PT-2025-38252

Name of the Vulnerable Software and Affected Versions parcel versions 2.0.0-alpha and earlier Description A security issue exists in Parcel that allows malicious websites to send XMLHTTPRequests to the application's development server and read the response, potentially leading to source code thef...

Linux Distros Unpatched Vulnerability : CVE-2015-3845

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of...

Linux Distros Unpatched Vulnerability : CVE-2019-2118

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In various functions of Parcel.cpp, there are uninitialized or partially initialized stack variables. These could lead to local information disclosure with no...

Linux Distros Unpatched Vulnerability : CVE-2022-20474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In readLazyValue of Parcel.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. This could lead to local...

Google Android elevation of privilege vulnerability (CNVD-2025-23034)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability caused by an out-of-bounds write due to a heap-based buffer overflow in the appendFrom function in Parcel.cpp. An attacker can exploit the vulnerability to...

CVE-2025-32325

In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48535

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulnerability due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. Us...

Malicious code in sirius-warp-quantum-parcel (npm)

The package sirius-warp-quantum-parcel was found to contain malicious code...

MAL-2025-43825 Malicious code in cladistics-decoherence-perseus-parcel (npm)

The package cladistics-decoherence-perseus-parcel was found to contain malicious code...

MAL-2025-45282 Malicious code in nebula-browserify-parcel-rocket (npm)

The package nebula-browserify-parcel-rocket was found to contain malicious code...

Malicious code in parcel-stop-paleontology-hydrogeology (npm)

The package parcel-stop-paleontology-hydrogeology was found to contain malicious code...

Malicious code in nebula-browserify-parcel-rocket (npm)

The package nebula-browserify-parcel-rocket was found to contain malicious code...

MAL-2025-46072 Malicious code in sirius-warp-quantum-parcel (npm)

The package sirius-warp-quantum-parcel was found to contain malicious code...

MAL-2025-45505 Malicious code in parcel-stop-paleontology-hydrogeology (npm)

The package parcel-stop-paleontology-hydrogeology was found to contain malicious code...

Malicious code in cladistics-decoherence-perseus-parcel (npm)

The package cladistics-decoherence-perseus-parcel was found to contain malicious code...

CVE-2025-48535

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulnerability due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. Us...

CVE-2025-32325

In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48535

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulnerability due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. Us...

CVE-2025-48535

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulnerability due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. Us...

CVE-2025-48535

The Android operating system is affected by an elevation of privilege vulnerability in the assertSafeToStartCustomActivity function within AppRestrictionsFragment.java . The root cause is an unsafe deserialization flaw triggered by a parcel mismatch , which can result in a launch anywhere vulnera...