Information disclosure

In requestAppKeyboardShortcuts of WindowManagerService.java, there is a possible way to infer the app a user is interacting with due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2023-21177

In requestAppKeyboardShortcuts of WindowManagerService.java, there is a possible way to infer the app a user is interacting with due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2023-21177

CVE-2023-21177 affects Android 13 via WindowManagerService.requestAppKeyboardShortcuts. A missing permission check could allow an attacker to infer the app a user is interacting with, enabling local information disclosure without additional execution privileges and without user interaction. Repor...

CVE-2023-21026

In updateInputChannel of WindowManagerService.java, there is a possible way to set a touchable region beyond its own SurfaceControl due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for...

Code injection

In updateInputChannel of WindowManagerService.java, there is a possible way to set a touchable region beyond its own SurfaceControl due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for...

CVE-2023-21026

CVE-2023-21026 affects Android 13 on the WindowManagerService component, specifically the updateInputChannel path in WindowManagerService.java. A logic error could allow an attacker to extend a touchable region beyond the owner SurfaceControl, enabling a local denial-of-service condition without ...

CVE-2023-21440

Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture...

Improper access control

Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture...

CVE-2023-21440

Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture...

CVE-2023-21440

The CVE-2023-21440 entry maps to an improper access control vulnerability in the WindowManagerService, affecting Samsung Android devices. Root cause: WindowManagerService prior to SMR Feb-2023 Release 1 allows an attacker to capture the screen. Impact: potential exposure of screen content (confid...

CVE-2023-21440

Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture...

CVE-2023-21440: Improper Authorization

Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture...

PT-2023-18207 · Unknown · Windowmanagerservices

Name of the Vulnerable Software and Affected Versions: WindowManagerService versions prior to SMR Feb-2023 Release 1 Description: The issue is related to improper access control in the WindowManagerService, allowing attackers to capture the screen. Recommendations: For versions prior to SMR...

CVE-2022-39899

Improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1 allows attacker to send the input event using S Pen gesture...

CVE-2022-39899

Improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1 allows attacker to send the input event using S Pen gesture...

Authentication flaw

Improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1 allows attacker to send the input event using S Pen gesture...

CVE-2022-39899

Improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1 allows attacker to send the input event using S Pen gesture...

CVE-2022-39899

CVE-2022-39899 is an improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1. The issue can allow a local attacker to send input events via S Pen gestures due to insufficient authentication around the WindowManagerService. Affected software is Samsung...

CVE-2022-39899

Improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1 allows attacker to send the input event using S Pen gesture...

PT-2022-25092 · Samsung · Windowmanagerservices

Name of the Vulnerable Software and Affected Versions: Samsung WindowManagerService versions prior to SMR Dec-2022 Release 1 Description: The issue is related to improper authentication in the Samsung WindowManagerService, allowing an attacker to send input events using S Pen gestures...