Archive
4 September 2025
Vulnerabilities first published on this day (UTC), newest first.
101 results · Clear filters · Feed
-
Medium 6.0
frost-core: refresh shares with smaller min_signers will reduce group security
ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures). In versions 2.0.0 through 2.1.0, refresh shares with smaller min_signers will reduce security of group. The inability to change min_signers (i.e. the threshold…
-
Medium 5.1
api: Shared OAuth Signing Key Between Different Instances
api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed…
-
Medium 6.5
Xbox Certification Bug Copilot Djando Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Xbox allows an unauthorized attacker to disclose information over a network.
-
Medium 6.1
Electron is vulnerable to Code Injection via resource modification
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via …
-
Medium 5.1
FreePBX UCP is Vulnerable to Stored XSS Through its User Control Panel
contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions 15.0.14 and below, 16.0.0 through 16.0.26.4 and 17.0.0 through 17.0.5, a stored cross-site scripting (XSS) vulnerability in FreePBX all…
-
Medium 6.2
In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility …
-
Medium 4.0
In android_app of Android.bp, there is a possible way to launch any activity as a system user. This could lead to local…
-
Medium 4.0
In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new…
-
Medium 5.0
In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error. This coul…
-
Medium 5.5CVE-2025-48561 Public exploit
In multiple locations, there is a possible way to access data displayed on the screen due to side channel information d…
-
Medium 5.5
In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy. This coul…
-
Medium 5.5
In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input va…
-
Medium 6.1
In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a …
-
Medium 5.0
In multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confuse…
-
Medium 5.5
In testGrantSlicePermission of SliceManagerTest.java, there is a possible permanent denial of service due to a path tra…
-
Medium 5.5
In multiple functions of AccountManagerService.java, there is a possible permanent denial of service due to resource ex…
-
Medium 5.5
In setApplicationHiddenSettingAsUser of PackageManagerService.java, there is a possible way to hide a system critical p…
-
Medium 5.5
In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confuse…
-
Medium 4.0
In multiple locations, there is a possible way to overlay biometrics due to a tapjacking/overlay attack. This could lea…
-
Medium 6.2
In multiple locations, there is a possible way to leak hidden work profile notifications due to a logic error in the co…
-
Medium 4.0
In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserAct…
-
Medium 5.5
In isSystem of WifiPermissionsUtil.java, there is a possible permission bypass due to a missing permission check. This …
-
Medium 5.7
In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio st…
-
Medium 5.5
In allowPackageAccess of multiple files, resource exhaustion is possible when repeatedly adding allowed packages. This …
-
Medium 5.5
In multiple functions of DexUseManagerLocal.java, there is a possible way to crash system server due to a logic error i…
-
Medium 5.5
In isContentUriForOtherUser of BluetoothOppSendFileInfo.java, there is a possible cross user data leak due to a logic e…
-
Medium 5.5
In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to l…
-
Medium 5.5
In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead…
-
Medium 5.5
In offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission che…
-
Medium 6.5
In add_attr of sdp_discovery.cc, there is a possible out of bounds read due to a missing bounds check. This could lead …
-
Medium 5.5
In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credent…
-
Medium 5.5
In multiple locations, there is a possible way to persistently DoS the device due to a missing length check. This could…
-
Medium 5.5
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible incorrect verification of proper intent…
-
Medium 5.5
In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. T…
-
Medium 4.4
In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local …
-
Medium 5.1
In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant f…
-
Medium 4.0
In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error …
-
Medium 4.0
In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. Th…
-
Medium 6.2
In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a m…
-
Medium 4.0
In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to…