CVE-2018-9411

CVE-2018-9411 describes an out-of-bounds write in decrypt of ClearKeyCasPlugin.cpp caused by a missing bounds check, enabling remote code execution with no extra privileges and requiring user interaction for exploitation. Public sources consistently mirror this description, with Android’s July 20...

CVE-2018-9410

CVE-2018-9410 describes an out-of-bounds read in the Android Framework via FontUtils.cpp -> analyzeAxes, causing local information disclosure with no extra privileges and no user interaction. The connected Android bulletin lists CVE-2018-9410 under the Framework section with High severity, not...

CVE-2018-9365

CVE-2018-9365 describes a potential out-of-bounds read in the SMP L2C data path (smp_data_received in smp_l2c.cc) that could lead to remote code execution. Exploitation requires user interaction. Multiple connected sources (RH, NVD, CVE lists, Android bulletin) confirm the issue and its remote-co...

CVE-2018-9409

The CVE-2018-9409 entry affects Android’s Media framework, specifically the HWC (Hardware Composer) path: HWCSession::SetColorModeById in hwc_session.cpp. The root cause is a missing bounds check, leading to a possible out-of-bounds write. This could enable local elevation of privilege with no ad...

CVE-2018-9367

CVE-2018-9367 describes a potential out-of-bounds write in the MediaTek Cameratool CCAP component (function FT_ACDK_CCT_V2_OP_ISP_SET_TUNING_PARAS within Meta_CCAP_Para.cpp). The underlying issue is improper input validation, which could enable local escalation of privilege with no additional exe...

CVE-2018-9348

CVE-2018-9348 : The Red Hat/NVD entries describe an integer overflow in SMF_ParseMetaEvent within eas_smf.c that can cause remote Denial of Service via resource exhaustion. Exploitation requires user interaction, and the public details emphasize DoS impact with no explicit remote code execution. ...

CVE-2018-9345

CVE-2018-9345 affects Android’s BnAudioPolicyService (AudioPolicyService.cpp). The issue is information disclosure due to uninitialized data, enabling local information disclosure with no extra privileges and no user interaction required. Multiple connected sources confirm the same description. P...

CVE-2018-9344

The CVE-2018-9344 entry describes a use-after-free in DescramblerImpl.cpp caused by improper locking, enabling local privilege escalation with no extra privileges and no user interaction. Connected sources associate this issue with Android’s Media framework and list affected context in the Androi...

CVE-2018-9341

CVE-2018-9341 affects the Android Media framework: in impeg2d_mc_fullx_fully of impeg2d_mc.c there is an out-of-bounds write due to a missing bounds check. This can lead to remote arbitrary code execution in the context of a privileged process, with user interaction required to exploit. Multiple ...

CVE-2018-9340

CVE-2018-9340 affects Android Framework: in ResStringPool::setTo of ResourceTypes.cpp an attacker can cause mStringPoolSize to be out of bounds, leading to information disclosure. Root cause is out-of-bounds handling in ResStringPool. The CVE is listed in Android’s June 2018 security bulletin, wi...

CVE-2018-9339

CVE-2018-9339 affects Android’s framework Parcel.java, specifically in the methods writeTypedArrayList/readTypedArrayList, with a root cause of type confusion that enables local privilege escalation. The vulnerability can be exploited with no user interaction and requires local access. Public doc...

CVE-2018-9338

CVE-2018-9338 is an Android Framework vulnerability described in multiple sources as an out-of-bounds write in ResStringPool::setTo (ResourceTypes.cpp) caused by a missing bounds check. The issue can lead to local escalation of privilege with no user interaction required. Affected component is wi...

CVE-2023-21270

CVE-2023-21270 affects Android’s PermissionManagerServiceImpl.java, specifically in restorePermissionState, where a flaw can allow an app to retain permissions that should be revoked due to incorrect permission flag clearance during an update. This can lead to local elevation of privilege with Us...

CVE-2017-13315

CVE-2017-13315 involves an Elevation of Privilege in Android’s DcParamObject.java (writeToParcel/createFromParcel) that bypasses permissions to start an activity with system privileges without extra execution privileges. Affected component: Android System (DcParamObject parceling code). Impact to...

CVE-2020-26066

Cisco SD-WAN vManage Software Web UI contains an XML External Entity (XXE) processing vulnerability in certain XML files parsed by the application. An authenticated remote attacker could exploit this flaw to gain read and write access to information stored on the system. Affected component is the...

CVE-2020-26067

CVE-2020-26067 concerns Cisco Webex Teams web interface. Affected component: web-based interface; issue arises from improper validation of usernames. An authenticated, remote attacker can create an account containing malicious HTML/script and join a space with that name, enabling cross-site scrip...

CVE-2020-26062

Cisco Integrated Management Controller (CIMC) suffers a username-enumeration vulnerability due to differences in authentication responses. An unauthenticated, remote attacker can determine valid usernames by sending authentication requests to CIMC over the network. Multiple connected sources (CVE...

CVE-2020-26063

CVE-2020-26063 — Cisco Integrated Management Controller (IMC) API endpoints have improper authorization checks, enabling an authenticated remote attacker to bypass authorization and actions on the vulnerable system. Exploitation involves sending crafted API requests that could download files or m...

CVE-2020-26071

CVE-2020-26071 affects Cisco SD-WAN Software CLI. The issue is caused by insufficient input validation for specific commands, allowing an authenticated, local attacker to create or overwrite arbitrary files on an affected device, potentially leading to a DoS. Cisco has released software updates a...

CVE-2020-27124

Cisco ASA SSL/TLS DoS (CVE-2020-27124): Vulnerability in the SSL/TLS handler due to improper error handling on established SSL/TLS connections can cause an unauthenticated remote attacker to reload the device, leading to DoS. Affected products: Cisco ASA Software. Impact: device reload and servic...