CVE-2020-12750

CVE-2020-12750 describes a vulnerability in Samsung mobile devices running Q (Android 10) where Factory Reset Protection (FRP) can be bypassed via SPEN. The issue affects Samsung devices with Q(10.0) software; multiple feeds (NVD, Red Hat, CNVD, CVE listings) corroborate the same impact. The core...

CVE-2020-25060

Technical details about CVE-2020-25060 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2020-25064

Technical details (affected products, vulnerable component, root cause, exploit information) are not provided in the connected documents. Monitor for updates from LG/Security advisories.

CVE-2020-27044

CVE-2020-27044 affects Android 11 in Parcel.cpp, restartWrite path, where a use-after-free leads to memory corruption. The issue is described as a local elevation of privilege without extra execution privileges required; user interaction is not needed. The vulnerability is reported with a high ba...

CVE-2020-27055

The CVE-2020-27055 vulnerability affects Android 11, specifically in WifiConfigController.java and WifiConfigController2.java. The issue arises from improper input validation in isSubmittable and showWarningMessagesIfAppropriate, leading to an insecure WiFi configuration and potential remote info...

CVE-2021-0357

Technical details about CVE-2021-0357 are not publicly available in the provided Connected documents. The descriptions reiterate an out-of-bounds write in netdiag affecting Android 10/11 with local privilege escalation. Monitor for updates.

CVE-2021-0413

This CVE refers to the MediaTek flv extractor with an out-of-bounds read caused by a missing bounds check. The result is local information disclosure without requiring user interaction. No exploitation details are provided beyond this disclosure risk. A patch/ID is listed as ALPS05561379 (Issue I...

CVE-2021-0454

CVE-2021-0454 affects the Citadel chip firmware via an out-of-bounds write caused by a missing bounds check, enabling local privilege escalation with System execution privileges required and no user interaction. In Google Pixel/Android contexts, this vulnerability is mapped to Titan M components ...

CVE-2021-0490

CVE-2021-0490 affects Android’s memory management driver (MediaTek memory management driver) and describes an out-of-bounds write due to a missing bounds check that could enable local elevation of privilege with no user interaction. The issue is documented across sources including NVD and the 202...

CVE-2021-0529

CVE-2021-0529 affects MediaTek devices via the MTK memory management driver. The root cause is improper locking, leading to memory corruption and local escalation of privilege with no extra user interaction. Impact is described as local EoP with high severity (per CVSS metrics in sources). The co...

CVE-2021-0530

CVE-2021-0530 is an Android memory management driver vulnerability described across multiple sources as an out-of-bounds write caused by uninitialized data, enabling local privilege escalation with no user interaction required. Connected data identify affected component as the Android memory mana...

CVE-2021-0532

CVE-2021-0532 affects the Android memory management driver and is caused by a race condition that can lead to memory corruption and local escalation of privilege with no additional privileges or user interaction required. The description is consistent across multiple sources (NVD, Red Hat, CVE li...

CVE-2021-0533

CVE-2021-0533 affects the Android memory management driver (Memory management on Android SoC) and is caused by a race condition that can lead to memory corruption. The documented impact is local escalation of privilege with no additional execution privileges required and no user interaction neede...

CVE-2021-0610

CVE-2021-0610 affects Mediatek memory management driver. Reported issue is a memory corruption caused by an integer overflow, enabling local privilege escalation with no user interaction required (LOCAL, LOW complexity). Documents consistently describe a patch identified as ALPS05403499 (Issue AL...

CVE-2021-0656

CVE-2021-0656 affects the edma driver and is characterized by a use-after-free memory corruption leading to local escalation of privilege with System execution privileges required. Public descriptions consistently note no user interaction is needed for exploitation. The issue is tied to the edma ...

CVE-2021-0900

The CVE-2021-0900 entry concerns the MediaTek apusys component, with an out-of-bounds read due to an incorrect bounds check. This could enable local information disclosure and requires System privileges for exploitation, with no user interaction needed. Documents consistently describe the affecte...

CVE-2021-25409

CVE-2021-25409 describes an improper access in the Notification setting prior to Samsung SMR June‑2021 Release 1, allowing physically proximate attackers to set arbitrary notifications by physically configuring the device. The NVD entry indicates a low overall impact (CVSS v2: AV:L/AC:L/Au:N/I:P/...

CVE-2021-25451

CVE-2021-25451 affects Android’s NetworkPolicyManagerService where a PendingIntent hijack can lead to exposure of IMSI data. The vulnerability is local, requiring user interaction, with a low-moderate CVSS (3.3 on 3.1, base score 3.3; confidentiality impact: Low). Root cause stated: manipulation ...

CVE-2021-25454

CVE-2021-25454 corresponds to an OOB read in the libsaacextractor.so library, vulnerability class affecting Samsung SMR components prior to the September 2021 Release 1. The flaw enables remote DoS via a crafted AAC file, as described across multiple sources (NVD/Red Hat/CVE records). Technical c...

CVE-2021-25475

Summary of CVE-2021-25475 : The issue is a heap-based buffer overflow in the DSP kernel driver, before Samsung SMR Oct-2021 Release 1. This flaw can lead to arbitrary memory writes and code execution within the kernel context on affected Samsung devices. Affected component: DSP kernel driver. Roo...

CVE-2021-30161

CVE-2021-30161 affects LG mobile devices running Android 11. The vulnerability allows attackers to bypass the lockscreen protection after an incoming call has been terminated. Root cause, affected models/versions, exploit details, and fixes are not provided in the connected documents; remediation...

CVE-2022-20342

CVE-2022-20342 affects Android 13. An insecure default in WiFi could disclose the WiFi password to the end user, enabling local information disclosure without extra privileges or user interaction. The issue is categorized under Android 13 security release notes; no exploitation details or active ...

CVE-2022-32645

CVE-2022-32645 affects vow and describes a race condition that could lead to local information disclosure with SYSTEM privileges required. Exploitation does not require user interaction. The CVE entry cites a patch ID ALPS07494477 (issue ALPS07494477) as the remediation. Multiple connected source...

CVE-2022-32650

In the CVE-2022-32650 entries, the vulnerability affects the MediaTek mtk-isp component, described as a use-after-free caused by a logic error. This leads to local escalation of privilege with System execution privileges required, and exploitation does not require user interaction. Remediation is...

CVE-2022-36843

CVE-2022-36843 describes a heap-based overflow in the MHW_RECOG_LIB_INFO function of libSDKRecognitionText.spensdk.samsung.so on Samsung devices. The vulnerability stems from a memory handling issue in the recognition library, potentially leading to memory access faults. Public references point t...

CVE-2022-36844

Summary (concrete details from connected docs): CVE-2022-36844 is a heap-based overflow in HWR::EngJudgeModel::Construct() within the Samsung libSDKRecognitionText.spensdk.samsung.so library. Vulnerable component: libSDKRecognitionText.spensdk.samsung.so prior to SMR Sep-2022 Release 1. Impact de...

CVE-2022-38689

CVE-2022-38689 concerns the telephony service, where a missing permission check can enable local information disclosure without extra execution privileges. Multiple connected sources corroborate a local-privilege-agnostic disclosure vector affecting telephony components, with no concrete exploit ...

CVE-2022-38697

CVE-2022-38697 affects the messaging service with a missing permission check that could allow a local attacker to access an unexpected provider in the contacts service without extra execution privileges. The NVD entry lists a CVSSv3.1 base score of 5.5 (HIGH confidentiality impact, LOCAL access, ...

CVE-2022-39093

CVE-2022-39093 describes a missing permission check in the power management service that can allow a setup of the service without additional execution privileges. The vulnerability is characterized as local, with low attack complexity and no user interaction, and has a CVSS v3.1 base score of 7.8...

CVE-2022-39102

CVE-2022-39102 concerns a missing permission check in the power management service, potentially allowing setup without additional privileges. The vulnerability is described as local, with low attack complexity and high impact across confidentiality, integrity, and availability (CVSS v3.1 base sco...

CVE-2022-39104

Summary (validated): CVE-2022-39104 affects the Contacts service, where a missing permission check could allow local denial of service without requiring additional execution privileges. The CVSS 3.1 base metrics indicate a Medium severity with Local attack vector and Availability impact. No expli...

CVE-2022-39110

CVE-2022-39110 describes a missing permission check in the Music service that could allow elevation of privilege with no additional execution privileges required. The vulnerability is identified across multiple sources (NVD, Red Hat, CVE lists, PRION, CNNVD, etc.), all reiterating the same issue:...

CVE-2022-39120

CVE-2022-39120 concerns a vulnerability in the kernel’s sensor driver where a missing bounds check can trigger an out-of-bounds write, enabling local denial of service. This is described consistently across sources (NVD/Red Hat/NVD enrichments) as a local, high-availability impact with a 5.5 CVSS...

CVE-2022-39854

CVE-2022-39854 pertains to Samsung devices with the IOMMU in the SMR Oct-2022 Release 1, where improper protection in the IOMMU could allow unauthorized access to secure memory. The root cause is described as insufficient protection in IOMMU prior to the SMR Oct-2022 Release 1. Affected remediati...

CVE-2022-42759

CVE-2022-42759 affects the wlan driver, where a missing bounds check in the driver could allow a local denial of service in wlan services. The Red Hat and NVD entries corroborate the description; no concrete exploit details are provided in the connected documents. The PT-Security entry notes the ...

CVE-2022-44420

The CVE-2022-44420 entry describes a vulnerability in the UNISOC modem module where there is a missing verification of the HashMME value in the Security Mode Command, enabling local denial of service with no additional privileges. This is a local-access issue with impact on availability (HIGH) an...

CVE-2022-47328

CVE-2022-47328 concerns a vulnerability in a WLAN driver (Qualcomm chip family in several reports) where a missing permission check enables potential local information disclosure. The Public documents consistently describe the issue as a local information disclosure due to insufficient privilege ...

CVE-2022-47351

CVE-2022-47351 affects the camera driver and involves a missing bounds check that enables an out-of-bounds read. This can lead to a local denial of service with System execution privileges required. The issue is documented across NVD/Red Hat databases with a CVSS v3.1 base score of 4.4 (MEDIUM) a...

CVE-2022-48241

The CVE-2022-48241 entry describes a vulnerability in the telephony service caused by a missing permission check that could enable local denial of service without additional execution privileges. The issue is referenced across multiple sources (NVD, Red Hat, CVE listing) with a common impact and ...

CVE-2022-48368

CVE-2022-48368 affects the UNISOC chipsets’ audio service, with the root cause described as a missing permission check in the audio service. This could allow a local attacker with low privileges and no user interaction to escalate to a high-privilege level, potentially compromising confidentialit...

CVE-2022-48441

CVE-2022-48441 affects Unisoc-based devices where the dialer service may perform a missing permission check, enabling local denial of service with no additional privileges. The issue is described across multiple sources as a local impact vulnerability (attack vector: local; impact: availability)....

CVE-2023-20647

This CVE (CVE-2023-20647) affects the ril module in MediaTek chips. The root cause is a missing bounds check that enables an out-of-bounds read, leading to local information disclosure with system execution privileges required. Exploitation is described as not requiring user interaction. Patch ID...

CVE-2023-20648

CVE-2023-20648 affects the ril module in MediaTek chips. Root cause: missing bounds check causing an out-of-bounds read. Impact: local information disclosure with system execution privileges required; exploitation requires no user interaction. Patch ID: ALPS07628612. Multiple connected sources (N...

CVE-2023-20651

CVE-2023-20651 concerns the MediaTek apu component, where a missing bounds check enables an out-of-bounds read. This could lead to local information disclosure with System execution privileges needed; no user interaction is required. Public details consistently identify the vulnerability in apu a...

CVE-2023-20677

The CVE-2023-20677 issue affects the wlan component in MediaTek-based devices, caused by a missing bounds check leading to an out-of-bounds read. Impact is local information disclosure with SYSTEM-level execution privileges required, and exploitation reportedly does not require user interaction. ...

CVE-2023-20693

Summary (CVE-2023-20693) In MediaTek wlan firmware, an uncaught exception can cause a system crash, leading to a remote denial of service without user interaction. The NVD entry lists a network exploit vector with no privileges required and no user interaction, and a high impact to availability. ...

CVE-2023-20703

CVE-2023-20703 concerns the MediaTek chip apu module where a missing bounds check can cause an out-of-bounds read, potentially exposing local information without extra privileges or user interaction. Multiple sources (NVD, Red Hat, CVE/CVE-list, PRION) corroborate the issue and its basic impact, ...

CVE-2023-20708

CVE-2023-20708 involves a possible out-of-bounds read in the MediaTek keyinstall component. The underlying issue is a missing bounds check, enabling local privilege escalation with System execution privileges needed. Exploitation status is not documented in the provided sources. The vulnerability...

CVE-2023-20709

CVE-2023-20709 affects the keyinstall module in MediaTek systems. The issue is an out-of-bounds read caused by a missing bounds check, leading to potential local information disclosure and requiring System execution privileges for exploitation. User interaction is not needed. References to patche...

CVE-2023-20803

Summary: CVE-2023-20803 affects the imgsys component of MediaTek microprogram software, where memory corruption can occur due to improper input validation. This leads to local privilege escalation with system execution privileges required and user interaction needed for exploitation. Technical de...