CVE-2024-31320

CVE-2024-31320 relates to Android’s setSkipPrompt in AssociationRequest.java, where an attacker could establish a companion device association without user confirmation, enabling local elevation of privilege with no user interaction. The Red Hat and CNVD entries align on an Android elevation-of-p...

CVE-2024-31335

The CVE-2024-31335 entry concerns a logic error in DevmemIntChangeSparse2 within devicemem_server.c that can enable arbitrary code execution with local privilege elevation in the kernel. Connected sources indicate affected components include Android’s kernel-related stack and PowerVR-GPU subcompo...

CVE-2024-31331

CVE-2024-31331 affects the Android Framework, specifically a logic error in PackageManagerService.java setMimeGroup that can hide the service from Settings. This can enable local elevation of privilege with high impact (confidentiality/integrity/availability). Exploitation requires local access a...

CVE-2024-31334

CVE-2024-31334 affects the DevmemIntFreeDefBackingPage function in the Android/Linux kernel code path devicemem_server.c. The described logic error could allow arbitrary code execution leading to local elevation of privilege without requiring user interaction. Exploitation is local (no remote vec...

CVE-2024-31324

CVE-2024-31324 affects Android Framework due to a tapjacking/overlay bypass in WindowState.java. The issue can be triggered by starting an activity in portrait, then rotating to landscape, enabling local elevation of privilege with user interaction required. The entry notes exploitation is possib...

CVE-2024-31323

CVE-2024-31323 is an Android local elevation-of-privilege vulnerability in the onCreate path of the HealthFitness module (HealthFitness) that could trick a user into granting health permissions via tapjacking, requiring no user interaction for exploitation. The issue is mapped to the Healthfitnes...

CVE-2024-31318

CVE-2024-31318 affects Android’s CompanionDeviceManagerService.java. The flaw is a missing permission check that could allow pairing a companion device without user acceptance, enabling local elevation of privilege with no extra execution privileges required. User interaction is not needed for ex...

CVE-2024-31319

CVE-2024-31319 affects Android Framework (NotificationManagerService.java). A cross-user data leak caused by a confused deputy could lead to local escalation of privilege with no extra execution privileges required. Exploitation is described as local and independent of user interaction. Public de...

CVE-2024-31325

CVE-2024-31325 is listed in the Android Framework as an Elevation of Privilege (EoP) vulnerability with a local attack vector. The issue arises from a logic error that can reveal images across different users’ data, enabling local privilege escalation without additional execution privileges. Affe...

CVE-2024-31313

CVE-2024-31313 is an Android/MessageQueueBase.h issue involving an incorrect bounds check in the function availableToWriteBytes, which can cause an out-of-bounds write. The vulnerability enables local escalation of privilege with no additional execution privileges required and does not require us...

CVE-2024-23697

CVE-2024-23697: A use-after-free in RGXCreateHWRTData_aux (rgxta3d.c) enables possible arbitrary code execution and local kernel privilege escalation. No user interaction required. Documents consistently describe this as a local-privilege escalation vulnerability with kernel impact and do not pro...

CVE-2024-31315

In Android, CVE-2024-31315 affects the ManagedServices.java implementation, where improper input validation in multiple functions could enable hiding an app with notification access via the Device & app notifications settings. The vulnerability is described as enabling local elevation of privileg...

CVE-2024-31316

CVE-2024-31316 affects the Android Framework, specifically the onResult path in AccountManagerService.java. The issue is a parcel mismatch that could allow an arbitrary background activity launch, resulting in local elevation of privilege without requiring additional execution privileges. No user...

CVE-2024-23698

CVE-2024-23698 affects the Android/Linux kernel code path RGXFWChangeOSidPriority in rgxfwutils.c, where a missing bounds check could enable arbitrary code execution and local escalation of privilege with no user interaction. The issue is described consistently across multiple sources (Android An...

CVE-2024-31310

CVE-2024-31310 affects Android: in AutofillManagerServiceImpl.newServiceInfoLocked, improper input validation can allow hiding an enabled Autofill service in the Autofill service settings. Impact is local privilege escalation with high confidentiality/integrity/availability implications, requirin...

CVE-2024-31317

CVE-2024-31317 is a Zygote command-injection vulnerability affecting Android 9–13, enabling a non-privileged app with WRITE_SECURE_SETTINGS to trigger code execution in the Zygote process via unsafe deserialization and manipulated Zygote arguments (e.g., runtime-flags, hidden_api_blacklist_exempt...

CVE-2023-21114

CVE-2023-21114 affects Android devices with a local elevation of privilege due to a confused deputy in components referenced in the Android WiFi stack and related platform code. Exploitation requires local access and does not need user interaction. Multiple vendors’ advisories (e.g., Android secu...

CVE-2023-3288

CVE-2023-3288 affects Easy!Appointments, where a BOLA flaw on POST /providers allows a low-privileged user to create a privileged provider, enabling privilege escalation. Multiple connected sources (including CVELIST entry Easy!Appointments

CVE-2023-3289

CVE-2023-3289 affects Easy!Appointments (versions prior to 1.5.0). A BOLA in POST /services allows a low-privileged user to create a service for any user (including admin), leading to unauthorized data manipulation. The connected documents provide explicit description of the affected endpoint and...

CVE-2023-3286

CVE-2023-3286 affects Easy!Appointments prior to version 1.5.0. The vulnerability is described as a BOLA issue on POST /secretaries that allows a low-privileged user to create another low-privileged secretary account, enabling unauthorized data manipulation. The connected sources consistently fra...