CVE-2021-25428

Improper validation check vulnerability in PackageManager prior to SMR July-2021 Release 1 allows untrusted applications to get dangerous level permission without user confirmation in limited circumstances...

CVE-2021-25428

Improper validation check vulnerability in PackageManager prior to SMR July-2021 Release 1 allows untrusted applications to get dangerous level permission without user confirmation in limited circumstances...

PackageManager安全漏洞

Samsung PackageManager is an application from Samsung Korea. A security vulnerability exists in versions prior to Samsung PackageManager SMR July-2021 Release 1, which can be exploited by attackers to gain dangerous levels of privileges without user confirmation in limited circumstances...

MGASA-2021-0306 Updated thunar packages fix a security vulnerability

An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program based on the file type without user confirmation. This could be used to achieve code execution CVE-2021-32563...

CVE-2021-31897

CVE-2021-31897 affects JetBrains WebStorm prior to 2021.1, where code execution without user confirmation was possible for untrusted projects. The vulnerability is documented across multiple sources (NVD entry and Red Hat advisory) and is addressed in WebStorm 2021.1 per JetBrains’ Q1 2021 Securi...

DEBIAN-CVE-2021-32563

An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program based on the file type without user confirmation. This could be used to achieve code execution...

CVE-2021-0306

In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which allows an app to gain the android.permission.ACTIVITYRECOGNITION permission without user confirmation. This could lead to local escalation of privilege with no...

The vulnerability of Firefox browser, related to incorrect application installation when pressing the ALT + a keys on the keyboard, allows the attacker to compromise data integrity.

The vulnerability of Firefox browsers is related to the incorrect installation of extensions when pressing the ALT + a keys on the keyboard. This allows extensions to be installed without user confirmation. Exploiting this vulnerability can enable an attacker to compromise data integrity remotely...

Privilege escalation

When pairing with a Bluetooth device, it may be possible to pair a malicious device without any confirmation from the user, and that device may be able to interact with the phone. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is...

CVE-2019-2225

When pairing with a Bluetooth device, it may be possible to pair a malicious device without any confirmation from the user, and that device may be able to interact with the phone. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is...

PRODSECBUG-2465: Bypass of user confirmation mechanism

More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...

Unauthorized Modification Of SSH Configurations

chloride does not prompt for user confirmation before adding unknown hosts into the SSH knownhosts file. The SSH knownhosts file is not properly handled when using net-ssh, which allows automatic addition of the host without confirmation when connecting to an unknown host...

RHEL 6 : chromium-browser (RHSA-2018:2666)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:2666 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 69.0.3497.81. Security Fixes:...

Debian DSA-4289-1 : chromium-browser - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2018-16065 Brendon Tiszka discovered an out-of-bounds write issue in the v8 JavaScript library. - CVE-2018-16066 cloudfuzzer discovered an out-of-bounds read issue in blink/webkit. - CVE-2018-16067 Zhe Jin discovered ...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 69 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 69.0.3497.81 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming...

KLA11312 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, obtain sensitive information, bypass security restrictions and spoof user interface. Below is a complete list of vulnerabilities: 1. ...

DEF CON 2018: Telltale URLs Leak PII to Dozens of Third Parties

LAS VEGAS – When we order food online, book a plane ticket or purchase seats for a show, we often get an email confirmation with a handy link that, when clicked, takes us directly to our confirmation, with no need to log back into the site. These pages have our confirmation code, the ability to...

CVE-2018-4137

An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. The issue involves the "Safari Login AutoFill" component. It allows remote attackers to read autofilled data by leveraging lack of a user-confirmation requirement...

CVE-2018-4137

An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. The issue involves the "Safari Login AutoFill" component. It allows remote attackers to read autofilled data by leveraging lack of a user-confirmation requirement...

Design/Logic Flaw

An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. The issue involves the "Safari Login AutoFill" component. It allows remote attackers to read autofilled data by leveraging lack of a user-confirmation requirement...