Flaws Exploited in the Wild

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A critical zero-day vulnerability, tracked as CVE-2023-41179, has been identified in the third-party AV uninstaller module contained in Trend Micro Apex One, Worry-Free Business Security, and...

Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability

Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target...

Do You Really Trust Your Web Application Supply Chain?

Well, you shouldn't. It may already be hiding vulnerabilities. It's the modular nature of modern web applications that has made them so effective. They can call on dozens of third-party web components, JS frameworks, and open-source tools to deliver all the different functionalities that keep the...

Trend Micro Endpoint security products for enterprises vulnerable to arbitrary code execution

Overview Trend Micro Endpoint security products for enterprises provided by Trend Micro Incorporated contain an arbitrary code execution vulnerability CWE-94, CVE-2023-41179 in 3rd Party AV Uninstaller Module. Trend Micro Incorporated states that an attack exploiting this vulnerability has been...

Design/Logic Flaw

A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One on-prem and SaaS, Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that a...

FALSE POSITIVE - OpenSearch Vulnerability in Bitbucket Data Center and Server

Notice of FALSE POSITIVE After review, it has been determined that CVE-2022-41906 DOES NOT affect ANY version of Bitbucket Data Center or Bitbucket Server. We have updated our bulletin and Jira tickets to reflect this update. We have taken action to prevent this false-positive from appearing in o...