Code injection

In getCurrentState of OneTimePermissionUserManager.java, there is a possible way to hold one-time permissions after the app is being killed due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

CVE-2023-21399

there is a possible way to bypass cryptographic assurances due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21399

there is a possible way to bypass cryptographic assurances due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21399

CVE-2023-21399 affects Google Pixel devices (Pixel bulletin: GSC component) and is described as a logic-error–driven bypass of cryptographic guarantees that enables local privilege escalation with no user interaction. Impact: Elevation of Privilege, Local; exploitability is listed as high with lo...

CVE-2023-21256

Summary: CVE-2023-21256 concerns Android’s SettingsHomepageActivity.java, where a logic error could let an attacker launch arbitrary activities from Settings, enabling local elevation of privilege. The vulnerability requires user interaction to exploit and is described across multiple sources (NV...

CVE-2023-21256

In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2023-21256

In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2023-21254

In getCurrentState of OneTimePermissionUserManager.java, there is a possible way to hold one-time permissions after the app is being killed due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

CVE-2023-21254

In getCurrentState of OneTimePermissionUserManager.java, there is a possible way to hold one-time permissions after the app is being killed due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

CVE-2023-21254

CVE-2023-21254 affects Android Framework in the getCurrentState path of OneTimePermissionUserManager.java. The issue allows holding one-time permissions after the app is killed due to a logic error, enabling local privilege escalation with no extra execution privileges and without user interactio...

CVE-2023-21245

CVE-2023-21245 affects Google's Android Framework, specifically the showNextSecurityScreenOrFinish path in KeyguardSecurityContainerController.java. A logic error could allow access to the lock screen during device setup, enabling local elevation of privilege without user interaction. Exploitatio...

CVE-2023-21245

In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lock screen during device setup due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...

CVE-2023-21145

CVE-2023-21145 corresponds to an Android Framework elevation-of-privilege issue in ActivityRecord.java, specifically in updatePictureInPictureMode, where a logic error could bypass background launch restrictions. The result is local escalation of privilege with no extra execution privileges or us...

CVE-2023-20942

In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2023-20942

The CVE-2023-20942 issue affects Android’s AudioFlinger.cpp, specifically in openMmapStream, where a logic error can allow recording audio without showing the microphone privacy indicator. This vulnerability enables local privilege escalation with no extra execution privileges and requires no use...

CVE-2023-20942

In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

Design/Logic Flaw

A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system...

Design/Logic Flaw

The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. This vulnerability affects Firefox for iOS 115...

Design/Logic Flaw

Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected...

Design/Logic Flaw

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the...