CVE-2024-40658

In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-40662

In scheme of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-40655

CVE-2024-40655 is an Android framework issue in the CallScreeningServiceHelper.java, where a permissions bypass could allow maintaining a while-in-use permission in the background, enabling local elevation of privilege with no extra execution privileges. Exploitation requires user interaction. Th...

CVE-2024-40657

CVE-2024-40657 affects the Android Framework, specifically the AccountTypePreferenceLoader.addPreferencesForType path. The issue can enable a confused deputy to disable apps for other users, causing local elevation of privilege with no extra execution privileges required and no user interaction n...

CVE-2024-40655

In bindAndGetCallIdentification of CallScreeningServiceHelper.java, there is a possible way to maintain a while-in-use permission in the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is...

CVE-2024-40655

In bindAndGetCallIdentification of CallScreeningServiceHelper.java, there is a possible way to maintain a while-in-use permission in the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is...

CVE-2024-40650

In wifiitemeditcontent of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-40652

In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

CVE-2024-40654

CVE-2024-40654 is an Android issue described across multiple sources as a privilege bypass (confused deputy) that could enable local escalation of privilege. Exploitation is noted to require user interaction in at least one description, with impact described as high (confidentiality, integrity, a...

CVE-2024-40650

In wifiitemeditcontent of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-40654

In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2024-23716

In CVE-2024-23716, a race condition in DevmemIntPFNotify within devicemem_server.c can trigger a use-after-free, enabling local privilege escalation in the kernel with no extra execution privileges or user interaction required. The linked Red Hat and Android bulletin data corroborate a kernel-lev...

CVE-2024-31336

In PVRSRVBridgeRGXKickTA3D2 of serverrgxta3dbridge.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-28996 · Veeam · Veeam Backup For Nutanix Ahv

Name of the Vulnerable Software and Affected Versions: Veeam Backup for Nutanix AHV affected versions not specified Description: A server-side request forgery SSRF vulnerability allows a low-privileged user to perform local privilege escalation through exploiting the SSRF vulnerability. This issu...

kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application

Hardware logic with insecure de-synchronization in IntelR DSA and IntelR IAA for some IntelR 4th or 5th generation XeonR processors may allow an authorized user to potentially enable escalation of privilege local access...

Android Security Bulletin—September 2024Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2024-09-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

CVE-2024-20086

In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08932916; Issue ID: MSV-1551...

CVE-2024-20086

In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08932916; Issue ID: MSV-1551...

PUB-A-330446276

In ppmpunprotectbuf of drm/code/drmfw.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-345848543

In TBD of TBD, there is a possible LCS signing enforcement missing due to test/debugging code left in a production build. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...