CVE-2023-35677

CVE-2023-35677 describes a DoS vulnerability in Android where, in the onCreate path of DeviceAdminAdd.java, a missing permission check could allow a device admin to be forcibly added. This enables local denial of service (factory reset or persistent locking) without extra execution privileges and...

CVE-2023-35674

The CVE-2023-35674 issue affects the Android Framework, specifically an onCreate path in WindowState.java that can launch a background activity due to a logic error. This enables local elevation of privilege without extra execution privileges and without user interaction. The Android Security Bul...

PT-2023-25262 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a missing permission check in the onCreate method of DeviceAdminAdd.java, which could allow a device admin to be forcibly added. This could lead to local denial of...

ASB-A-280793427

In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could lead to local denial of service factory reset or continuous locking with no additional execution privileges needed. User interaction is not needed for...

Design/Logic Flaw

In onCreate of LockSettingsActivity.java, there is a possible way set a new lockscreen PIN without entering the existing PIN due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio...

Google Android security vulnerabilities

Google Android is a Linux-based open source operating system from Google. Google Android onCreate module has an authorization issue vulnerability that stems from a lack of permission checking in the onCreate module of ManagePermissionsActivity.java, with one possible way to bypass the Restore...

PT-2023-17926 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a missing permission check in the onCreate method of ManagePermissionsActivity.java. This could allow bypassing factory reset...

CVE-2023-21251

In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

CVE-2023-21251

In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

CVE-2023-21251

CVE-2023-21251 affects the Android Framework, specifically the onCreate path in ConfirmDialog.java . The issue describes an improper input validation that could permit a connection to VNP without user consent, yielding a local elevation of privilege (requires user interaction). The impact is cons...

PT-2023-18037 · Google · Android

Name of the Vulnerable Software and Affected Versions: ConfirmDialog.java affected versions not specified Description: The issue is related to improper input validation in the onCreate method of ConfirmDialog.java, allowing a possible connection to VNP without the user's consent. This could lead ...

Google Pixel security vulnerabilities

Google Pixel is a smartphone from Google, an American company. Google Pixel suffers from a security vulnerability that originates in onCreate in UsbAccessoryUriActivity.java, which can evade the installation wizard due to a logic error in the code, which could lead to local privilege escalation...

CVE-2023-21175

In onCreate of DataUsageSummary.java, there is a possible method for a guest user to enable or disable mobile data due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Google Pixel security vulnerabilities

Google Pixel is a smartphone from Google, Inc. in the United States. A security vulnerability exists in Google Pixel, which stems from onCreate in DataUsageSummary.java, where a user may bypass privilege restrictions and enable or disable mobile data, which may result in a local privilege...

CVE-2023-21135

In onCreate of NotificationAccessSettings.java, there is a possible failure to persist notifications settings due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2023-5066 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the September 2023 security updates Description: The issue is related to a logic error in the code of WindowState.java, specifically in the onCreate method, which can lead to local escalation of privilege with no...

Google Android suffers from unspecified vulnerability (CNVD-2023-09610)

Google Android is a Linux-based open source operating system from Google. A security vulnerability exists in Google Android versions 10, 11, and 12, which stems from an eavesdropping/overwriting attack in onCreate of MasterClearConfirmFragment.java, which may restore factory settings and cause a...

CVE-2022-20215

In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10...

Design/Logic Flaw

In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10...

CVE-2023-20913

CVE-2023-20913 affects Android 10–13; a tapjacking/overlay issue in PhoneAccountSettingsActivity could enable local elevation of privilege by tricking the user into enabling a malicious phone account. The Android Security Bulletin lists this issue under the 2023-01-01 and 2023-01-05 patch levels;...