CVE-2022-39128

CVE-2022-39128 corresponds to a vulnerability in the sensor driver that can cause a local denial of service in the kernel due to an out-of-bounds write from a missing bounds check. The connected documents consistently describe: (1) the flaw as a bounds-check omission in the sensor driver, (2) imp...

CVE-2019-2089

CVE-2019-2089 affects Android 10 Framework: during app uninstallation, a set of permissions may remain for a shared app ID, enabling local privilege escalation with no additional execution privileges required. The condition is exploitable with user interaction. The issue is documented in Android ...

CVE-2019-2131

CVE-2019-2131 affects Android devices where an application with overlay permission can display overlays on top of the Settings UI, potentially enabling local elevation of privilege. The issue is tied to the overlay permission mechanism on versions including Android 7.0–9.x (Android-7.0, 7.1.1, 7....

CVE-2019-9258

This CVE-2019-9258 entry concerns Android 10 (wifilogd) with a possible out-of-bounds write due to a missing bounds check, enabling local elevation of privilege without user interaction. The issue affects wifilogd on Android-10 and is described as an out-of-bounds write that could elevate privile...

CVE-2019-9315

CVE-2019-9315 affects the Android 10 Media Framework component libhevc, where a missing variable initialization creates a condition for information disclosure. The issue could permit remote disclosure without additional execution privileges; exploitation requires user interaction. The CVSS data i...

CVE-2019-9316

CVE-2019-9316 affects Android’s media stack via the libstagefright component, where a missing variable initialization is cited as the root cause. This flaw could enable remote information disclosure without extra privileges, with user interaction required for exploitation. Affected product is And...

CVE-2019-9343

CVE-2019-9343 affects the Bluetooth stack in Android 10. The vulnerability arises from a missing bounds check that enables an out-of-bounds read, leading to remote information disclosure without requiring privileges or user interaction. Impact is confined to information disclosure; no exploitatio...

CVE-2019-9424

CVE-2019-9424 affects Android 10: a vulnerability in the Screen Lock where the setting to hide the unlock pattern can be ignored under certain conditions, causing information disclosure. The vulnerability is listed in Android 10 security release notes and has NVD scores of 4.3 (CVSS2) and 7.5 (CV...

CVE-2020-0018

CVE-2020-0018 affects Android 8.x–10, in MotionEntry::appendDescription of InputDispatcher.cpp. The issue is an information-disclosure vulnerability: an attacker could cause local disclosure of user input with system-level privileges, and exploitation does not require user interaction (local atta...

CVE-2020-0060

CVE-2020-0060 is documented as a SQL injection-based permission bypass in Android 10. The affected components are the SmsProvider.java and MmsSmsProvider.java query paths, enabling a local information disclosure with system-level privileges and no user interaction required for exploitation. The v...

CVE-2020-0094

CVE-2020-0094 affects Android 9 and 10 Media Framework via ExifUtils.cpp, in particular setImageHeight and setImageWidth. Root cause: an incorrect bounds check enables an out-of-bounds write, leading to local elevation of privilege without extra execution privileges. Impact: once exploited, attac...

CVE-2020-0212

CVE-2020-0212 is a concrete Android security vulnerability affecting Android 10. The issue is an out-of-bounds read caused by a use-after-free in InputBufferManager.cpp (_onBufferDestroyed), potentially enabling remote information disclosure with no execution privilege, requiring user interaction...

CVE-2020-0303

CVE-2020-0303 affects the Android 11 Media extractor, where a use-after-free caused by improper locking can lead to remote code execution. The issue concerns the media-extractor component (Android-11) and is described as enabling remote code execution with no or minimal privileges; exploitation r...

CVE-2020-0327

CVE-2020-0327 affects Android 11: a missing permission check in core networking could allow local information disclosure of app network usage. Exploitation reportedly requires user execution but no user interaction, and the impact is local information disclosure with HIGH confidentiality impact p...

CVE-2020-0333

CVE-2020-0333 affects Android 11. The issue resides in the UrlQuerySanitizer component, where improper input validation could allow remote code execution. The vulnerability is exploitable with network access and does not require user interaction, with a high to critical impact depending on the me...

CVE-2020-0346

The CVE-2020-0346 entry affects Android 11 media framework/Mediaserver. The vulnerability is an out-of-bounds write caused by an integer overflow in a Mediaserver component, enabling local elevation of privilege without user interaction. Impacted version: Android 11 (Android device context). Expl...

CVE-2020-0473

CVE-2020-0473 is an Android 11-related issue in Bluetooth: in updateIncomingFileConfirmNotification of BluetoothOppNotification.java, a permissions bypass could allow a local escalation of privilege. With physical possession of the device, an attacker could transfer files over Bluetooth without a...

CVE-2020-0496

CVE-2020-0496 : The issue is a memory corruption in CPDF_RenderStatus::LoadSMask (cpdf_renderstatus.cpp) leading to a use-after-free and local information disclosure without requiring user interaction on Android 11. Public references in connected documents confirm the vulnerable component and imp...

CVE-2020-10832

The CVE-2020-10832 entry describes a vulnerability in Samsung mobile devices with P(9.0) Exynos chipsets where Kernel Wi-Fi drivers allow out-of-bounds Read/Write operations (buffer overflow). This affects the kernel Wi-Fi subsystem and is tied to several Samsung internal IDs (SVE-2019-16125, 161...

CVE-2020-10849

Technical details (affected components, root cause, impact, or fixes) are not publicly disclosed in the provided documents. Monitor for updates from official sources as additional details may be published later.

CVE-2020-25060

Technical details about CVE-2020-25060 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2020-27097

CVE-2020-27097 affects Android 11. The vulnerability exists in UriGrantsManagerService.java (checkGrantUriPermission), enabling a local information disclosure without additional exploitation privileges or user interaction. Concrete impact documented as a permissions bypass that could expose parti...

CVE-2021-0344

CVE-2021-0344 concerns memory corruption in the mtkpower component in Android (Android-10 and Android-11). The root cause is a missing bounds check, enabling local escalation of privileges with System-level execution privileges required; exploitation does not require user interaction. The vulnera...

CVE-2021-0382

CVE-2021-0382 affects Android 11 where SliceManagerService.java’s checkSlicePermission allows local information disclosure due to an incorrect permission check. Exploitation would be local (no user interaction) and could expose partial to sensitive information as defined in the CVE entry. Red Hat...

CVE-2021-0413

This CVE refers to the MediaTek flv extractor with an out-of-bounds read caused by a missing bounds check. The result is local information disclosure without requiring user interaction. No exploitation details are provided beyond this disclosure risk. A patch/ID is listed as ALPS05561379 (Issue I...

CVE-2021-0449

CVE-2021-0449 : In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data, leading to local information disclosure with System execution privileges required. The vulnerability affects the Titan M component as listed in Android kernel contexts; exploita...

CVE-2021-0450

CVE-2021-0450 affects the Titan M component in Google's Pixel devices. The Titan M firmware disclosure arises from uninitialized data leading to possible stack memory disclosure, enabling local information disclosure with system privileges without user interaction. Reported across multiple source...

CVE-2021-0454

CVE-2021-0454 affects the Citadel chip firmware via an out-of-bounds write caused by a missing bounds check, enabling local privilege escalation with System execution privileges required and no user interaction. In Google Pixel/Android contexts, this vulnerability is mapped to Titan M components ...

CVE-2021-0493

CVE-2021-0493 is an Android memory management driver vulnerability described as an out-of-bounds write caused by a missing bounds check. The affected component is the memory management driver in Android, with potential local escalation of privilege and no additional execution privileges needed. T...

CVE-2021-0496

CVE-2021-0496 is an Android memory management driver vulnerability caused by a use-after-free leading to local privilege escalation. Affected: Android devices with the memory management driver. Impact: local code execution with high integrity/availability impact; attacker requires local access, n...

CVE-2021-0630

CVE-2021-0630 affects MediaTek WiFi driver components. The flaw is a missing bounds check in the wifi driver that can cause a system crash, enabling remote denial of service with no additional privileges or user interaction required. Several connected sources (NVD, Red Hat advisories, CVE registr...

CVE-2021-0657

CVE-2021-0657 affects apusys and is caused by a stack-based buffer overflow leading to an out-of-bounds write. This can enable local escalation to System privileges without user interaction. The vulnerability context is supported by multiple sources (e.g., Red Hat, NVD) and lists a patch referenc...

CVE-2021-0679

CVE-2021-0679 affects MediaTek’s apusys. The issue is a memory corruption caused by a missing bounds check in apusys that could lead to local privilege escalation with System execution privileges required; exploitation is possible without user interaction. A patch is referenced (ALPS05672107; ALP...

CVE-2021-0900

The CVE-2021-0900 entry concerns the MediaTek apusys component, with an out-of-bounds read due to an incorrect bounds check. This could enable local information disclosure and requires System privileges for exploitation, with no user interaction needed. Documents consistently describe the affecte...

CVE-2021-0903

CVE-2021-0903 concerns the MediaTek Apusys component, where a missing bounds check can trigger an out-of-bounds write. The condition enables local escalation of privilege with SYSTEM execution rights and does not require user interaction. Affected material mentions Apusys; Red Hat and other sourc...

CVE-2021-22494

Summary: CVE-2021-22494 affects Samsung Note20 devices running Q (10.0) software. The fingerprint scanner may misbehave when a screen protector is used because the required image compensation is not present during enrollment. This can lead to inversion and a high False Recognition Rate (FRR). The...

CVE-2021-25330

The CVE-2021-25330 entry concerns Samsung MobileWips (MobileWips app) on Samsung devices. Public descriptions indicate a flaw where calling a non-existent provider enables unauthorized actions, including a denial-of-service attack by hijacking the provider, and that this affects the version prior...

CVE-2021-25393

CVE-2021-25393 affects Samsung's SecSettings prior to SMR May-2021 Release 1. The issue is improper sanitization of an incoming intent that lets a local attacker gain permissions to access system UID data. Affected component is the Settings app on Samsung Android devices; root cause relates to in...

CVE-2022-20215

CVE-2022-20215 describes a tapjacking/overlay attack in the MasterClearConfirmFragment.java on Android 10–12 that could trigger a local factory reset, causing a denial of service without extra privileges. Exploitation requires user interaction and can occur locally; no exploit details or likeliho...

CVE-2022-20270

CVE-2022-20270 affects Android 13, where a permissions bypass in the Content component could disclose the Gmail account name on a device with no extra privileges or user interaction. Documented impact is local information disclosure (confidentiality) with no exploitation details provided in the c...

CVE-2022-26454

CVE-2022-26454 affects the teei component where a memory corruption caused by an integer overflow could enable local privilege escalation to System level without user interaction. Public documents consistently describe the issue as a local escalation vulnerability in teei, with the attack surface...

CVE-2022-26459

The CVE-2022-26459 issue affects MediaTek vow. An integer overflow can cause an out-of-bounds read, leading to local information disclosure with System execution privileges required. No user interaction is needed. A patch is referenced as ALPS07032634 (Issue ALPS07032634). Exploitation details ar...

CVE-2022-26462

CVE-2022-26462 describes an out-of-bounds read in the MediaTek vow component caused by an incorrect bounds check. The vulnerability could lead to local information disclosure with system-level execution privileges required, and exploitation reportedly does not require user interaction. Public ref...

CVE-2022-30755

CVE-2022-30755 affects Samsung AppLock prior to the SMR July 2022 Release 1. The issue is improper authentication resulting from insufficient authentication logic, enabling an attacker to bypass password confirmation by hijacking an implicit intent. The vulnerability is documented across multiple...

CVE-2022-32616

CVE-2022-32616 affects the isp component in MediaTek-based devices, causing an out-of-bounds write due to uninitialized data. This can enable local escalation of privilege with System execution privileges required, and no user interaction is needed. The entry lists patch ALPS07341258 / Issue ALPS...

CVE-2022-32648

The CVE-2022-32648 entry describes a use-after-free due to a race condition in the disp component, enabling local privilege escalation with SYSTEM privileges and no user interaction. Multiple sources (NVD/Red Hat/PRION/CVE records) confirm the issue and the same patch identifier: ALPS06535964 (Is...

CVE-2022-38675

CVE-2022-38675 concerns a defect in the GPU driver where a missing bounds check enables a local out-of-bounds write, potentially causing a local denial of service in the kernel. The description across multiple sources agrees on the kernel impact and local attack vector, with CVSS v3.1 metrics ind...

CVE-2022-39084

CVE-2022-39084 relates to UNISOC chipset network service with a missing permission check, enabling local privilege escalation requiring system execution privileges. CVSS details show Local access, high impact on confidentiality, integrity, and availability (score 6.7). Concrete affected-entity: U...

CVE-2022-39849

CVE-2022-39849 describes an improper access control in the knox_vpn_policy service prior to Samsung SMR Oct-2022 Release 1, allowing unauthorized read of configuration data. Affected component: knox_vpn_policy in Samsung Knox/VPN policy context. Root cause: insufficient access restrictions enabli...

CVE-2022-39852

CVE-2022-39852 is a heap-based overflow in the makeContactAGIF function of libagifencoder.quram.so, vulnerable in Samsung devices prior to SMR Oct-2022 Release 1. This can allow local attacker-controlled code execution with high impact on confidentiality, integrity, and availability. Remediation ...