Archive
9 February 2023
Vulnerabilities first published on this day (UTC), newest first.
125 results · Feed
-
High 7.3
Use of Externally-Controlled Format String vulnerabilities in STST TA prior to SMR Jan-2023 Release 1 allows arbitrary …
-
Medium 4.2
Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without aut…
-
Medium 4.0
Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID.
-
Low 2.3
Missing Authorization vulnerability in One Hand Operation + prior to version 6.1.21 allows multi-users to access owner&…
-
Medium 5.5
Improper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R(11), 13.1.03.501 in Android S(1…
-
Medium 6.2
Improper input validation in MyFiles prior to version 12.2.09 in Android R(11), 13.1.03.501 in Android S( 12) and 14.1.…
-
High 7.8
Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install appli…
-
Medium 4.0
Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Pr…
-
Low 3.3
Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID.
-
High 7.5
Improper cryptographic implementation in Samsung Flow for Android prior to version 4.9.04 allows adjacent attackers to …
-
Medium 5.7
Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attack…
-
Medium 5.1
Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 R…
-
Medium 4.0
Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access inf…
-
Medium 4.0
Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.…
-
Low —
ReDoS based DoS vulnerability in Active Support's underscore
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process …
-
High 8.8
SQL Injection Vulnerability via ActiveRecord comments
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which auto…
-
Medium 6.1
Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect inter…
-
Unscored —
In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.
-
Low —
ReDoS based DoS vulnerability in GlobalID
A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade …
-
High 7.5
ReDoS based DoS vulnerability in Action Dispatch
A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastroph…
-
Medium 6.1
Open Redirect Vulnerability in Action Pack
An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the che…
-
Low —
ReDoS based DoS vulnerability in Action Dispatch
A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, whe…
-
High 7.5
The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affec…
-
High 7.5
The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this …
-
High 7.5
The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability …
-
High 7.5
The geofencing kernel code has a vulnerability of not verifying the length of the input data. Successful exploitation o…
-
High 7.5
The geofencing kernel code does not verify the length of the input data. Successful exploitation of this vulnerability …
-
Critical 9.1
The phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this vulnerability may a…
-
High 7.5
The IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this vulnerability can lead to…
-
High 7.5
The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this …
-
Medium 6.5
The Bluetooth module has an out-of-memory (OOM) vulnerability. Successful exploitation of this vulnerability may affect…
-
High 7.5
The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affec…
-
Medium 6.5
The Bluetooth module has an OOM vulnerability. Successful exploitation of this vulnerability may affect data confidenti…
-
High 7.5
The IHwAttestationService interface has a defect in authentication. Successful exploitation of this vulnerability may a…
-
High 7.5
The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerabi…
-
High 7.5
The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data i…
-
High 7.5
The multi-screen collaboration module has a privilege escalation vulnerability. Successful exploitation of this vulnera…
-
Medium 5.3
The SystemUI has a vulnerability in permission management. Successful exploitation of this vulnerability may cause user…
-
Medium 5.3
Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a sp…
-
Low —
Denial of service via multipart parsing in Rack
A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, p…