1380 matches found
CVE-2024-31327
CVE-2024-31327 affects Android/libfmq: multiple functions in MessageQueueBase.h may cause an out-of-bounds write due to a race, enabling local escalation of privilege with no user interaction. Exploitation specifics are not provided in the supplied documents. Android security references acknowled...
CVE-2024-31318
CVE-2024-31318 affects Android’s CompanionDeviceManagerService.java. The flaw is a missing permission check that could allow pairing a companion device without user acceptance, enabling local elevation of privilege with no extra execution privileges required. User interaction is not needed for ex...
CVE-2024-31324
CVE-2024-31324 affects Android Framework due to a tapjacking/overlay bypass in WindowState.java. The issue can be triggered by starting an activity in portrait, then rotating to landscape, enabling local elevation of privilege with user interaction required. The entry notes exploitation is possib...
CVE-2024-31319
CVE-2024-31319 affects Android Framework (NotificationManagerService.java). A cross-user data leak caused by a confused deputy could lead to local escalation of privilege with no extra execution privileges required. Exploitation is described as local and independent of user interaction. Public de...
CVE-2024-31325
CVE-2024-31325 is listed in the Android Framework as an Elevation of Privilege (EoP) vulnerability with a local attack vector. The issue arises from a logic error that can reveal images across different users’ data, enabling local privilege escalation without additional execution privileges. Affe...
CVE-2024-31322
Summary of CVE-2024-31322 : In Android’s AccessibilityManagerService.updateServicesLocked, improper input validation can let an app be hidden from Settings while still retaining the Accessibility Service, enabling local elevation of privilege with no extra execution privileges required. Exploitat...
CVE-2024-23697
CVE-2024-23697: A use-after-free in RGXCreateHWRTData_aux (rgxta3d.c) enables possible arbitrary code execution and local kernel privilege escalation. No user interaction required. Documents consistently describe this as a local-privilege escalation vulnerability with kernel impact and do not pro...
CVE-2024-31316
CVE-2024-31316 affects the Android Framework, specifically the onResult path in AccountManagerService.java. The issue is a parcel mismatch that could allow an arbitrary background activity launch, resulting in local elevation of privilege without requiring additional execution privileges. No user...
CVE-2024-31311
CVE-2024-31311 affects Google Android; the flaw is an out-of-bounds write in the function increment_annotation_count within stats_event.c, caused by a missing bounds check. This can enable local elevation of privilege with no additional execution privileges and without user interaction. Affected ...
CVE-2024-31317
CVE-2024-31317 is a Zygote command-injection vulnerability affecting Android 9–13, enabling a non-privileged app with WRITE_SECURE_SETTINGS to trigger code execution in the Zygote process via unsafe deserialization and manipulated Zygote arguments (e.g., runtime-flags, hidden_api_blacklist_exempt...
CVE-2024-31310
CVE-2024-31310 affects Android: in AutofillManagerServiceImpl.newServiceInfoLocked, improper input validation can allow hiding an enabled Autofill service in the Autofill service settings. Impact is local privilege escalation with high confidentiality/integrity/availability implications, requirin...
CVE-2024-31314
CVE-2024-31314 is a DoS via resource exhaustion in multiple functions of ShortcutService.java. The issue is described across Android/Red Hat/NVD/CVE lists as a local DoS without required user interaction. Affected component is ShortcutService.java, with a persistent denial of service risk due to ...
CVE-2024-23695
CVE-2024-23695 involves the Android/Linux kernel’s CacheOpPMRExec in cache_km.c, with a reported out-of-bounds write caused by an integer overflow. This can lead to local elevation of privilege with no extra execution privileges or user interaction required. The available connected documents do n...
CVE-2024-23696
The CVE-2024-23696 issue is tied to the RGXCreateZSBufferKM function in rgxta3d.c, where a use-after-free leads to possible arbitrary code execution and local elevation of privilege in the kernel. Exploitation reportedly requires local access with no extra privileges and no user interaction. Conn...
CVE-2023-21114
CVE-2023-21114 affects Android devices with a local elevation of privilege due to a confused deputy in components referenced in the Android WiFi stack and related platform code. Exploitation requires local access and does not need user interaction. Multiple vendors’ advisories (e.g., Android secu...
CVE-2024-2177
CVE-2024-2177 affects GitLab CE/EE: vulnerable versions are 16.3 up to but not including 16.11.5, 17.0 up to but not including 17.0.3, and 17.1 up to but not including 17.1.1. The issue is a Cross Window Forgery in the OAuth authentication flow, exploitable via a crafted payload. The connected do...
CVE-2023-3288
CVE-2023-3288 affects Easy!Appointments, where a BOLA flaw on POST /providers allows a low-privileged user to create a privileged provider, enabling privilege escalation. Multiple connected sources (including CVELIST entry Easy!Appointments
CVE-2023-3289
CVE-2023-3289 affects Easy!Appointments (versions prior to 1.5.0). A BOLA in POST /services allows a low-privileged user to create a service for any user (including admin), leading to unauthorized data manipulation. The connected documents provide explicit description of the affected endpoint and...
CVE-2023-3286
CVE-2023-3286 affects Easy!Appointments prior to version 1.5.0. The vulnerability is described as a BOLA issue on POST /secretaries that allows a low-privileged user to create another low-privileged secretary account, enabling unauthorized data manipulation. The connected sources consistently fra...