CVE-2024-25083

Vulnerability summary (CVE-2024-25083) : BeyondTrust Privilege Management for Windows, before version 24.1, contains a flaw where a low-privileged user initiating a repair can cause arbitrary programs to run with elevated privileges. Root cause: flawed handling of the repair flow enabling privile...

CVE-2023-45918

CVE-2023-45918 is a rejected CVE entry. The Initial Description states it was withdrawn by the CNA and not a security issue; the Connected Documents reflect this with a matching entry noting the withdrawal and lack of public details. There are no active technical details, affected products, explo...

Design/Logic Flaw

In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Out-of-bounds

In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure of past print jobs or other print-related information, with no additional execution privileges needed. User interaction is not needed for exploitation...

Memory corruption

In discoverythread of Dns64Configuration.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Heap overflow

In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

Memory corruption

In readLogs of StatsService.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40124

CVE-2023-40124 involves a local information disclosure (cross-user read) due to a confused deputy. Public docs from NVD/Red Hat/OSV describe impact as local, with no execution privileges required and no user interaction needed. Android security bulletin entries for 2023-11-01/05 group this under ...

CVE-2023-40115

The CVE-2023-40115 issue is in readLogs of StatsService.cpp, causing memory corruption via a use-after-free and enabling local privilege escalation with no extra user interaction. Multiple sources (NVD/Red Hat/OSV/PRION, etc.) confirm the vulnerability. Affected component is part of Android’s Sta...

CVE-2023-40113

CVE-2023-40113 affects the Android platform (System component) and stems from a missing permission check that allowed apps to access cross‑user message data. This enables local information disclosure without extra privileges or user interaction. Public details in the provided documents are limite...

CVE-2023-40110

CVE-2023-40110 is tied to a heap buffer overflow in multiple MtpPacket.cpp functions, causing an out-of-bounds write that could enable local privilege escalation with user interaction required. Connected sources (NVD/Red Hat/PRION/CNNVD/Android bulletin) consistently reference MtpPacket.cpp as th...

CVE-2023-40106

CVE-2023-40106 concerns a BAL bypass in Android’s NotificationManagerService.java (sanitizeSbn) that could allow launching an activity from the background, enabling local privilege escalation without extra privileges or user interaction. Affected component is the background handling path in the A...

CVE-2023-40109

CVE-2023-40109 affects the Android USB configuration path: createFromParcel in UsbConfiguration.java. The issue enables a background activity launch via a permissions bypass, causing local privilege escalation with no extra execution privileges, requiring user interaction for exploitation. Report...

CVE-2023-40107

CVE-2023-40107 concerns a use-after-free in ARTPWriter (ARTPWriter.cpp) related to uninitialized data, enabling local privilege escalation without extra user interaction. The affected component is ARTPWriter (ARTPWriter.cpp); underlying issue is use-after-free, leading to potential arbitrary code...

CVE-2023-40111

The provided documents only repeat the CVE description (MediaSessionRecord.java, possible local privilege escalation via a confused deputy) with no additional technical details, affected versions, or fixes. Public technical details are not available here; monitor for updates.

CVE-2023-40112

CVE-2023-40112 describes a likely out-of-bounds read in the printer subsystem: the function ippSetValueTag in ipp.c performs a missing bounds check, potentially allowing local disclosure of past print jobs or other print-related data. Exploitation is described as local (no remote access) with no ...

CVE-2023-40114

CVE-2023-40114 relates to an out-of-bounds write caused by a use-after-free in MtpFfsHandle.cpp, leading to local elevation of privilege with no additional execution privileges required. Exploitation requires user interaction. The public details identify the affected area (Android-related code pa...

CVE-2023-40105

CVE-2023-40105 affects the Android framework (ActivityManagerService), specifically in backupAgentCreated. The root cause is a missing permission check in this path, enabling local information disclosure. The impact is high confidentiality loss with no integrity or availability impact described, ...

CVE-2023-40100

CVE-2023-40100 affects Android via a memory corruption in the discovery_thread of Dns64Configuration.cpp caused by a use-after-free. This can lead to local elevation of privilege with no extra execution privileges required and no user interaction needed, per multiple sources. The vulnerability is...

CVE-2024-25123

MSS (Mission Support System) contains a path manipulation vulnerability in mslib/index.py where the filename route parameter can include ../, enabling reading of files outside the intended directory. This affects MSS prior to version 8.3.3; upgrade to 8.3.3 to mitigate. The issue is caused by how...