CVE-2024-49738

CVE-2024-49738 is documented across multiple sources as a vulnerability in Google Android involving the function writeInplace in Parcel.cpp. The issue is described as a possible out-of-bounds write in this function, which could enable local escalation of privilege with no additional execution pri...

Google Android 代码问题漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that stems from insecure deserialization, which can be exploited by an attacker to bypass the parcel mismatch mitigation and elevate privileges...

PT-2025-2857 · Unknown · Accountmanagerservice

Name of the Vulnerable Software and Affected Versions: AccountManagerService affected versions not specified Description: The issue is related to a possible way to bypass parcel mismatch mitigation due to unsafe deserialization in the checkKeyIntentParceledCorrectly function of...

PT-2025-2853 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fix Description: The issue is related to a possible out of bounds write in the writeInplace function of Parcel.cpp. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2018-9434

In multiple functions of Parcel.cpp, there is a possible way to bypass address space layout randomization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-360846772

In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to bypass parcel mismatch mitigation due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitatio...

Download a banker to track your parcel

In late October 2024, a new scheme for distributing a certain Android banking Trojan called "Mamont" was uncovered. The victim would receive an instant message from an unknown sender asking to identify a person in a photo. The attackers would then send what appeared to be the photo itself but was...

Malicious code in parcel-plugin-lighterhtm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 415194ea6ab6f715cf5f3ce8ee4f2b08597339fa35641457a333aed6ff9109a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2018-9474

In writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2018-9421

In writeInplace of Parcel.cpp, there is a possible information leak across processes, using Binder, due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2018-9339

In writeTypedArrayList and readTypedArrayList of Parcel.java, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-10587 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a permission bypass due to a write size mismatch in the writeToParcel and createFromParcel methods of DcParamObject.java. This could lead to an elevation of...

CVE-2017-13312

In createFromParcel of MediaCas.java, there is a possible parcel read/write mismatch due to improper input validation. This could lead to local escalation of privilege where an app can start an activity with system privileges with no additional execution privileges needed. User interaction is not...

PT-2024-10582 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a read/write serialization problem in the createFromParcel method of ViewPager.java. This could allow for a permissions bypass, enabling local escalation of privileg...

PT-2024-10584 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a possible parcel read/write mismatch in the createFromParcel method of MediaCas.java due to improper input validation. This could lead to local escalation of...

The vulnerability of the Parcel Tracking component in Microsoft Edge and Google Chrome browsers allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Parcel Tracking component in Microsoft Edge and Google Chrome relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a speciall...

WordPress UPS Live Rates and Access Points plugin <= 2.3.11 - Missing Authorization to Plugin API key reset vulnerability

Missing Authorization to Plugin API key reset vulnerability discovered by Peter Thaleikis in WordPress Plugin WooCommerce UPS Shipping – Live Rates and Access Points versions = 2.3.11...

Fedora: Security Advisory (FEDORA-2024-4d80983af6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (openSUSE-SU-2024:0337-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-9383

The Parcel Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...