CVE-2021-0386

CVE-2021-0386 affects Android 11 in the UsbConfirmActivity onCreate, enabling a tapjacking vector due to an insecure default value. The vulnerability could allow local escalation of privilege with user interaction required for exploitation (ATT&CK: Local, UI: Required). The issue is documented ac...

CVE-2021-0450

CVE-2021-0450 affects the Titan M component in Google's Pixel devices. The Titan M firmware disclosure arises from uninitialized data leading to possible stack memory disclosure, enabling local information disclosure with system privileges without user interaction. Reported across multiple source...

CVE-2021-0457

CVE-2021-0457 targets the FingerTipS touch screen driver in the Android kernel and describes an out-of-bounds write caused by a heap buffer overflow, enabling local privilege escalation to SYSTEM with no user interaction required. Public sources (NVD entry, ZDI advisory) corroborate a heap-based ...

CVE-2021-0658

CVE-2021-0658 affects the apusys component with an out-of-bounds write caused by a missing bounds check, enabling local escalation of privilege with System execution privileges required and no user interaction. Public documentation consistently notes this is a local vulnerability with high-impact...

CVE-2021-0671

CVE-2021-0671 affects the apusys component, where a missing bounds check can cause memory corruption leading to local escalation of privilege with System execution privileges. Exploitation details are not provided in the documents; user interaction is not required. A patch is identified as ALPS05...

CVE-2021-0676

CVE-2021-0676 pertains to the geniezone driver, where an incorrect bounds check enables a possible out-of-bounds read . This could lead to local information disclosure with the attacker obtaining System execution privileges; exploitation requires no user interaction. Multiple sources (NVD, Red Ha...

CVE-2021-0677

The CVE-2021-0677 issue affects the ccu driver, where an integer overflow can trigger an out-of-bounds read, leading to local information disclosure with SYSTEM privileges required. Exploitation reportedly does not need user interaction. The Red Hat and NVD entries corroborate this description; p...

CVE-2021-0898

In APUsys (MediaTek Apusys), CVE-2021-0898 describes a memory corruption via a use-after-free in the apusys component that can enable local escalation of privilege with System execution privileges required and no user interaction. Affected: apusys; root cause: use-after-free leading to memory cor...

CVE-2021-22492

CVE-2021-22492 concerns a buffer overflow in the Bluetooth UART driver on Samsung mobile devices using Broadcom Bluetooth chipsets (O(8.x), P(9.0), Q(10.0)). The issue stems from the UART driver handling data unsafely, leading to potential memory corruption. CVSS data from NVD indicates a base sc...

CVE-2021-25330

The CVE-2021-25330 entry concerns Samsung MobileWips (MobileWips app) on Samsung devices. Public descriptions indicate a flaw where calling a non-existent provider enables unauthorized actions, including a denial-of-service attack by hijacking the provider, and that this affects the version prior...

CVE-2021-25443

CVE-2021-25443 is a use-after-free vulnerability in the Samsung conn_gadget driver prior to SMR AUG-2021 Release 1. Affected component: conn_gadget driver in Samsung mobile software. Root cause per records: use-after-free leading to potential malicious action by an attacker. Impact is described a...

CVE-2021-25488

The CVE-2021-25488 issue affects Samsung devices via the modem interface driver’s recv_data() function. The root cause is a missing boundary check in the buffer handling, before the SMR Oct-2021 Release 1 patch, which permits an out-of-bounds (OOB) read. The vulnerability is documented across mul...

CVE-2022-20324

CVE-2022-20324 : In Android 13, the Framework exposes a side-channel leak that can reveal whether an app is installed without query permissions, enabling local information disclosure without extra execution privileges. The vulnerability affects the Framework component and results in confidential ...

CVE-2022-20458

CVE-2022-20458 affects Android (Android-12L). The vulnerability is an information disclosure in logs: StatusBarNotification.getKey() may print sensitive data (PII or hardware identifiers) via CarNotificationListener.java in Android "user" builds, exposing user account names. Affected component ap...

CVE-2022-26454

CVE-2022-26454 affects the teei component where a memory corruption caused by an integer overflow could enable local privilege escalation to System level without user interaction. Public documents consistently describe the issue as a local escalation vulnerability in teei, with the attack surface...

CVE-2022-26459

The CVE-2022-26459 issue affects MediaTek vow. An integer overflow can cause an out-of-bounds read, leading to local information disclosure with System execution privileges required. No user interaction is needed. A patch is referenced as ALPS07032634 (Issue ALPS07032634). Exploitation details ar...

CVE-2022-26462

CVE-2022-26462 describes an out-of-bounds read in the MediaTek vow component caused by an incorrect bounds check. The vulnerability could lead to local information disclosure with system-level execution privileges required, and exploitation reportedly does not require user interaction. Public ref...

CVE-2022-30755

CVE-2022-30755 affects Samsung AppLock prior to the SMR July 2022 Release 1. The issue is improper authentication resulting from insufficient authentication logic, enabling an attacker to bypass password confirmation by hijacking an implicit intent. The vulnerability is documented across multiple...

CVE-2022-32646

CVE-2022-32646 describes a stack overflow in GPU DRM due to a missing bounds check, enabling local privilege escalation with SYSTEM execution privileges required and no user interaction. Multiple sources (NVD, Red Hat, CVE list, PRION, CNNVD-style entries) consistently reference the same issue an...

CVE-2022-39082

CVE-2022-39082 describes a missing permission check in a network service leading to local privilege escalation requiring System execution privileges. Connected sources reference a UNISOC chipset context and confirm the local-access risk, with CVSSv3.1 metrics indicating Local access, privileges r...

CVE-2022-39094

CVE-2022-39094 affects the power management service, where a missing permission check enables setting up the service with no additional privileges. The vulnerability is triggered locally (attack vector: LOCAL) with low privilege requirements and no user interaction, and has high impact on confide...

CVE-2022-39103

The CVE-2022-39103 entry concerns the Gallery service, where a missing permission check is the root cause. This vulnerability could permit local denial of service without requiring additional execution privileges. Publicly provided documents reiterate the issue but do not specify affected version...

CVE-2022-39109

Technical details about CVE-2022-39109 are not publicly provided in the connected documents. Monitor for updates from vendors and advisories to obtain affected products, versions, and fixes.

CVE-2022-39850

CVE-2022-39850: The issue is an improper access control in Samsung’s mum_container_policy service, present prior to SMR Oct-2022 Release 1, allowing an unauthorized read of configuration data. Affected product area is Samsung mobile devices; root cause is inadequate access checks in the mum_conta...

CVE-2022-39852

CVE-2022-39852 is a heap-based overflow in the makeContactAGIF function of libagifencoder.quram.so, vulnerable in Samsung devices prior to SMR Oct-2022 Release 1. This can allow local attacker-controlled code execution with high impact on confidentiality, integrity, and availability. Remediation ...

CVE-2022-44440

CVE-2022-44440 involves a missing bounds check in the WLAN driver, causing a local denial of service. The provided documents confirm the issue and impact but do not supply affected products/versions or a remediation/fix. No exploitation details are included in the sources.

CVE-2022-47326

Evidence from multiple connected sources confirms CVE-2022-47326 affects the WLAN driver via a missing permission check that could lead to local information disclosure. Documents consistently describe the issue as a local information disclosure vulnerability tied to the WLAN driver component, wit...

CVE-2022-48243

CVE-2022-48243 concerns the UNISOC audio service, where a missing permission check in the audio service could enable local escalation of privilege with no additional execution privileges. The CVE is consistently described across sources as a local-privilege-escalation issue without public details...

CVE-2022-48440

CVE-2022-48440 affects the dialer service. The root cause cited across connected documents is a missing permission check, enabling local denial of service with no additional execution privileges. The exposure is local (AV:L, PR:L) with a high impact on availability, and no exploitation details or...

CVE-2022-48445

CVE-2022-48445 concerns a vulnerability in the telephony service where a missing permission check could allow a local denial of service without requiring additional privileges. This is described consistently across multiple sources (NVD, Red Hat, CVE lists) as a local issue with no exploitation d...

CVE-2022-48450

CVE-2022-48450 : Affects Unisoc Bluetooth service. The issue is a missing parameter check in the Bluetooth service, which could allow a local denial of service and require system execution privileges to exploit. The NVD notes a Medium severity (CVSS 3.1: 4.4) with local attack vector and high pri...

CVE-2022-48453

CVE-2022-48453 affects a camera driver (Unisoc-based devices) with a missing bounds check that can trigger an out-of-bounds write. Impact is local denial of service with system privileges required; CVSSv3.1 vector indicates local access, high privileges, and availability impact, with a medium bas...

CVE-2023-20634

The connected sources describe CVE-2023-20634 as an input-validation based out-of-bounds write in Widevine, affecting MediaTek Widevine components. The root cause is improper input validation leading to local privilege escalation with system execution privileges, exploitable without user interact...

CVE-2023-20644

CVE-2023-20644 affects the ril module of MediaTek-based devices, where a missing bounds check causes an out-of-bounds read. This can lead to local information disclosure with potential system-privilege execution, with no user interaction required. Exploitation details are not provided in the docu...

CVE-2023-20645

CVE-2023-20645 affects the ril component in MediaTek-based devices. The vulnerability is an out-of-bounds read caused by a missing bounds check, potentially enabling local information disclosure with system execution privileges. Exploitation does not require user interaction. A patch is identifie...

CVE-2023-20711

CVE-2023-20711 affects the keyinstall component and describes a possible out-of-bounds read due to a missing bounds check, enabling local information disclosure with system privileges needed. Exploitation details are not specified in the provided documents; user interaction is not required. The p...

CVE-2023-20722

CVE-2023-20722 affects the m4u component with an out-of-bounds write caused by improper input validation. This can lead to local privilege escalation requiring System execution privileges, with no user interaction needed. A patch is available (Patch ID: ALPS07771518; Issue ID: ALPS07680084). Conn...

CVE-2023-20756

CVE-2023-20756 concerns a vulnerability in keyinstall (reported across multiple feeds) that enables an out-of-bounds write caused by an integer overflow. This can lead to local escalation of privilege with SYSTEM privileges, requiring no user interaction. A patch is available (Patch ID ALPS075100...

CVE-2023-20775

CVE-2023-20775 describes a local out-of-bounds write in the display code due to a missing bounds check, enabling local privilege escalation with System rights; no user interaction required. Impacted hardware is reported as various MediaTek chips (per connected references), with a patch identified...

CVE-2023-20813

CVE-2023-20813 affects MediaTek WLAN software/component where an out-of-bounds read occurs due to improper input validation. Impact described as local information disclosure with the need for System execution privileges; no user interaction required. Patch referenced: ALPS07453549 (Issue ID: ALPS...

CVE-2023-20815

The CVE-2023-20815 issue affects MediaTek WLAN software. Affected component: WLAN service; root cause: out-of-bounds write due to improper input validation. Impact: local escalation of privilege with System execution privileges required; no user interaction needed. Remediation: patch ALPS07453587...

CVE-2023-20834

The CVE-2023-20834 issue affects the pda component, where a race condition leads to a use-after-free vulnerability. This can allow local escalation of privilege to SYSTEM level with high confidentiality/integrity/availability impact, and requires no user interaction to exploit. The documented att...

CVE-2023-21317

CVE-2023-21317 : In Android’s ContentService, a side-channel disclosure can reveal whether an app is installed on the device without any query permissions, enabling local information disclosure with no user interaction. Affected component: ContentService/Android framework; root cause: side-channe...

CVE-2023-21372

CVE-2023-21372 concerns a vulnerability in libdexfile where a missing bounds check allows an out-of-bounds read, enabling local elevation of privilege without user interaction. The issue affects Android’s libdexfile component and is classified as a local EoP (MITRE ambiguous, but Android bulletin...

CVE-2023-33887

CVE-2023-33887 affects the telephony service due to a missing permission check, enabling local information disclosure without additional execution privileges. The core issue is a privilege-check gap in the telephony component, with the impact described as local data leakage and no user interactio...

CVE-2023-40642

CVE-2023-40642 concerns a missing permission check in Messaging that could allow local information disclosure without requiring additional execution privileges. The available sources consistently describe the issue as a permissions check gap in Messaging, enabling access to sensitive information ...

CVE-2023-40650

CVE-2023-40650 affects the Telecom service and is caused by a missing permission check that can allow local information disclosure without requiring additional execution privileges. Public information in connected sources confirms the issue and its impact, but does not provide product/version spe...

CVE-2023-42633

The CVE-2023-42633 entry concerns a vulnerability in validationtools where a missing permission check can lead to local information disclosure without requiring additional privileges. The issue is documented across multiple sources, consistently describing a local information disclosure impact du...

CVE-2023-42635

Technical details about CVE-2023-42635 are not publicly provided in the supplied documents; monitor for updates.

CVE-2023-42637

CVE-2023-42637 concerns the validationtools component, where a missing permission check could allow local information disclosure without additional execution privileges. The available connected documents confirm the issue but do not provide concrete product/version mappings, exploit details, or a...