CVE-2018-9493

CVE-2018-9493 affects Android’s Download Manager content provider, with an SQL injection due to improper input validation. This could lead to local information disclosure without extra privileges or user interaction. Affected Android versions include 7.0–9.0. The provided sources describe the iss...

CVE-2018-9585

The CVE-2018-9585 issue affects Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9 in the NFC subsystem. Root cause: a missing bounds check in nfc_ncif_proc_get_routing within nfc_ncif.cc leads to an out-of-bounds write. Impact: local elevation of privilege with no additional execution privileges needed;...

CVE-2018-9589

CVE-2018-9589 affects the Android WiFi stack. In ieee802_11_rx_wnmsleep_req() within wnm_ap.c on Android 7.0–9 (including 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9), there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure in the WiFi driver with ...

CVE-2019-2034

CVE-2019-2034 : In rw_i93_sm_read_ndef of rw_i93.cc, an integer overflow can trigger an out‑of‑bounds write, enabling local elevation of privilege in the NFC process. Affected Android versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9. Exploitation requires user interaction. Documents indicate a local code...

CVE-2019-20580

This CVE concerns Samsung mobile devices running P(9.0). The Motion photo player is able to bypass the Secure Folder feature to view images, constituting an information disclosure vulnerability. Affected software/hardware: Samsung mobile devices with P(9.0). Vulnerable component: Motion photo pla...

CVE-2019-20586

CVE-2019-20586 affects Samsung mobile devices running O(8.1) and P(9.0) with TEEGRIS. Root cause is a type confusion in the FINGERPRINT Trustlet, enabling arbitrary code execution. Exploitation details are not provided in the available documents, and no public patch/version fix is specified; one ...

CVE-2019-20770

CVE-2019-20770 affects LG mobile devices running Android 9.0. The HAL service contains a buffer overflow that leads to arbitrary code execution. Sources in connected documents (Red Hat and NVD entries) confirm the description and LG’s internal ID LVE-SMP-190013 (Sept 2019). No further exploit det...

CVE-2019-2139

CVE-2019-2139 affects Android 10’s libxaac, where a missing bounds check allows an out-of-bounds read that can disclose information. Exploitation requires user interaction; no root privileges are indicated. The connected documents confirm the vulnerable component and impact but do not specify a p...

CVE-2019-9417

CVE-2019-9417 is a Bluetooth vulnerability in Android 10 where an out-of-bounds read can disclose information locally without user interaction due to a missing bounds check. Exploitation requires local access; impact is information disclosure with no execution privileges gained. Public references...

CVE-2019-9418

CVE-2019-9418 affects Android 10 via libstagefright, where a missing bounds check can cause resource exhaustion leading to remote DoS with no extra privileges required (user interaction). Connected sources confirm the issue and indicate mitigation through Android 10 patch level 2019-09-01 or late...

CVE-2019-9468

The CVE-2019-9468 issue affects Android 10 and is caused by a double free in export_key_der inside export_key.cpp, leading to memory corruption and local privilege escalation without user interaction. The vulnerability is categorized as EoP with high impact, as reflected in the Pixel Update Bulle...

CVE-2020-0008

CVE-2020-0008 affects Android 8.0–10 and is described as a race-condition in LowEnergyClient::MtuChangedCallback that can cause an out-of-bounds read. The issue enables local information disclosure without requiring user interaction or additional privileges. The vulnerability is documented across...

CVE-2020-0020

CVE-2020-0020 affects the Android 10 ExifInterface.getAttributeRange implementation. The issue is an incorrect bounds check in redacting location metadata from media files, enabling local information disclosure with no user interaction required (privileges: none; attack vector: LOCAL; CVSS v3.1 b...

CVE-2020-0090

CVE-2020-0090 is a vulnerability in the MediaTek Email component on Android devices. It is described as an improper authorization in the receiver component. According to the connected Android bulletin entry, this issue is categorized under the MediaTek components with CVE-2020-0090 and is listed ...

CVE-2020-0425

Technical details about CVE-2020-0425 are not publicly provided in the connected documents. Monitor for updates from vendors and security advisories.

CVE-2020-13836

CVE-2020-13836 affects Samsung mobile devices running O(8.x), P(9.0), and Q(10.0). A path traversal vulnerability exists in the HWRResProvider that can lead to data exposure. This is documented across multiple sources (including NVD, Red Hat, CNVD, CVE lists) with the Samsung ID SVE-2020-16954. T...

CVE-2020-13837

CVE-2020-13837 concerns Samsung mobile devices running Q(10.0). The issue is that the Lockscreen does not block access to Music Share via the Quick Panel, allowing potential exposure of Music Share controls or data when the device is locked. The Samsung Internal ID is SVE-2020-17145 (June 2020). ...

CVE-2021-0360

CVE-2021-0360 concerns an out-of-bounds write in the netdiag component caused by an incorrect bounds check. According to the provided documents, this could allow local escalation of privilege with System execution privileges, and does not require user interaction. Affected products listed are And...

CVE-2021-0401

Summary: CVE-2021-0401 describes a memory corruption due to a race condition in vow that could enable local privilege escalation to SYSTEM on Android devices (Android-10/Android-11). The issue is triggered by a race in vow’s handling, requiring user interaction for exploitation. The patches refer...

CVE-2021-0404

CVE-2021-0404 concerns MediaTek’s mobile_log_d on Android 11, where an input validation error can enable local information disclosure. The Red Hat entry and multiple aggregated sources confirm that exploitation does not require user interaction, but the impact involves potential disclosure of sen...

CVE-2021-0405

CVE-2021-0405 affects Android 10 and Android 11, where the MediaTek performance driver’s out-of-bounds write stems from a missing bounds check in the driver code. This can permit local escalation of privilege to System execution level without user interaction, as described in multiple sources (in...

CVE-2021-25361

The CVE-2021-25361 issue affects Samsung’s stickerCenter component prior to SMR APR-2021 Release 1. The vulnerability stems from improper access control, enabling a local attacker to read or write arbitrary files of the system process via an untrusted application. Public documentation consistentl...

CVE-2021-25449

The CVE-2021-25449 entry describes an improper input validation in the libsapeextractor library prior to SMR Sep-2021 Release 1, which can lead to arbitrary code execution in the mediaextractor process. The vulnerability is documented across multiple feeds (including Samsung, Red Hat, NVD) and is...

CVE-2022-20242

CVE-2022-20242 describes a side-channel information disclosure in Android 13’s Telephony component that can reveal whether an app is installed, without query permissions. This enables local information disclosure with no user interaction, as indicated in the description. Affected product: Android...

CVE-2022-20265

CVE-2022-20265 concerns Android 13 where the Settings component allows a permissions bypass that can lead to local elevation of privilege with physical access and no user interaction. Affected product: Android 13 (Settings). Root cause: a permissions bypass in the Settings flow that bypasses fact...

CVE-2022-20267

The CVE-2022-20267 issue affects Android 13’s Bluetooth implementation. It arises from a missing permission check that could allow enabling or disabling Bluetooth connections without user consent, enabling local elevation of privilege with no user interaction required. Affected component: Bluetoo...

CVE-2022-20284

CVE-2022-20284 affects Android 13 Telephony. A missing permission check enables local information disclosure of phone accounts; no user interaction is required. Exploitation requires user privileges (LOW) and local access (UI:N). Impact is confined to confidentiality (HIGH); integrity/availabilit...

CVE-2022-20298

CVE-2022-20298 affects Android 13 ContentService. The issue stems from a missing permission check in ContentService, enabling an attacker to determine whether an account exists on the device and potentially disclose local information. Exploitation is local and does not require user interaction, w...

CVE-2022-26455

The CVE-2022-26455 entry concerns the gz module on MediaTek devices. A memory corruption fault arises from incorrect error handling, enabling local escalation of privilege with SYSTEM privileges required; no user interaction is needed. A patch is referenced (ALPS07177858 / ALPS07177858). Connecte...

CVE-2022-30720

CVE-2022-30720 concerns an improper input validation logic in libsmkvextractor used by Samsung Mobile. The issue, tracked across multiple feeds, states that prior to SMR Jun-2022 Release 1 an attacker could trigger a crash, indicating a stability/availability impact. Concrete details confirm the ...

CVE-2022-30752

CVE-2022-30752 concerns an improper access control vulnerability in the SemWifiApClient’s sendDHCPACKBroadcast function. Affected software is SemWifiApClient prior to Samsung SMR Jul-2022 Release 1. The root cause is improper access control that could allow an attacker to obtain the MAC address o...

CVE-2022-32621

CVE-2022-32621 concerns MediaTek isp component: a race condition can cause an out-of-bounds write, enabling local privilege escalation with SYSTEM privileges. Exploitation reportedly does not require user interaction, and an in-place patch is available (Patch ID ALPS07310829; Issue ID ALPS0731082...

CVE-2022-32624

CVE-2022-32624 describes an out-of-bounds write caused by an incorrect buffer-size calculation in the throttling mechanism. This can lead to local escalation of privileges with SYSTEM-level execution privileges. Exploitation is described as local and does not require user interaction. The issue i...

CVE-2022-36853

The CVE-2022-36853 issue affects Samsung Photo Editor (on Samsung mobile devices) prior to the SMR Sep-2022 Release 1. Root cause: intent redirection in Photo Editor that may disclose sensitive information. Impact: enables information disclosure to an attacker without user interaction (per NVD me...

CVE-2022-36861

CVE-2022-36861 affects Samsung SystemUI prior to SMR Sep-2022 Release 1. It is described as a custom permission misuse that lets an attacker use some protected functions with SystemUI privilege. Root cause: misuse of a custom permission in SystemUI. Impact: potential elevation of privileges withi...

CVE-2022-38678

CVE-2022-38678 describes a missing permission check in the contacts service that could lead to a local denial-of-service without requiring additional privileges. The vulnerability affects the contacts service component and is characterized by a local attack vector with low attack complexity and l...

CVE-2022-39086

CVE-2022-39086 affects network services with a missing permission check that can enable local privilege escalation requiring system execution privileges. Multiple connected sources associate this issue with UNISOC chipset/network services, indicating the root cause is lack of privilege checking. ...

CVE-2022-39099

CVE-2022-39099: A missing permission check in the power management service enables setup of the service with no additional execution privileges required. CVSSv3.1 base metrics (LOCAL access, LOW privileges) indicate high impact on confidentiality, integrity, and availability. Connected sources co...

CVE-2022-39125

The CVE-2022-39125 entry concerns a vulnerability in a sensor driver where a missing bounds check can cause an out-of-bounds write, leading to local denial of service in the kernel. The data in connected sources consistently describe the issue as a sensor-driver boundary-check failure affecting k...

CVE-2022-39851

CVE-2022-39851 affects CocktailBarService on Samsung Mobile devices prior to SMR Oct-2022 Release 1. The issue is due to improper access control, enabling a local attacker to bind a service that requires the BIND_REMOTEVIEWS permission. The vulnerability is mitigated by updating to SMR Oct-2022 R...

CVE-2022-39898

CVE-2022-39898 affects Samsung IIccPhoneBook prior to SMR Dec-2022 Release 1 and is characterized by improper access control that could allow access to some information on the USIM. The vulnerability is documented across multiple feeds (NVD, Red Hat, CVE List) with a common description and a Sams...

CVE-2022-39905

CVE-2022-39905 is an implicit intent hijacking vulnerability in the Samsung Telecom application prior to the SMR-DEC-2022 Release 1. The fault is a misused implicit intent that allows an attacker to access sensitive information via intents, with impact described as confidential data exposure and ...

CVE-2022-42762

CVE-2022-42762 describes a local denial-of-service vulnerability in the WLAN subsystem due to a missing bounds check in the WLAN driver (UNISOC chipset context appears in multiple sources). The flaw can be triggered locally and could impact WLAN services. Connected sources corroborate the basic i...

CVE-2022-42782

The CVE-2022-42782 entry concerns a missing permission check in the WLAN driver that can lead to local information disclosure. Connected sources (Red Hat, NVD, CNNVD, CVE listings) confirm the issue centers on the WLAN driver of the affected chipset; they do not provide an explicit patched versio...

CVE-2022-44423

CVE-2022-44423 involves a missing permission check in the music service that could trigger a local denial-of-service in the contacts service without requiring additional privileges. Connected sources reference UNISOC chipsets and reiterate the issue as a local DoS vector, but do not provide concr...

CVE-2022-44443

CVE-2022-44443 concerns a missing bounds check in the WLAN driver, causing local denial of service in WLAN services. The connected sources consistently describe the vulnerable component as the WLAN driver and attribute the issue to an out-of-bounds condition leading to DoS. The available document...

CVE-2022-47325

The CVE-2022-47325 entry concerns the WLAN driver where a missing permission check could allow local information disclosure. Several connected sources (NVD, Red Hat, CVE listing, PRION, CNNVD) consistently describe this issue as a local-information-disclosure vulnerability in the WLAN driver, cau...

CVE-2022-47362

CVE-2022-47362 affects telecom service with a missing permission check, enabling local denial of service. Documented in multiple feeds (NVD/Red Hat/PRION/Gov sources) reports: local exploit possibility; exploitation status not detailed. Some references indicate no disclosed fix version; PT-Securi...

CVE-2022-47465

CVE-2022-47465 affects the vdsp service, where a missing permission check can cause local denial of service. The CVE description and multiple sources confirm a local, low-privilege issue with no required user interaction, resulting in availability impact. Exploitation details are not provided in ...

CVE-2022-48242

CVE-2022-48242 concerns the telephony service in UNISOC chipsets where a missing permission check can lead to local information disclosure without requiring additional execution privileges. The linked documents consistently describe a local-privilege-check failure in the telephony service module,...