Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.
The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to exe...
The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse.
Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files.
System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.
Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or del...
Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that al...
Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet.
The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or...
ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz") where name re...
AI-powered asset discovery, dark web monitoring, CVE alerting, and vulnerability scanning — all in one platform.
