yakov shafranovich vulnerabilities and exploits

(subscribe to this query)

7.8

CVSSv3

An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.

Elastic Elasticsearch

7.4

CVSSv3

Amazon Fire OS prior to 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.

Amazon Fire Os

7.5

CVSSv3

A information disclosure vulnerability in the Android system (ui). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. ID: A-38258991.

Google Android 7.1.1 Google Android 8.0 Google Android 5.1.1 Google Android 6.0 Google Android 6.0.1 Google Android 7.0 Google Android 7.1.2

8.8

CVSSv3

ASUS RT-AC* and RT-N* devices with firmware prior to 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF.

Asus Rt-ac1750 Firmware 3.0.0.4.380.7266

1 Article

7.5

CVSSv3

ASUS RT-AC* and RT-N* devices with firmware prior to 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map.

Asus Rt-ac1750 Firmware 3.0.0.4.380.7266

4.7

CVSSv3

A denial of service vulnerability in Proxy Auto Config in Android 4.x prior to 4.4.4, 5.0.x prior to 5.0.2, 5.1.x prior to 5.1.1, 6.x prior to 2016-11-01, and 7.0 prior to 2016-11-01 could enable a remote malicious user to use a specially crafted file to cause a device hang or re...

Google Android 7.0 Google Android

7.5

CVSSv3

The London Trust Media Private Internet Access (PIA) application prior to 1.3.3.1 for Android allows remote malicious users to cause a denial of service (application crash) via a large VPN server-list file.

Londontrustmedia Private Internet Access

7.5

CVSSv3

When wifi is switched, function sendNetworkStateChangeBroadcast of WifiStateMachine.java broadcasts an intent including detailed wifi network information. This could lead to information disclosure with no execution privileges needed. User interaction is not needed for exploitatio...

Google Android 7.1.1 Google Android 7.1.2 Google Android 9.0 Google Android 8.0 Google Android 8.1 Google Android 7.0

1 Article

3.3

CVSSv3

In WiFi, the RSSI value and SSID information is broadcast as part of android.net.wifi.RSSI_CHANGE and android.net.wifi.STATE_CHANGE intents. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploita...

Google Android 10.0

7.5

CVSSv3

Android 1.0 up to and including 9.0 has Insecure Permissions. The Android bug ID is 77286983.

Google Android

1 Github repository

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook