CVE-2020-0364

CVE-2020-0364 affects Android 11 via libDRCdec, where a missing bounds check causes an out-of-bounds read that can disclose information remotely. Exploitation requires user interaction. The issue is documented as fixed in the Android 11 security release notes; update to Android 11 with the patch ...

CVE-2020-0387

CVE-2020-0387 affects the SmartSpace package: in its manifest files there is a tapjacking vector caused by a missing permission check. The issue enables local elevation of privilege and possible account hijacking, with exploitation requiring user interaction. The vulnerability is categorized as a...

CVE-2020-0406

CVE-2020-0406 affects Android 11 via the libmpeg2dec component. The issue is an out-of-bounds write caused by a missing bounds check in libmpeg2dec, enabling local privilege escalation if triggered with certain parameters; exploitation requires user interaction and does not require prior executio...

CVE-2020-0434

CVE-2020-0434 relates to Pixel’s use of the Catpipe library, where a use-after-free leads to memory corruption in the Android kernel and enables local privilege escalation without user interaction. The impact is Local Privilege Escalation with high severity (per CVSS), affecting Pixel devices via...

CVE-2020-0480

CVE-2020-0480 affects Android 11 in the Framework: DocumentsProvider.java allows a local escalation of privilege due to a missing permission check in callUnchecked. The issue enables a caller to copy, move, or delete files accessible to DocumentsProvider without extra execution privileges. Exploi...

CVE-2020-10841

CVE-2020-10841 affects Samsung mobile devices with P(9.0)/Q(10.0) on Exynos 9610; root cause is an arbitrary kfree in the vipx and vertex drivers. Red Hat/NVD entries corroborate a kernel-free issue with potential high impact (CVE notes partial/confidentiality/availability risks, CVSSv3.1 base 7....

CVE-2020-25280

CVE-2020-25280 affects Samsung mobile devices running Android Q (10.0) on Exynos and MediaTek chipsets. Unauthenticated attackers could send a USB debugging command to execute LTE/5G commands, with impact to confidentiality, integrity, and availability listed as high in CVSS 3.1 (PHYSICAL access,...

CVE-2020-25281

The CVE-2020-25281 entry concerns LG mobile devices running Android 7.x–8.1 where apps with sensitive security settings (e.g., the package verifier) mishandle unknown-source installations. Affected component/function relates to the installation pipeline for unknown sources. Underlying impact stat...

CVE-2020-27027

CVE-2020-27027: In the NFC code path, specifically in nfc_ncif_proc_get_routing of nfc_ncif.cc, an out-of-bounds read due to a missing bounds check is described as enabling local information disclosure without requiring user interaction. The Android-11 reference in the initial entry is supported ...

CVE-2020-27031

CVE-2020-27031 affects Android 11, where in nfc_data_event of nfc_ncif.cc there is a possible out-of-bounds read due to a missing bounds check. This can lead to local information disclosure and may require system privileges, with no user interaction needed for exploitation. The provided documents...

CVE-2020-27037

CVE-2020-27037 affects Android 11, with a vulnerability in phNxpNciHal_core_initialized of phNxpNciHal.cc that can trigger an out-of-bounds read due to a missing bounds check. This could lead to local information disclosure on the NFC server and may grant System execution privileges, with no user...

CVE-2020-27041

In CVE-2020-27041, the issue is in Android 11’s ConnectivityService.java showProvisioningNotification where an unsafe PendingIntent could allow local information disclosure of notification data without extra privileges or user interaction. The vulnerability is a local disclosure due to PendingInt...

CVE-2020-27047

CVE-2020-27047 affects the Android ce_t4t_update_binary in ce_t4t.cc. A missing bounds check causes a potential out-of-bounds read, enabling local information disclosure with no full execution privileges. Exploitation requires user interaction. The connected documents do not specify affected prod...

CVE-2020-27053

CVE-2020-27053 affects Android 11. In ClientModeImpl.java, broadcastWifiCredentialChanged has a missing permission check causing a location permission bypass. This could lead to local disclosure of the WiFi network name with System execution privileges; no user interaction is required for exploit...

CVE-2020-27056

CVE-2020-27056 affects Android 11 with a missing permission check in SELinux MLS policies that can disclose local package-metadata information without extra privileges. The issue is confirmed as a local information-disclosure vulnerability; no exploitation details are provided in the documents. R...

CVE-2021-0371

Summary: CVE-2021-0371 is an Android elevation-of-privilege issue. The flaw is in the function nci_proc_rf_management_ntf within nci_hrcv.cc , where an out-of-bounds read can occur due to a missing bounds check. This could enable local privilege escalation to System level without user interaction...

CVE-2021-0408

In CVE-2021-0408, the issue is a possible out-of-bounds read in the asf extractor caused by an incorrect bounds check. This could lead to local information disclosure without additional privileges or user interaction. The vulnerability is documented across multiple sources (NVD/Red Hat/NVD_PAIR/e...

CVE-2021-0488

CVE-2021-0488 affects Android with an out-of-bounds write in the nanopb-related code path (pb_write in pb_encode.c) due to a missing bounds check. The impact is local elevation of privilege, requiring local access and yielding System privileges; user interaction is not needed. Several connected s...

CVE-2021-23243

Technical details are not publicly available in the provided documents. Information on affected products, versions, impact or remediation is not specified. Monitor for updates.

CVE-2021-25407

Summary (CVE-2021-25407) : A vulnerability in Samsung’s NPU driver (pre-SMR JUN-2021 Release 1) enables an out-of-bounds write, allowing arbitrary memory writes. The issue is rooted in the NPU driver and affects devices using the affected firmware. Publicly disclosed data indicate potential impac...

CVE-2021-25467

CVE-2021-25467 describes a potential buffer overflow in the Vision DSP kernel driver (Samsung devices) before SMR Oct-2021 Release 1, enabling privilege escalation to root via hijacking a loaded library. The incident is tied to local exploit scenarios, with impact described as high for confidenti...

CVE-2021-25471

The vulnerability CVE-2021-25471 affects Samsung devices in the Security Mode Command (SMC) processing path where replay protection is missing. This lack of replay attack protection can cause denial of service to mobile network connections and result in battery depletion. Documented impact is tie...

CVE-2022-47497

The CVE-2022-47497 entry concerns the soter service, with a root cause described as a missing bounds check that enables an out-of-bounds write. This could cause local denial of service with system execution privileges required. Affected context appears to be UNISOC/“soter service” components acro...

CVE-2023-20686

CVE-2023-20686 describes a race-condition in the display DRM path that enables a double-free vulnerability, potentially enabling local privilege escalation with SYSTEM privileges. The issue is described consistently across sources (NVD/Red Hat citations) as requiring no user interaction to exploi...

CVE-2023-20757

The CVE-2023-20757 entry concerns the cmdq component, where a missing bounds check enables an out-of-bounds write. This can lead to local privilege escalation with SYSTEM execution privileges required and does not require user interaction. The vulnerability description is consistent across multip...

CVE-2023-20766

CVE-2023-20766 describes a local out-of-bounds write in the gps component caused by a missing bounds check, enabling local privilege escalation with system-level execution privileges, and no user interaction required. A patch is available (Patch ID ALPS07573237; Issue ID ALPS07573202). No exploit...

CVE-2023-20771

CVE-2023-20771 involves a memory corruption issue caused by a race condition in the display path, enabling local escalation to SYSTEM privileges with no user interaction. Reported affected MediaTek-based chips include MT6580, MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6785, MT8168, and MT8...

CVE-2023-20784

CVE-2023-20784 describes an out-of-bounds write in the keyinstall component due to a missing bounds check, enabling local escalation of privilege with SYSTEM execution privileges required and no user interaction. The vulnerability is associated with MediaTek-based chip environments as per multipl...

CVE-2023-20814

The CVE-2023-20814 issue is described as an out-of-bounds write in the MediaTek WLAN service caused by improper input validation, enabling local escalation to SYSTEM with no user interaction. Affected software is MediaTek WLAN components; root cause is a buffer/bounds check failure. Impact is loc...

CVE-2023-21300

Summary: CVE-2023-21300 affects Android’s PackageManager and arises from a side-channel information disclosure that allows a local attacker to infer whether an app is installed without query permissions. This is described as a local information disclosure with no additional execution privileges r...

CVE-2023-30917

CVE-2023-30917 affects DMService in Unisoc chipsets (e.g., SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T618, etc.) due to a missing permission check, enabling local privilege escalation with no additional privileges. NVD data shows CVSS v3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base...

CVE-2023-30919

The CVE-2023-30919 vulnerability is due to a missing permission check in the messaging service, enabling local information disclosure without requiring additional execution privileges. Public records (NVD, Red Hat, PRION, CVE listing) describe the issue as a local-privilege-context information ex...

CVE-2023-30922

CVE-2023-30922 describes a missing permission check in the messaging service, leading to local information disclosure without extra execution privileges. The vulnerability is reported across multiple sources tied to UNISOC chipsets (e.g., SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T618, T...

CVE-2023-30924

CVE-2023-30924 involves a missing permission check in the messaging service, enabling local information disclosure without extra execution privileges. The NVD entry assigns CVSS v3.1 base score 5.5 (Local, Low attack complexity, Privileges Required: Low, Confidentiality Impact: High) and notes it...

CVE-2023-30925

CVE-2023-30925 describes a missing permission check in the opm service that can cause local information disclosure without requiring extra privileges. Multiple sources (including NVD and Red Hat) confirm the issue and its impact, with a CVSSv3.1 base score of 5.5 (Local access, Confidentiality im...

CVE-2023-32788

The CVE-2023-32788 entry concerns a missing permission check in the telephony service that could lead to local information disclosure without additional execution privileges. Affected scope is described across multiple sources (NVD/Red Hat/CVE record), with the CVSS v3.1 vector indicating Local a...

CVE-2023-32853

CVE-2023-32853 describes a possible out-of-bounds write in the rpmb module that could enable local privilege escalation with System-level privileges; no user interaction is required for exploitation. The description states a missing bounds check as the root cause. Patch ID: ALPS07648764; Issue ID...

CVE-2023-33893

The CVE-2023-33893 entry concerns a privilege-check bypass in the fastDial service that can enable local information disclosure without additional execution privileges. Public sources consistently describe the issue as a missing permission check leading to exposure of data, with an overall CVSSv3...

CVE-2023-33897

CVE-2023-33897 affects libimpl-ril and is caused by a missing bounds check that leads to an out-of-bounds write. This can result in local denial of service with SYSTEM privileges required. The available documents confirm the vulnerability and its impact but do not provide specifics on affected pr...

CVE-2023-33901

CVE-2023-33901 affects UNISOC Bluetooth service due to a missing permission check, enabling local information disclosure without extra privileges. Public details in connected sources enumerate affected UNISOC chipsets, including SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T618, T612, T616,...

CVE-2023-33913

CVE-2023-33913 describes a vulnerability in the DRM/oemcrypto module where an incorrect calculation of the buffer size allows an out-of-bounds write. This could lead to remote escalation of privilege with system execution privileges required. The initial documents confirm the issue and its impact...

CVE-2023-33914

CVE-2023-33914 concerns UNISOC chipsets where the NIA0 algorithm used in Security Mode Command may accept invalid input due to missing verification, enabling remote information disclosure without extra privileges. The publicly provided sources confirm the issue but do not specify a fixed version ...

CVE-2023-38436

The CVE-2023-38436 entry concerns vowifiservice and describes a missing permission check that could allow local information disclosure without requiring additional privileges. Across connected sources, the impact is stated as information disclosure with a local attack vector and no explicit remot...

CVE-2023-38449

CVE-2023-38449 affects vowifiservice and is caused by a missing permission check, enabling local privilege escalation with no additional execution privileges (per the CVE description and connected records). The NVD entry shows a CVSS v3.1 base score of 7.8 (HIGH) with local attack vector, low att...

CVE-2023-38461

The CVE-2023-38461 entry concerns vowifiservice with a missing permission check, leading to local denial of service without extra privileges. Affected component: vowifiservice (on UNISOC-derived platforms as reflected in multiple sources). Root cause: insufficient authorization checks in the serv...

CVE-2023-42671

The CVE-2023-42671 issue affects imsservice and stems from a missing permission check, allowing an app to write permission usage records and potentially disclose information locally. This is a local information disclosure vulnerability with no additional execution privileges required. Affected co...

CVE-2023-42685

Technical details about CVE-2023-42685 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories.

CVE-2023-42689

CVE-2023-42689 affects the wifi service in UNISOC chipsets. The root cause is a possible missing permission check in the wifi service, which could enable local escalation of privilege with no additional execution privileges required. The CVE is associated with a high impact (base score 7.8) invol...

CVE-2023-42690

CVE-2023-42690 concerns a missing permission check in the wifi service of UNISOC chipsets, enabling local escalation of privilege with no additional execution privileges required. The NVD entry rates this as CVSSv3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base score 7.8, HIGH). Connected documents...

CVE-2023-42693

CVE-2023-42693 : The issue is a missing permission check in the wifi service of UNISOC chipsets, enabling local escalation of privilege with no extra execution privileges required. Connected sources confirm the affected component as the wifi service and describe the impact as local privilege elev...