CVE-2018-9345

CVE-2018-9345 affects Android’s BnAudioPolicyService (AudioPolicyService.cpp). The issue is information disclosure due to uninitialized data, enabling local information disclosure with no extra privileges and no user interaction required. Multiple connected sources confirm the same description. P...

CVE-2018-9344

The CVE-2018-9344 entry describes a use-after-free in DescramblerImpl.cpp caused by improper locking, enabling local privilege escalation with no extra privileges and no user interaction. Connected sources associate this issue with Android’s Media framework and list affected context in the Androi...

CVE-2018-9341

CVE-2018-9341 affects the Android Media framework: in impeg2d_mc_fullx_fully of impeg2d_mc.c there is an out-of-bounds write due to a missing bounds check. This can lead to remote arbitrary code execution in the context of a privileged process, with user interaction required to exploit. Multiple ...

CVE-2018-9340

CVE-2018-9340 affects Android Framework: in ResStringPool::setTo of ResourceTypes.cpp an attacker can cause mStringPoolSize to be out of bounds, leading to information disclosure. Root cause is out-of-bounds handling in ResStringPool. The CVE is listed in Android’s June 2018 security bulletin, wi...

CVE-2018-9339

CVE-2018-9339 affects Android’s framework Parcel.java, specifically in the methods writeTypedArrayList/readTypedArrayList, with a root cause of type confusion that enables local privilege escalation. The vulnerability can be exploited with no user interaction and requires local access. Public doc...

CVE-2018-9338

CVE-2018-9338 is an Android Framework vulnerability described in multiple sources as an out-of-bounds write in ResStringPool::setTo (ResourceTypes.cpp) caused by a missing bounds check. The issue can lead to local escalation of privilege with no user interaction required. Affected component is wi...

CVE-2023-21270

CVE-2023-21270 affects Android’s PermissionManagerServiceImpl.java, specifically in restorePermissionState, where a flaw can allow an app to retain permissions that should be revoked due to incorrect permission flag clearance during an update. This can lead to local elevation of privilege with Us...

CVE-2017-13315

CVE-2017-13315 involves an Elevation of Privilege in Android’s DcParamObject.java (writeToParcel/createFromParcel) that bypasses permissions to start an activity with system privileges without extra execution privileges. Affected component: Android System (DcParamObject parceling code). Impact to...

CVE-2020-26066

Cisco SD-WAN vManage Software Web UI contains an XML External Entity (XXE) processing vulnerability in certain XML files parsed by the application. An authenticated remote attacker could exploit this flaw to gain read and write access to information stored on the system. Affected component is the...

CVE-2020-26067

CVE-2020-26067 concerns Cisco Webex Teams web interface. Affected component: web-based interface; issue arises from improper validation of usernames. An authenticated, remote attacker can create an account containing malicious HTML/script and join a space with that name, enabling cross-site scrip...

CVE-2020-26062

Cisco Integrated Management Controller (CIMC) suffers a username-enumeration vulnerability due to differences in authentication responses. An unauthenticated, remote attacker can determine valid usernames by sending authentication requests to CIMC over the network. Multiple connected sources (CVE...

CVE-2020-26063

CVE-2020-26063 — Cisco Integrated Management Controller (IMC) API endpoints have improper authorization checks, enabling an authenticated remote attacker to bypass authorization and actions on the vulnerable system. Exploitation involves sending crafted API requests that could download files or m...

CVE-2020-26071

CVE-2020-26071 affects Cisco SD-WAN Software CLI. The issue is caused by insufficient input validation for specific commands, allowing an authenticated, local attacker to create or overwrite arbitrary files on an affected device, potentially leading to a DoS. Cisco has released software updates a...

CVE-2020-27124

Cisco ASA SSL/TLS DoS (CVE-2020-27124): Vulnerability in the SSL/TLS handler due to improper error handling on established SSL/TLS connections can cause an unauthenticated remote attacker to reload the device, leading to DoS. Affected products: Cisco ASA Software. Impact: device reload and servic...

CVE-2020-3431

Cisco Small Business RV042 and RV042G Dual WAN Router series are affected by an unauthenticated XSS vulnerability in the web-based management interface due to insufficient input validation. An attacker can lure a user to click a crafted link, potentially executing arbitrary script code in the use...

CVE-2020-26073

Cisco SD-WAN vManage Software is affected by a directory traversal/local file inclusion issue in the application data endpoints (APIs). It enables an unauthenticated attacker to read sensitive files and tokens via crafted API requests. The core issue is improper validation of directory traversal ...

CVE-2020-3532

CVE-2020-3532 affects Cisco Unified Communications Manager and related components (CUCM, CUCM Session Management Edition, IM&P, Unity Connection). The web-based management interface fails to properly validate input, enabling unauthenticated, remote attackers to persuade users to click crafted lin...

CVE-2020-3548

CVE-2020-3548 affects Cisco AsyncOS software for Cisco Email Security Appliance (ESA). The issue is in the TLS protocol implementation, caused by inefficient processing of incoming TLS traffic. An unauthenticated, remote attacker can send crafted TLS packets to trigger a prolonged state of high C...

CVE-2021-1132

CVE-2021-1132 affects Cisco Network Services Orchestrator (NSO) API and web-management interface. The issue arises from improper validation of user-supplied input, allowing an unauthenticated, remote attacker to send crafted HTTP requests containing directory traversal sequences to access sensiti...

CVE-2021-1410

CVE-2021-1410 affects Cisco Webex Meetings. The vulnerability stems from insufficient authorization enforcement for requests to update distribution lists, allowing an authenticated, remote attacker to modify a distribution list belonging to another user within the same organization. The issue is ...