CVE-2019-2150

CVE-2019-2150 affects the libxaac library used in Android 10. The issue is an out-of-bounds read caused by a missing bounds check, leading to information disclosure. Exploitation requires user interaction. Multiple connected sources (Red Hat, CNVD, CVE listings) describe the same root cause in li...

CVE-2019-9321

CVE-2019-9321 affects the Android 10 stack via the libavc library, where a missing variable initialization in libavc could allow information disclosure. The vulnerability reportedly requires user interaction to be exploited and would impact confidentiality (partial). The connected Red Hat entry a...

CVE-2019-9330

CVE-2019-9330 affects Android 10 in Bluetooth, where an out-of-bounds read due to a missing bounds check could enable remote information disclosure without user interaction. The issue is cataloged across multiple sources (NVD, Red Hat, CVE listing) with CVSSv3.1 base score 7.5 (HIGH) and CVSSv2 5...

CVE-2019-9368

CVE-2019-9368 affects Android 10's Bluetooth stack, where a missing bounds check enables a local information-disclosure via an out-of-bounds read. Impact: partial confidentiality loss with no exploitation privileges or user interaction required. Affected product: Android 10 (Android ID A-79883568...

CVE-2019-9429

CVE-2019-9429 affects the profman component in Android 10. The issue is a memory corruption–related out-of-bounds write that could enable local privilege escalation with no user interaction. Exploitation is described as local; no remote/vector details are provided. Mitigation: apply Android 10 se...

CVE-2020-0008

CVE-2020-0008 affects Android 8.0–10 and is described as a race-condition in LowEnergyClient::MtuChangedCallback that can cause an out-of-bounds read. The issue enables local information disclosure without requiring user interaction or additional privileges. The vulnerability is documented across...

CVE-2020-0020

CVE-2020-0020 affects the Android 10 ExifInterface.getAttributeRange implementation. The issue is an incorrect bounds check in redacting location metadata from media files, enabling local information disclosure with no user interaction required (privileges: none; attack vector: LOCAL; CVSS v3.1 b...

CVE-2020-0101

CVE-2020-0101 affects Android devices (Android 8.0–10) and is linked to the BnCrypto::onTransact path in ICrypto.cpp. The vulnerability is an information disclosure due to uninitialized data, enabling local information exposure with system privileges, and requires no user interaction. Public docu...

CVE-2020-0201

CVE-2020-0201 affects Android 10 with a vulnerability in WifiConfigController.java (showSecurityFields) that can leak credentials due to a confused deputy, enabling remote elevation of privilege without additional privileges or user interaction. The issue is documented in multiple sources; applic...

CVE-2020-0267

CVE-2020-0267 affects Android 11 WindowManager. The issue allows a local attacker to trigger the launch of a malicious app due to a confused deputy, causing elevation of privilege without extra execution privileges, with user interaction required for exploitation. Affected component is WindowMana...

CVE-2020-13831

CVE-2020-13831 affects Samsung mobile devices running O(8.x) and P(9.0) on Exynos 7570. The vulnerability stems from the Trustonic Kinibi component, which allows arbitrary memory mapping. This yields high-severity impact (partial confidentiality, integrity, and availability; in NVD, CVSSv3.1 base...

CVE-2020-13836

CVE-2020-13836 affects Samsung mobile devices running O(8.x), P(9.0), and Q(10.0). A path traversal vulnerability exists in the HWRResProvider that can lead to data exposure. This is documented across multiple sources (including NVD, Red Hat, CNVD, CVE lists) with the Samsung ID SVE-2020-16954. T...

CVE-2020-13837

CVE-2020-13837 concerns Samsung mobile devices running Q(10.0). The issue is that the Lockscreen does not block access to Music Share via the Quick Panel, allowing potential exposure of Music Share controls or data when the device is locked. The Samsung Internal ID is SVE-2020-17145 (June 2020). ...

CVE-2020-26598

CVE-2020-26598 affects LG mobile devices running Android 8.0–9.0, with the issue in the Network Management component. The root cause is described as a vulnerability that could allow an unauthorized actor to terminate (kill) an established TCP connection. CVSS metrics indicate a network vector wit...

CVE-2021-0362

CVE-2021-0362 affects Android 11 as described across multiple sources. The vulnerability is a memory corruption via a stack buffer overflow in the aee component, enabling local privilege escalation with System-level execution privileges. Exploitation does not require user interaction. Patch ALPS0...

CVE-2021-0366

In CVE-2021-0366, the vulnerability affects Android devices (Android-10 and Android-11) due to a memory corruption in the vpu caused by a race condition. This leads to local privilege escalation with System privileges required, and exploitation does not require user interaction. The vulnerability...

CVE-2021-0404

CVE-2021-0404 concerns MediaTek’s mobile_log_d on Android 11, where an input validation error can enable local information disclosure. The Red Hat entry and multiple aggregated sources confirm that exploitation does not require user interaction, but the impact involves potential disclosure of sen...

CVE-2021-0405

CVE-2021-0405 affects Android 10 and Android 11, where the MediaTek performance driver’s out-of-bounds write stems from a missing bounds check in the driver code. This can permit local escalation of privilege to System execution level without user interaction, as described in multiple sources (in...

CVE-2021-25449

The CVE-2021-25449 entry describes an improper input validation in the libsapeextractor library prior to SMR Sep-2021 Release 1, which can lead to arbitrary code execution in the mediaextractor process. The vulnerability is documented across multiple feeds (including Samsung, Red Hat, NVD) and is...

CVE-2021-25460

CVE-2021-25460 affects BlockchainTZService, where an improper access control in the sspExit() function could allow an attacker to terminate the service. The issue is limited to BlockchainTZService prior to SMR Sep-2021 Release 1. Impact is service termination (availability). Remediation: upgrade ...

CVE-2021-25480

CVE-2021-25480 describes a vulnerability in the GUTI REALLOCATION COMMAND handling within Qualcomm modems, where a lack of replay attack protection before Samsung’s SMR Oct-2021 Release 1 could enable remote denial of service on the mobile network connection. The issue is tied to Qualcomm modem p...

CVE-2022-20012

CVE-2022-20012 affects the mdp driver and describes memory corruption caused by an integer overflow, enabling local privilege escalation without requiring user interaction. Multiple sources (NVD, Red Hat, CVE records) consistently cite the issue and a patch identified as ALPS05836478. The exploit...

CVE-2022-20291

CVE-2022-20291 affects Android 13 (AppOpsService) and enables a side-channel to determine whether an app is installed without query permissions, leading to local information disclosure with no user interaction. No exploit code is provided in the documents. Android 13 security notes indicate fixes...

CVE-2022-20293

CVE-2022-20293 affects Android 13 LauncherApps: a side-channel disclosure lets a local attacker determine whether an app is installed without query permissions, enabling local information disclosure with no execution privileges and no user interaction. Affected component: LauncherApps; root cause...

CVE-2022-20308

CVE-2022-20308 affects hostapd in Android 13, where an insecure default value in hostapd leads to remote denial of service of the Wi‑Fi hotspot without extra privileges or user interaction. The issue is described as an insecure configuration default that can be exploited remotely to cause DoS. Pu...

CVE-2022-26429

CVE-2022-26429 concerns a missing permission check in the cta component, enabling an app to write permission usage records. This constitutes a local privilege escalation vulnerability with a LOCAL attack vector, LOW privileges required, and NO user interaction needed. The NVD entry cites a patch ...

CVE-2022-26470

The CVE-2022-26470 issue affects the aie module in MediaTek chips. It is an out-of-bounds write caused by an incorrect bounds check, enabling local privilege escalation to System level with no user interaction required. A patch is identified as ALPS07116037 (Issue ALPS07116037).

CVE-2022-32640

CVE-2022-32640 concerns MediaTek Meta WiFi with an out-of-bounds write caused by a missing bounds check. The vulnerability enables local privilege escalation with SYSTEM level execution privileges required; no user interaction is needed. Connected documents confirm affected component is Meta WiFi...

CVE-2022-32641

CVE-2022-32641 affects Meta Wifi implementations in MediaTek chipsets, with an out-of-bounds read caused by a missing bounds check. This can enable local escalation of privilege with System execution privileges required; exploitation reportedly does not require user interaction. The patch referen...

CVE-2022-32652

CVE-2022-32652 (mtk-aie) : A use-after-free due to a logic error in MediaTek mtk-aie could allow local escalation to SYSTEM privileges with no user interaction required. Affected component: mtk-aie (MediaTek) with a local-exploit path implied by the CVE description. Public details in connected do...

CVE-2022-36860

The CVE-2022-36860 entry concerns a heap-based overflow in the LoadEnvironment function of the libSDKRecognitionText.spensdk.samsung.so library. Affected component: libSDKRecognitionText.spensdk.samsung.so; vulnerability type: heap-based overflow in LoadEnvironment; root cause: memory access faul...

CVE-2022-38671

The CVE-2022-38671 entry concerns a vulnerability in the UNISOC camera driver where a missing bounds check enables an out-of-bounds write, potentially causing a local denial of service in the kernel. The NVD description confirms the issue as an out-of-bounds write in the camera driver with local ...

CVE-2022-38674

The CVE-2022-38674 entry concerns a vulnerability in the wlan driver where a missing parameters check can allow a local denial of service against wlan services. Affected component: wlan driver (and associated Qualcomm wlan context in several records). Root cause: insufficient input/parameter vali...

CVE-2022-38678

CVE-2022-38678 describes a missing permission check in the contacts service that could lead to a local denial-of-service without requiring additional privileges. The vulnerability affects the contacts service component and is characterized by a local attack vector with low attack complexity and l...

CVE-2022-39098

The CVE-2022-39098 entry details a vulnerability in the power management service where a missing permission check could allow an attacker to set up the power management service without requiring additional execution privileges. Judging from the connected records, the issue is assigned a CVSS v3.1...

CVE-2022-39107

CVE-2022-39107 affects the Soundrecorder service (UNISOC-based devices per CNNVD/Red Hat lists) and is caused by a missing permission check, enabling local privilege escalation with low privileges and no user interaction. The NVD/PRION/CNNVD entries describe elevation of privilege without requiri...

CVE-2022-39905

CVE-2022-39905 is an implicit intent hijacking vulnerability in the Samsung Telecom application prior to the SMR-DEC-2022 Release 1. The fault is a misused implicit intent that allows an attacker to access sensitive information via intents, with impact described as confidential data exposure and ...

CVE-2022-42759

CVE-2022-42759 affects the wlan driver, where a missing bounds check in the driver could allow a local denial of service in wlan services. The Red Hat and NVD entries corroborate the description; no concrete exploit details are provided in the connected documents. The PT-Security entry notes the ...

CVE-2022-42776

CVE-2022-42776 affects the UscAIEngine service, with a missing permission check that could allow setting up the service without requiring additional execution privileges. The issue is described consistently across NVD/Red Hat records and related feeds as a privilege-check bypass within the UscAIE...

CVE-2022-44442

The CVE-2022-44442 entry concerns the WLAN driver, where a missing bounds check in the WLAN driver could allow local denial of service in WLAN services. This risk is supported by multiple sources (NVD text reiterates the local DoS outcome; Red Hat and others describe the same bound-check issue in...

CVE-2022-44446

CVE-2022-44446 affects the WLAN driver, with the root cause described as a missing bounds check in the wlan driver. The practical impact stated across sources is a local denial of service in WLAN services. No exploit details, affected product versions, or remediation steps are provided in the con...

CVE-2022-47333

The CVE-2022-47333 entry concerns a vulnerability in the wlan driver where a missing permission check could enable local information disclosure. Affected component: WLAN driver; root cause: insufficient permission validation. Impact: local information disclosure (confidentiality impact high; inte...

CVE-2022-47341

The CVE-2022-47341 entry describes a vulnerability in engineermode services with a missing permission check that could allow local escalation of privilege to system execution privileges. Affected component: engineermode services. Root cause: inadequate permission validation leading to privilege e...

CVE-2022-47351

CVE-2022-47351 affects the camera driver and involves a missing bounds check that enables an out-of-bounds read. This can lead to a local denial of service with System execution privileges required. The issue is documented across NVD/Red Hat databases with a CVSS v3.1 base score of 4.4 (MEDIUM) a...

CVE-2022-47355

CVE-2022-47355 is described across multiple sources as a missing permission check in a log service that could allow local denial of service. The primary affected component appears to be the log service, with the root cause stated as insufficient permission validation. Reported impact is local den...

CVE-2022-47365

CVE-2022-47365 relates to a missing bounds check in the wlan driver that can cause an out-of-bounds write, leading to local denial of service in wlan services. Affected component: wlan driver (specific products/versions not enumerated in the provided documents). Root cause: missing bounds check e...

CVE-2022-47473

CVE-2022-47473 affects the telephony service (telephony module) where a missing permission check can lead to local information disclosure without requiring additional privileges. Multiple sources (Red Hat, NVD, CVE List, and UNISOC/CNNVD summaries) describe the same root cause and impact, with th...

CVE-2022-48235

The CVE-2022-48235 issue concerns the UNISOC MP3 encoder in chipsets, where a missing bounds check can cause an out-of-bounds write. This leads to a local denial of service with System execution privileges required. Affected component: MP3 encoder; root cause: missing bounds check leading to out-...

CVE-2022-48371

CVE-2022-48371 concerns UNISOC dialer service vulnerability due to a missing privilege check. The linked documents confirm the issue affects UNISOC chipsets’ dialer service module and enables local information disclosure without additional execution privileges. The CVSS 3.1 vector (AV:L/AC:L/PR:L...

CVE-2023-20630

CVE-2023-20630 affects the USB module on MediaTek chips. Root cause: a missing bounds check causing an out-of-bounds write. Impact: local escalation of privilege with System execution privileges required; no user interaction needed. Public exploitation details are not provided in the documents. R...