CVE-2019-2112

CVE-2019-2112 : In Android, memory corruption via a use-after-free in alarm.cc could enable local code execution with no authentication and no user interaction. Affected: Android 8.0, 8.1, and 9.0. Root cause: use-after-free in alarm.cc. Impact: local privilege escalation with high severity per C...

CVE-2019-2198

CVE-2019-2198 is a SQL injection vulnerability in Android’s Download Provider that can lead to local information disclosure without user interaction. Affected: Android 8.0–10 (Download Provider query selection parameter). Root cause: SQL injection in the Download Provider. Impact: local informati...

CVE-2019-2212

CVE-2019-2212 concerns an out-of-bounds read in the Poisson_distribution of random, enabling local information disclosure without extra privileges or user interaction. Affected products/versions (from provided docs): Android 8.0–10. The root cause is a read that can leak information from memory i...

CVE-2019-9330

CVE-2019-9330 affects Android 10 in Bluetooth, where an out-of-bounds read due to a missing bounds check could enable remote information disclosure without user interaction. The issue is cataloged across multiple sources (NVD, Red Hat, CVE listing) with CVSSv3.1 base score 7.5 (HIGH) and CVSSv2 5...

CVE-2019-9344

CVE-2019-9344 affects Android 10 NFC server and involves an out-of-bounds read due to a missing bounds check, enabling local information disclosure. The vulnerability targets NFC server components and can be exploited with user interaction; no remote access is indicated. While NVD lists CVSS scor...

CVE-2019-9400

CVE-2019-9400 affects Android 10 Bluetooth stack: a null pointer dereference caused by a missing null check can allow remote denial of service without user interaction. Exploitation is described as network‑based with low complexity; impact is DoS with availability affected. Mitigation per Android...

CVE-2020-0024

CVE-2020-0024 affects Android 8.0–10 in SettingsBaseActivity.java via a permissions bypass in onCreate, enabling local escalation of privilege. Exploitation requires user interaction and does not require initial execution privileges, per the NVD entry. Affected products are Android 8.0/8.1/9/10; ...

CVE-2020-0090

CVE-2020-0090 is a vulnerability in the MediaTek Email component on Android devices. It is described as an improper authorization in the receiver component. According to the connected Android bulletin entry, this issue is categorized under the MediaTek components with CVE-2020-0090 and is listed ...

CVE-2020-0121

CVE-2020-0121: In Android 10, a logic error in AppOpsService.updateUidProcState allows a local information disclosure of location data with user privileges and no user interaction. Affected software is Android 10; root cause is a logic flaw enabling a permission bypass in updateUidProcState. Impa...

CVE-2020-0263

CVE-2020-0263 affects Android 11, specifically the Accessibility service. A security issue causes a permission bypass via an unsafe PendingIntent, enabling local information disclosure without user interaction (local attacker privileges required). The Core impact is information disclosure with hi...

CVE-2020-0309

CVE-2020-0309 affects Android 11 Bluetooth server and is described across multiple sources as an out-of-bounds write caused by an integer overflow, enabling local elevation of privilege to System with no user interaction required. The vulnerability concerns the Android-11 Bluetooth stack and is l...

CVE-2020-0425

Technical details about CVE-2020-0425 are not publicly provided in the connected documents. Monitor for updates from vendors and security advisories.

CVE-2020-0478

CVE-2020-0478 targets Android-11, with a vulnerability in restoration.c (extend_frame_lowbd) causing an out-of-bounds write due to a missing bounds check. This can enable local privilege escalation and requires user interaction for exploitation. Affects Android-11; exploitation details or patch/v...

CVE-2020-13834

Technical details (affected product/version, root cause, impact, fixes) are not publicly available in the provided connected documents; monitor for updates.

CVE-2020-26597

The CVE-2020-26597 entry concerns LG mobile devices running Android 9.0–10, where the Wi‑Fi subsystem has an incorrect input validation that leads to a crash. The issue is tied to LG’s internal ID LVE-SMP-200022 (October 2020). Affected component: Wi‑Fi stack on affected LG devices; root cause st...

CVE-2020-26605

Technical details about CVE-2020-26605 are not publicly provided in the supplied documents. Monitor for updates from vendors (Samsung security page, Red Hat, NCSC advisories) for affected products, fixes, and impact.

CVE-2020-28344

CVE-2020-28344 affects LG mobile devices running Android 8.0–10. The root cause is a missing NULL parameter check leading to a NULL pointer dereference, which may cause system services to crash. The available documents (NVD, Red Hat, CVE listing) reiterate this description; no specific CVE patch ...

CVE-2021-0356

CVE-2021-0356 affects Android 10 and Android 11 in the netdiag component, where improper input validation enables a local command-injection that can grant SYSTEM-level privileges without user interaction. The issue’s impact is described as local escalation with high confidentiality, integrity, an...

CVE-2021-0360

CVE-2021-0360 concerns an out-of-bounds write in the netdiag component caused by an incorrect bounds check. According to the provided documents, this could allow local escalation of privilege with System execution privileges, and does not require user interaction. Affected products listed are And...

CVE-2021-0365

CVE-2021-0365 affects Android (Android-10 and Android-11) with a memory corruption issue in the display driver caused by a use-after-free. The vulnerability allows local escalation to System privileges without user interaction, as reported in multiple sources (NVD/Red Hat entry for CVE-2021-0365;...

CVE-2021-0366

In CVE-2021-0366, the vulnerability affects Android devices (Android-10 and Android-11) due to a memory corruption in the vpu caused by a race condition. This leads to local privilege escalation with System privileges required, and exploitation does not require user interaction. The vulnerability...

CVE-2021-0627

CVE-2021-0627 affects OMA DRM. The vulnerability is described as memory corruption due to an integer overflow, enabling local escalation of privilege with System execution privileges required and no user interaction. Patch ID: ALPS05722434 (Issue ALPS05722434) is referenced. Connected sources rei...

CVE-2021-0895

In CVE-2021-0895, the affected component is MediaTek Apusys (apusys). The issue is an out-of-bounds write caused by a missing bounds check, enabling local escalation of privileges with System execution privileges required; exploitation is possible without user interaction. The vulnerability is li...

CVE-2021-25359

The CVE-2021-25359 entry describes an improper SELinux policy in Samsung’s SMR APR-2021 Release 1 prior builds that permits local attackers to access AP information via untrusted apps. Public records from multiple sources (e.g., Red Hat advisory, CNVD) align on a local-attack scenario stemming fr...

CVE-2021-25361

The CVE-2021-25361 issue affects Samsung’s stickerCenter component prior to SMR APR-2021 Release 1. The vulnerability stems from improper access control, enabling a local attacker to read or write arbitrary files of the system process via an untrusted application. Public documentation consistentl...

CVE-2022-20014

The CVE-2022-20014 entry concerns the vow driver, where improper input validation can cause memory corruption leading to local escalation of privilege with System execution privileges required. Exploitation does not require user interaction according to the description. The vulnerability is assoc...

CVE-2022-20259

CVE-2022-20259 affects Android 13 Telephony: a missing permission check enables local disclosure of ICCID and EID without user interaction. Impact is information disclosure with no privilege escalation; exploitability is local. Remediation is applying the Android 13 security patches (patch level ...

CVE-2022-20277

CVE-2022-20277 affects the Android framework component DevicePolicyManager. The issue is a side-channel information disclosure that enables an app to determine whether another app is installed without needing query permissions, leading to local information disclosure without extra execution privi...

CVE-2022-20279

CVE-2022-20279 affects Android 13, specifically through DevicePolicyManager where a side-channel can reveal whether an app is installed without query permissions, enabling local information disclosure with no extra privileges. The issue is categorized as a Framework component vulnerability (Polic...

CVE-2022-20284

CVE-2022-20284 affects Android 13 Telephony. A missing permission check enables local information disclosure of phone accounts; no user interaction is required. Exploitation requires user privileges (LOW) and local access (UI:N). Impact is confined to confidentiality (HIGH); integrity/availabilit...

CVE-2022-20298

CVE-2022-20298 affects Android 13 ContentService. The issue stems from a missing permission check in ContentService, enabling an attacker to determine whether an account exists on the device and potentially disclose local information. Exploitation is local and does not require user interaction, w...

CVE-2022-20318

CVE-2022-20318 affects Google's Android 13, specifically the PackageInstaller component. The issue arises from a side-channel information disclosure that allows a local attacker to determine whether an app is installed without any query permissions. Exploitation does not require user interaction,...

CVE-2022-20332

CVE-2022-20332 affects Android 13 and involves the PackageManager. The issue allows an app to infer whether another app is installed via a side-channel information disclosure, resulting in local information disclosure without extra execution privileges. Exploitation is described as local with no ...

CVE-2022-20340

CVE-2022-20340 affects Android 13 with a missing permission check in SELinux policy that can let a local attacker infer which websites are opened in the browser, causing a local information disclosure without additional privileges or user interaction. Root cause: improper SELinux policy allows in...

CVE-2022-21792

CVE-2022-21792 affects the camera ISP in MediaTek devices, with an out-of-bounds write caused by a missing bounds check. The vulnerability can allow local escalation of privilege with System execution privileges, and requires no user interaction to exploit. A patch is available under patch ID ALP...

CVE-2022-26432

CVE-2022-26432 affects MediaTek-based devices where a mailbox out-of-bounds write due to a missing bounds check can enable local privilege escalation with System privileges. Public details consistently describe the issue without user interaction; no exploit details are provided in the documents. ...

CVE-2022-30723

CVE-2022-30723 affects Samsung Mobile devices with Bluetooth prior to SMR Jun-2022 Release 1. The root cause is a broadcast of a BluetoothDevice object via activateVoiceRecognitionWithDevice without proper receiver restrictions, leading to leakage of the connected device’s MAC address. Impact is ...

CVE-2022-30728

CVE-2022-30728 describes an information-disclosure vulnerability affecting Samsung ScanPool prior to SMR Jun-2022 Release 1, enabling a local attacker to obtain MAC address information. The issue is a local-privilege/misconfiguration type exposure within ScanPool, with no broader impact described...

CVE-2022-30754

Summary: CVE-2022-30754 describes an implicit intent hijacking vulnerability in Samsung AppLinker. The issue allows an attacker to launch certain activities with the privileges of AppLinker due to insufficient restrictions on implicit intents. Affected component: Samsung AppLinker (on Samsung mob...

CVE-2022-30756

The CVE-2022-30756 entry describes an implicit Intent hijacking flaw in Samsung Finder prior to the SMR July 2022 Release 1. The underlying issue is that implicit intent invocation allows unrestrained recipients, enabling an attacker to launch certain Finder-privileged activities. Impact is descr...

CVE-2022-32613

CVE-2022-32613 affects the vcu component. A race condition can cause memory corruption, enabling local privilege escalation with SYSTEM execution privileges and no user interaction required. The exploitation vector/status is not detailed in the provided documents, but a patch is identified (ALPS0...

CVE-2022-32617

CVE-2022-32617 affects the typec component in affected MediaTek hardware. The root cause is an out-of-bounds write caused by an incorrect buffer-size calculation, enabling local privilege escalation for an attacker with physical access and no extra privileges or user interaction required. The vul...

CVE-2022-32623

CVE-2022-32623 concerns the mdp component, with an out-of-bounds write caused by incorrect error handling. The issue can enable local escalation of privilege with system execution privileges required, and does not require user interaction to exploit. The patch reference provided is ALPS07342114 (...

CVE-2022-33691

The CVE-2022-33691 entry describes a race-condition vulnerability in Samsung Mobile’s score driver (prior to SMR Jul-2022 Release 1). The issue stems from insufficient synchronization points, enabling local attackers to interleave malicious operations. Impact indicators in the sources point to lo...

CVE-2022-33697

CVE-2022-33697 corresponds to a local information-disclosure vulnerability in Samsung ImsCore, specifically ImsServiceSwitchBase, where IMSI can be exposed via device logs. Affected software: ImsCore prior to SMR Jul-2022 Release 1. Root cause: failure to protect sensitive information in logs; re...

CVE-2022-33701

KnoxCustomManagerService on Samsung devices is affected by an improper access control vulnerability prior to SMR Jul-2022 Release 1, allowing an attacker to invoke PowerManaer.goToSleep by sending a broadcast intent despite the method being protected by system permissions. Root cause: lack of pro...

CVE-2022-36855

CVE-2022-36855 is a use-after-free vulnerability in the iva_ctl driver, present in versions prior to Samsung SMR Sep-2022 Release 1. The issue allows a local attacker with low privileges and no user interaction to trigger memory access faults (per CVSS, high impact on confidentiality, integrity, ...

CVE-2022-36868

The issue in CVE-2022-36868 affects Samsung Mobile devices with the MouseNKeyHidDevice before SMR Oct-2022 Release 1. The root cause is an improper restriction of broadcasting an Intent, which leaks the MAC address of the connected Bluetooth device. Impact is limited to exposure of MAC address; n...

CVE-2022-39086

CVE-2022-39086 affects network services with a missing permission check that can enable local privilege escalation requiring system execution privileges. Multiple connected sources associate this issue with UNISOC chipset/network services, indicating the root cause is lack of privilege checking. ...

CVE-2022-39108

CVE-2022-39108 affects the Music service: a missing permission check is the root cause, enabling elevation of privilege with no extra execution privileges required. According to the available data, the exploit is local with low privileges required and no user interaction, and the CVSSv3.1 base sc...