2022

In incfs, there is a possible way of mounting on arbitrary paths due to a missing permission check. This could lead to l

An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_

An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients

In Dialer, there is a possible way to manipulate visual voicemail settings due to a missing permission check. This could

In Telecom, there is a possible leak of TTY mode change due to a missing permission check. This could lead to local esca

In SystemUI, there is a possible arbitrary Activity launch due to a confused deputy. This could lead to local escalation

In CellBroadcastReceiver, there is a possible path to enable specific cellular features due to a missing permission chec

In rcsservice, there is a possible way to modify TTY mode due to a missing permission check. This could lead to local es

In Telephony, there is a possible unauthorized modification of the PLMN SIM file due to a missing permission check. This

In SmsController, there is a possible information disclosure due to a permissions bypass. This could lead to local escal

In Traceur, there is a possible bypass of developer settings requirements for capturing system traces due to a missing p

In NFC, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege

In Bluetooth, there is a possible way to access the a2dp audio control switch due to a missing permission check. This co

In Settings, there is a possible way to misrepresent which app wants to add a wifi network due to improper input validat

In Settings, there is a possible way to add an auto-connect WiFi network without the user's consent due to a missing per

In miniadb, there is a possible way to get read/write access to recovery system properties due to an insecure default va

In Settings, there is a possible way to display an incorrect app name due to improper input validation. This could lead

In Settings, there is a possible way to make the user enable WiFi due to improper input validation. This could lead to l

In tremolo, there is a possible out of bounds read due to an integer overflow. This could lead to remote information dis

In libstagefright, there is a possible out of bounds write due to an integer overflow. This could lead to local escalati

In WindowManager, there is a possible way to start a foreground activity from the background due to a missing permission

In Bubbles, there is a possible way to interfere with Bubbles due to a permissions bypass. This could lead to local esca

In PackageManager, there is a possible way to change the splash screen theme of other apps due to a missing permission c

In WindowManager, there is a possible way to start non-exported and protected activities due to a missing permission che

In PermissionController, there is a possible way to delete some local files due to an unsafe PendingIntent. This could l

In PackageManager, there is a possible way to update the last usage time of another package due to a missing permission

In Keymaster, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation

In createGeneralSlice of ConnectedDevicesSliceProvider.java.java, there is a possible permission bypass due to an unsafe

In createBluetoothDeviceSlice of ConnectedDevicesSliceProvider.java, there is a possible permission bypass due to an uns

Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.

Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.

RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file.

Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache Dol

SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service.

Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.

SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service.

A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by ex

Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. When first powered up, a signature wi

textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthentica

NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote

An SQL Injection vulnerability exits in PuneethReddyHC online-shopping-system as of 11/01/2021 via the p parameter in pr

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Mast

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server repli

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar dat

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver

A buffer overflow vulnerability exists in the AMF of open5gs 2.1.4. When the length of MSIN in Supi exceeds 24 character

A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escala

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external enti

Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML exter