CVE-2021-0583

CVE-2021-0583 affects Android (9/10) and relates to the BluetoothPairingDialog onCreate, enabling a tapjacking/overlay scenario that could lead to local elevation of privilege. According to Red Hat and NVD entries, exploitation requires user interaction (UI: Required) and local access, with a hig...

Apple iOS 安全漏洞

Apple iOS is a set of operating systems developed for mobile devices by the American company Apple. Apple iOS 15 and iPadOS 15 previously had a security vulnerability that stemmed from the fact that VPN configurations may have been installed by apps without the user's permission...

CVE-2021-0594

In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. This could lead to remote proximal, NFC escalation of privilege allowing an attacker to deceive a user into allowing a Bluetooth connection with no additional execution...

Input validation

In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. This could lead to remote proximal, NFC escalation of privilege allowing an attacker to deceive a user into allowing a Bluetooth connection with no additional execution...

CVE-2021-0594

CVE-2021-0594 affects Android: In ConfirmConnectActivity.onCreate, there is a possible remote bypass of user consent due to improper input validation. This could lead to remote (proximal, NFC) escalation of privilege by deceiving a user into allowing a Bluetooth connection with no additional exec...

ASB-A-176445224

In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. This could lead to remote proximal, NFC escalation of privilege allowing an attacker to deceive a user into allowing a Bluetooth connection with no additional execution...

ASB-A-175213041

In sendNetworkConditionsBroadcast of NetworkMonitor.java, there is a possible way for a privileged app to receive WiFi BSSID and SSID without location permissions due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User...

CVE-2021-0539

In archiveStoredConversation of MmsService.java, there is a possible way to archive message conversation without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2021-0523

In onCreate of WifiScanModeActivity.java, there is a possible way to enable Wi-Fi scanning without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product:...

Design/Logic Flaw

In onCreate of WifiScanModeActivity.java, there is a possible way to enable Wi-Fi scanning without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2021-0523

In onCreate of WifiScanModeActivity.java, there is a possible way to enable Wi-Fi scanning without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2021-0487

In onCreate of CalendarDebugActivity.java, there is a possible way to export calendar data to the sdcard without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for...

Design/Logic Flaw

In onCreate of CalendarDebugActivity.java, there is a possible way to export calendar data to the sdcard without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for...

CVE-2021-0487

CVE-2021-0487 affects Android 11 (Framework) where CalendarDebugActivity.java could export calendar data to SD card via a tapjacking/overlay attack, enabling local elevation of privilege without user interaction. The Android security bulletin notes this under Framework with Updated AOSP versions ...

CVE-2021-0487

In onCreate of CalendarDebugActivity.java, there is a possible way to export calendar data to the sdcard without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for...

ASB-A-174047492

In onCreate of WifiScanModeActivity.java, there is a possible way to enable Wi-Fi scanning without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

PUB-A-179688673

In onLoadFailed of AnnotateActivity.java, there is a possible way to gain WRITEEXTERNALSTORAGE permissions without user consent due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio...

ASB-A-174046397

In onCreate of CalendarDebugActivity.java, there is a possible way to export calendar data to the sdcard without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2021-0446

In ImportVCardActivity, there is a possible way to bypass user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-17225212...

Design/Logic Flaw

In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege and pairing malicious devices with no additional execution privileges needed. User...