CVE-2020-0269
published 2020-09-18CVE-2020-0269: In Android Auto Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.15%
4.6th percentile
In Android Auto Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-151645626
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| joyent | json | >= 0 < 2.3.0 | 2.3.0 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
ghsa7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-72g7-hpv6-j389: In Android Auto Settings, there is a possible permission bypass due to an unsafe PendingIntent
ghsa_unreviewed·2022-05-24
CVE-2020-0269 [MEDIUM] CWE-281 GHSA-72g7-hpv6-j389: In Android Auto Settings, there is a possible permission bypass due to an unsafe PendingIntent
In Android Auto Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-151645626
GHSA
Unsafe object creation in json RubyGem
ghsa·2020-07-27·CVSS 7.5
CVE-2020-10663 [HIGH] CWE-20 Unsafe object creation in json RubyGem
Unsafe object creation in json RubyGem
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269/GHSA-x457-cw4h-hq5f, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
Red Hat
rubygem-json: Unsafe object creation vulnerability in JSON
vendor_redhat·2020-03-19·CVSS 7.5
CVE-2020-10663 [HIGH] CWE-915 rubygem-json: Unsafe object creation vulnerability in JSON
rubygem-json: Unsafe object creation vulnerability in JSON
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
A flaw was found in rubygem-json. While parsing certain JSON documents, the json gem (including the one bundled with Ruby) can be coerced into creating arbitrary objects in the target system. This is the same issue as CVE-2013-0269.
Statement: Red Hat CloudForms 5 uses vulnerable rubygem-json, however, is not
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-09-18
Published