CVE-2019-20557

CVE-2019-20557 affects Samsung mobile devices running N(7.x), O(8.x), and P(9.0). The vulnerability allows attackers to bypass Factory Reset Protection (FRP) by manipulating a SIM card to block the PUK code. The issue is a device-side bypass of FRP, with the described impact being the inability t...

CVE-2018-21078

The CVE-2018-21078 entry relates to Samsung mobile devices running M(6.0), N(7.x), and O(8.0) where the Contacts app improperly secures Supplementary Service (SS) and USSD codes, enabling attackers to originate video calls. Public details in the provided documents note the Samsung ID SVE-2018-114...

CVE-2018-5907

The CVE-2018-5907 entry describes a vulnerability in the Qualcomm Audio DSP path: the function msm_adsp_stream_callback_put allows a buffer overflow due to insufficient input validation of user-provided data, leading to an integer overflow. Affected are Android for MSM, Firefox OS for MSM, and QR...

CVE-2018-9423

CVE-2018-9423 affects the Media framework component (ihevcd_parse_slice_header.c) where a missing bounds check allows an out-of-bounds read, leading to DoS. Exploitation requires user interaction. Several connected sources (NVD/Red Hat/Android bulletin) confirm the issue and cite the root cause. ...

CVE-2018-9426

CVE-2018-9426 summary (concrete details from connected docs) Root cause: In RSAKeyPairGenerator.getNumberOfIterations (RSAKeyPairGenerator.java), an incorrect implementation can produce weak RSA key pairs. Impact: Crypto vulnerability with no additional execution privileges; no user interaction r...

CVE-2018-9508

CVE-2018-9508 describes an out-of-bounds read in Bluetooth handling (smp_process_keypress_notification in smp_act.cc) that could lead to remote information disclosure without user interaction. Affected platforms include Android 7.0–8.1. The NVD notes a CVSSv3 base score of 6.5 (Attack vector: Adj...

CVE-2019-2051

CVE-2019-2051 is a vulnerability described in the Android ecosystem: it is a remote-read out-of-bounds issue in the Android system spaces.h encountered while processing a PAC file, allowing potential information disclosure without user interaction. Affected products are Android versions 7.0, 7.1....

CVE-2019-20602

CVE-2019-20602 affects Samsung mobile devices running N(7.x), O(8.0), and P(9.0) on Qualcomm chipsets. The issue is a NULL pointer dereference in the Authnr Trustlet, identified by Samsung as SVE-2019-13949 (May 2019). Connected sources confirm the affected components and root cause but do not pr...

CVE-2019-2070

CVE-2019-2070 describes an out-of-bounds write in libxaac on Android 10 caused by a missing bounds check. This could enable remote code execution with no privileges required, with user interaction needed for exploitation. Connected sources (NVD, Red Hat, CNVD, PRION/CVE-2019-2070 aggregates) cons...

CVE-2019-2080

CVE-2019-2080 concerns a possible out-of-bounds write in libxaac on Android 10, caused by a missing bounds check. The issue could enable remote code execution with no privileges and requires user interaction to exploit. Connected sources (including NVD and Red Hat) confirm libxaac as the vulnerab...

CVE-2019-2139

CVE-2019-2139 affects Android 10’s libxaac, where a missing bounds check allows an out-of-bounds read that can disclose information. Exploitation requires user interaction; no root privileges are indicated. The connected documents confirm the vulnerable component and impact but do not specify a p...

CVE-2019-2145

CVE-2019-2145 is a vulnerability in the Android libxaac library (Android-10) causing an information-disclosure via an out-of-bounds read due to missing bounds checks. The exploit requires user interaction and could allow partial confidentiality impact, with higher impact if exploited in context. ...

CVE-2019-9277

CVE-2019-9277 involves an information disclosure in the Linux proc filesystem on Android 10. The vulnerability allows local disclosure of app and browser activity without user interaction, with exploitation requiring local access and possible user privileges. Root cause is log information disclos...

CVE-2019-9373

Technical details about CVE-2019-9373 are not provided in the supplied documents. Monitor for updates from official advisories; no specific affected products, payloads, or mitigations are disclosed here.

CVE-2019-9385

In Android-10, the libxaac library contains an out-of-bounds read due to a missing bounds check, enabling remote information disclosure with no extra execution privileges. User interaction is required to exploit. The issue is documented across multiple sources (NVD, Red Hat CVE entry, CVE lists) ...

CVE-2019-9386

CVE-2019-9386 affects Android 10 NFC server: a missing bounds check leads to an out-of-bounds write that could enable local escalation of privilege in the system server. Exploitation requires user interaction. The issue is documented across multiple sources (NVD, Red Hat CVE, PRION) with the Andr...

CVE-2020-0003

CVE-2020-0003 affects Android 8.0 when the framework’s InstallStart.java onCreate contains a time‑of‑check time‑of‑use packaging validation bypass. The issue could allow a local elevation of privilege with user interaction required, via a vulnerability in the Android Framework. Public details ind...

CVE-2020-0064

CVE-2020-0064 is a MediaTek-specific issue (component: Omacp) documented in the Android May 2020 bulletin. It is classified as Information Disclosure (ID) with High severity and is linked to Android patch levels 2020-05-01 and later. The vulnerability arises from improper authorization when proce...

CVE-2020-0261

CVE-2020-0261 affects the Android kernel (C2 flame devices) with a seccomp bypass caused by a missing configuration file, enabling local elevation of privilege without user interaction. The vulnerability impact is described as high, with local exploitability and complete confidentiality/integrity...

CVE-2020-0354

CVE-2020-0354 concerns Android 11 Bluetooth where a missing bounds check enables an out-of-bounds write, potentially allowing remote code execution without privileges or user interaction. Affected software is the Android 11 Bluetooth stack; root cause is an out-of-bounds write in the Bluetooth im...

CVE-2021-1013

CVE-2021-1013 affects Android 12 (e.g., Pixel devices). In PermissionManagerService.java’s checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission, a side-channel information-disclosure path can determine whether an app is installed without query permissions. This enables local information...

CVE-2021-25338

CVE-2021-25338 describes an improper memory access control weakness in the RKP of Samsung mobile devices prior to the SMR Mar-2021 Release 1. The issue allows a compromised kernel to write portions of the RKP EL2 memory region, implying local attacker capabilities with kernel-level access and pot...

CVE-2021-25428

The CVE-2021-25428 entry concerns Samsung’s PackageManager, affected before the SMR July-2021 Release 1. The root cause is an improper validation check in PackageManager that can let untrusted apps obtain dangerous level permissions without user confirmation in limited circumstances (local, low c...

CVE-2022-20242

CVE-2022-20242 describes a side-channel information disclosure in Android 13’s Telephony component that can reveal whether an app is installed, without query permissions. This enables local information disclosure with no user interaction, as indicated in the description. Affected product: Android...

CVE-2022-20273

Summary: CVE-2022-20273 affects the Android Bluetooth stack on Android 13, involving an out-of-bounds read caused by a heap buffer overflow that could lead to remote information disclosure. Exploitation requires no user interaction and can be attempted from an adjacent network position (attack ve...

CVE-2022-20275

CVE-2022-20275 affects Android 13 devices due to a side-channel disclosure in the DevicePolicyManager that can reveal whether an app is installed without query permissions. The root cause is a information-disclosure path that enables local access to installation state without user interaction or ...

CVE-2022-20278

CVE-2022-20278 affects Android 13, in Accounts, due to insufficient log filtering that could write sensitive data to the system log. This enables local information disclosure with system privileges, no user interaction required. The issue is addressed in Android 13 security fixes; devices with pa...

CVE-2022-20283

CVE-2022-20283 is a Bluetooth vulnerability in Android 13 where an integer overflow can cause an out-of-bounds write in the Bluetooth stack, enabling remote code execution with no privileges and no user interaction. The issue is evidenced by Android security notes and multiple CVE aggregations, w...

CVE-2022-20285

CVE-2022-20285 affects Android 13 and involves a side-channel in PackageManager that can reveal whether an app is installed without query permissions, enabling local information disclosure with no user interaction. Affected component: PackageManager/framework behavior in Android 13; root cause is...

CVE-2022-20288

In Android 13, CVE-2022-20288 affects AppSearchManagerService and describes a side-channel information disclosure allowing a possible check if an app is installed without query permissions. Impact is local information disclosure with no additional execution privileges required; attack vector is L...

CVE-2022-20297

In Android 13, CVE-2022-20297 affects the Settings component, where a logic error could bypass factory reset protections. This enables local escalation of privilege without additional execution privileges and requires no user interaction. The vulnerability is described across multiple sources as ...

CVE-2022-20315

CVE-2022-20315 affects Android 13 with a missing permission check in ActivityManager, causing disclosure of installed packages via local information disclosure without extra privileges and no user interaction. Affected component: ActivityManager; root cause: inadequate permission check; impact: l...

CVE-2022-20531

The provided connected documents confirm CVE-2022-20531 affects Android’s Telecom component, describing a side-channel information disclosure that lets an app determine if another app is installed without query permissions. This enables local information disclosure with no extra execution privile...

CVE-2022-26474

The CVE-2022-26474 entry describes a local privilege escalation in MediaTek sensorhub due to an out-of-bounds write from an incorrect buffer size calculation. Vulnerable component: sensorhub in affected MediaTek chips; root cause is incorrect buffer size calculation leading to out-of-bounds write...

CVE-2022-27823

CVE-2022-27823 affects Samsung SMR libsapeextractor: the sapefd_parse_meta_HEADER_old function may read out of bounds when processing a crafted media file. The issue is rooted in an improper size check, enabling out-of-bounds reads. Impact is described as partial confidentiality and partial avail...

CVE-2022-28780

CVE-2022-28780 concerns an improper access control in the Weather feature prior to Samsung SMR May-2022 Release 1, enabling unauthorized access to location information set in Weather. The issue is mitigated by a patch that adds proper protection to prevent access to location data. Connected docum...

CVE-2022-28784

CVE-2022-28784 describes a path traversal vulnerability in Samsung Galaxy Themes prior to SMR May-2022 Release 1. The issue stems from incorrect file path validation logic, allowing a system user to list file names in arbitrary directories. Affected component: Galaxy Themes (on Samsung devices) w...

CVE-2022-30720

CVE-2022-30720 concerns an improper input validation logic in libsmkvextractor used by Samsung Mobile. The issue, tracked across multiple feeds, states that prior to SMR Jun-2022 Release 1 an attacker could trigger a crash, indicating a stability/availability impact. Concrete details confirm the ...

CVE-2022-30750

CVE-2022-30750 concerns Samsung SemWifiApClient prior to SMR Jul-2022 Release 1, with an improper access control vulnerability in the updateLastConnectedClientInfo function. The issue could allow an attacker to access the Wi‑Fi AP client MAC address of devices that connected to the AP. Connected ...

CVE-2022-30751

CVE-2022-30751 affects SemWifiApClient before the Samsung SMR Jul-2022 Release 1. The issue is an improper access control in the sendDHCPACKBroadcast function that can let an attacker access the Wi-Fi AP client MAC address of devices connected via the WIFI_AP_STA_DHCPACK_EVENT action. Public sour...

CVE-2022-30752

CVE-2022-30752 concerns an improper access control vulnerability in the SemWifiApClient’s sendDHCPACKBroadcast function. Affected software is SemWifiApClient prior to Samsung SMR Jul-2022 Release 1. The root cause is improper access control that could allow an attacker to obtain the MAC address o...

CVE-2022-32607

CVE-2022-32607 affects the aee component in MediaTek-derived implementations. The root cause is a use-after-free caused by a missing bounds check, enabling local escalation to System privileges without user interaction. The vulnerability is described with a local attack vector and high impact on ...

CVE-2022-32621

CVE-2022-32621 concerns MediaTek isp component: a race condition can cause an out-of-bounds write, enabling local privilege escalation with SYSTEM privileges. Exploitation reportedly does not require user interaction, and an in-place patch is available (Patch ID ALPS07310829; Issue ID ALPS0731082...

CVE-2022-32639

CVE-2022-32639 concerns watchdog with an out-of-bounds read caused by a missing bounds check. The vulnerability enables local escalation of privilege to System execution level; exploitation does not require user interaction. Patch ID ALPS07494487 is cited in the records. Current connected documen...

CVE-2022-36849

CVE-2022-36849 is a use-after-free vulnerability in the sdp_mm_set_process_sensitive function of the sdpmm driver, affecting Samsung devices in the SMR Sep-2022 Release 1. The issue arises from post-release reuse in the sdpmm driver and could allow malicious actions. Publicly documented impact fo...

CVE-2022-39081

CVE-2022-39081 describes a missing permission check in a network service that could enable local privilege escalation with System execution privileges required. The available connected documents corroborate the issue as a local-elevation flaw, but they do not provide concrete details on affected ...

CVE-2022-39114

CVE-2022-39114 describes a missing permission check in the Music service that can lead to a local denial of service without requiring additional execution privileges. The NVD entry assigns a CVSS v3.1 base score of 5.5 (Local, Low attack complexity, Low privileges required, Availability impact), ...

CVE-2022-39123

CVE-2022-39123 describes a potential out-of-bounds write in the sensor driver due to a missing bounds check, which could lead to local denial of service in the kernel. The public documents consistently state this issue but do not provide concrete exploitation details, affected product versions, o...

CVE-2022-39897

The CVE-2022-39897 issue affects Samsung Kernel prior to SMR Dec-2022 Release 1, enabling an attacker with local access to leak kernel address information via system logs, i.e., an information disclosure vulnerability. Documented impact: kernel address data exposure with impact on confidentiality...

CVE-2022-42536

Chromecast security bulletin (ANDROID CHROMECAST-2023-07-01) documents CVE-2022-42536 as a remote code execution affecting Chromecast devices. The issue is categorized under AMLogic Secure Monitor with high severity (CVSSv3.1: 9.8, network vector, no user interaction). The bulletin confirms a fun...