CVE-2016-10277

An elevation of privilege vulnerability in the Motorola bootloader could enable a local malicious application to execute arbitrary code within the context of the bootloader. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing...

CVE-2017-0623

An elevation of privilege vulnerability in the HTC bootloader could enable a local malicious application to execute arbitrary code within the context of the bootloader. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18...

CVE-2016-10277

CVE-2016-10277 : An elevation-of-privilege in the Motorola bootloader allows a local app to run arbitrary code in the bootloader context by exploiting kernel command-line injection, leading to potential full device compromise. Affected: Android with Kernel-3.10 and Kernel-3.18. Exploitation evide...

CVE-2016-10275

An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the...

CVE-2017-0623

CVE-2017-0623 describes an elevation-of-privilege vulnerability in the HTC bootloader that could allow a local malicious app to execute arbitrary code within the bootloader context. Affected software is Android on Kernel-3.18, with device-specific impact noted for Pixel and Pixel XL in the CVE li...

Google Nexus 9 SensorHub Firmware Downgrade Vulnerability(CVE-2017-0582)

Product Google Nexus 9 Vulnerable Version Nexus 9 Android Builds before N4F27B - May 2017, i.e. before bootloader 3.50.0.0143. Mitigation Install N4F27B or later bootloader version 3.50.0.0143. Technical Details The Nexus 9 device contains a SoC manufactured by Cywee which implements a “Sensor...

Google Nexus 9 Cypress SAR Firmware Injection via I2C(CVE-2017-0563)

Product Google Nexus 9 Vulnerable Version Nexus 9 Android Builds before N4F27B - May 2017, i.e. before bootloader 3.50.0.0143. Mitigation Install N4F27B or later bootloader version 3.50.0.0143. Technical Details The Nexus 9 device contains a sensor SoC manufactured by Cypress. The sensor is manag...

CVE-2017-5948

CVE-2017-5948 is a downgrade-attack vulnerability in OnePlus OxygenOS and HydrogenOS OTA updates. The root cause is a lenient updater-script in OTAs for OnePlus One, X, 2, 3, and 3T that does not enforce that the current version is

Google Android HTC bootloader elevation of privilege vulnerability

Google Android is a Linux-based operating system for smartphone devices. An elevation of privilege vulnerability exists in the Google Android HTC bootloader, which can be exploited by a remote attacker to build a malicious application that can be elevated in privilege by inducing the user to pars...

Android Qualcomm bootloader privilege escalation vulnerability

Android on Google Pixel XL, etc. is an open source Linux-based operating system for Google Pixel XL, etc. smart devices developed by Google Inc. and the Open Handheld Alliance OHA.Qualcomm bootloader is one of the programs used in the... Qualcomm bootloader is a bootloader developed by Qualcomm...

Android Qualcomm bootloader boost vulnerability

Android on Google Pixel XL, etc. is an open source Linux-based operating system for Google Pixel XL, etc. smart devices developed by Google Inc. and the Open Handheld Alliance OHA.Qualcomm bootloader is one of the programs used in the... Qualcomm bootloader is a bootloader developed by Qualcomm...

Google Patches Six Critical Mediaserver Bugs in Android

Google pushed out its monthly Android patches Monday, addressing 17 critical vulnerabilities, six of which are tied to its problematic Mediaserver component. An additional four critical vulnerabilities related to Qualcomm components in Android handsets including Google’s own Nexus 6P, Pixel XL an...

CVE-2016-10275

An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the...

CVE-2016-10276

An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the...

CVE-2016-10277

An elevation of privilege vulnerability in the Motorola bootloader could enable a local malicious application to execute arbitrary code within the context of the bootloader. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing...

CVE-2017-5625

In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbitrary partition except 'keystore' by issuing the 'fastboot oem dump ' fastboot command...

Design/Logic Flaw

DISPUTED Riverbed RiOS through 9.6.0 does not require a bootloader password, which makes it easier for physically proximate attackers to defeat the secure-vault protection mechanism via a crafted boot. NOTE: the vendor believes that this does not meet the definition of a vulnerability. The produc...

CVE-2017-7305

Riverbed RiOS through 9.6.0 does not require a bootloader password, which makes it easier for physically proximate attackers to defeat the secure-vault protection mechanism via a crafted boot. NOTE: the vendor believes that this does not meet the definition of a vulnerability. The product contain...

CVE-2017-7305

Riverbed RiOS through 9.6.0 does not require a bootloader password, which makes it easier for physically proximate attackers to defeat the secure-vault protection mechanism via a crafted boot. NOTE: the vendor believes that this does not meet the definition of a vulnerability. The product contain...

CVE-2017-7305

Riverbed RiOS through 9.6.0 does not require a bootloader password, which makes it easier for physically proximate attackers to defeat the secure-vault protection mechanism via a crafted boot. NOTE: the vendor believes that this does not meet the definition of a vulnerability. The product contain...