2022

In onReceive of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a

In onResume of CredentialStorage.java, there is a possible way to cleanup content of credentials storage due to a missin

In deleteNotificationChannelGroup of NotificationManagerService.java, there is a possible way to run foreground service

In updateState of UsbDeviceManager.java, there is a possible unauthorized access of files due to a confused deputy. This

In onCreate of RequestManageCredentials.java, there is a possible way for a third party app to install certificates with

In serviceConnection of ControlsProviderLifecycleManager.kt, there is a possible way to keep service running in foregrou

In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to lo

In checkFileUriDestination of DownloadProvider.java, there is a possible way to bypass external storage private director

In createOrUpdate of BasePermission.java, there is a possible permission bypass due to a logic error in the code. This c

In parse of RoleParser.java, there is a possible way for default apps to get permissions explicitly denied by the user d

In onUidStateChanged of AppOpsService.java, there is a possible way to access location without a visible indicator due t

In onCreate of SetupLayoutActivity.java, there is a possible way to setup a work profile bypassing user consent due to a

In setDisplayPadding of WallpaperManagerService.java, there is a possible way to cause a persistent DoS due to improper

In multiple functions of odsign_main.cpp, there is a possible way to persist system attack due to a logic error in the c

In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race conditi

In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag c

In ih264d_parse_decode_slice of ih264d_parse_slice.c, there is a possible out of bounds write due to a heap buffer overf

In PackageManager, there is a possible permanent denial of service due to resource exhaustion. This could lead to local

A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser i

A flaw was found in htmldoc before v1.9.12. Heap buffer overflow in pspdf_prepare_outpages(), in ps-pdf.cxx may lead to

A flaw was found in htmldoc in v1.9.12. Double-free in function pspdf_export(),in ps-pdf.cxx may result in a write-what-

A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts c

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx)

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by th

In NotificationStackScrollLayout of NotificationStackScrollLayout.java, there is a possible way to bypass Factory Reset

Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Li

Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable

Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.

There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted

In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privile

Cross-site Scripting (XSS) vulnerability in ArchivistaBox webclient allows an attacker to craft a malicious link, execut

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUS

A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen a

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory a

An issue was discovered in Projectworlds Hospital Management System v1.0. Unauthorized malicious attackers can add patie

A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive infor

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identit

Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login c

Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct

The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitr

The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote att

In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might

Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This o

Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command

Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command

Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command

Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name