CVE-2021-39639

In TBD of fvp.c, there is a possible way to glitch CPU behavior due to a missing permission check. This could lead to local escalation of privilege with physical access to device internals with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2021-1004

CVE-2021-1004 affects Android 12, via a missing permission check in getConfiguredNetworks() of WifiServiceImpl.java that can allow an app to determine whether another app is installed without query permissions. This is a local privilege escalation (no user interaction required) per the descriptio...

CVE-2021-1025

CVE-2021-1025 (Android 12) involves a flaw in hasNamedWallpaper in WallpaperManagerService.java that can reveal whether an app is installed without query permissions, causing local information disclosure without extra execution privileges. The root cause is a missing permission check. Impact is i...

CVE-2021-0982

In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2021-0985

In onReceive of AlertReceiver.java, there is a possible way to dismiss system dialog due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2021-1017

In AdapterService and GattService definition of AndroidManifest.xml, there is a possible way to disable bluetooth connection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

CVE-2021-0922

CVE-2021-0922 : The Android framework vulnerability resides in PackageManagerService.java, in enforceCrossUserOrProfilePermission, where a missing permission check can bypass INTERACT_ACROSS_PROFILES. This enables local escalation of privilege on Android 11 without user interaction. Documents con...

CVE-2021-0923

In createOrUpdate of Permission.java, there is a possible way to gain internal permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2021-0926

In onCreate of NfcImportVCardActivity.java, there is a possible way to add a contact without user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2021-0653

In enqueueNotification of NetworkPolicyManagerService.java, there is a possible way to retrieve a trackable identifier due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

PT-2021-13422

Name of the Vulnerable Software and Affected Versions Android version Android-12 Description In the AdapterService and GattService definition of AndroidManifest.xml, there is a possible way to disable bluetooth connection due to a missing permission check. This could lead to local escalation of...

CVE-2021-1011: Missing Authorization

In setPackageStoppedState of PackageManagerService.java, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-188219307...

PT-2021-13399

Name of the Vulnerable Software and Affected Versions Android versions Android-12 Description The issue is related to a missing permission check in the requestRouteToHostAddress function of ConnectivityService.java. This could allow an attacker to determine whether an app is installed without que...

PT-2021-22695

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue allows access to PIN protected settings without PIN confirmation due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2021-39651: Missing Authorization

In TBD of TBD, there is a possible way to access PIN protected settings bypassing PIN confirmation due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2021-13408

Name of the Vulnerable Software and Affected Versions Android versions Android-12 Description In the getConfiguredNetworks method of WifiServiceImpl.java, there is a possible way to determine whether an app is installed without query permissions due to a missing permission check. This could lead ...

CVE-2021-0653: Missing Authorization

In enqueueNotification of NetworkPolicyManagerService.java, there is a possible way to retrieve a trackable identifier due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2021-0922: Missing Authorization

In enforceCrossUserOrProfilePermission of PackageManagerService.java, there is a possible bypass of INTERACTACROSSPROFILES permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

CVE-2021-0994: Missing Authorization

In requestRouteToHostAddress of ConnectivityService.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interactio...

CVE-2021-0982: Missing Authorization

In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...