CVE-2020-0201

CVE-2020-0201 affects Android 10 with a vulnerability in WifiConfigController.java (showSecurityFields) that can leak credentials due to a confused deputy, enabling remote elevation of privilege without additional privileges or user interaction. The issue is documented in multiple sources; applic...

CVE-2020-12754

CVE-2020-12754 affects LG mobile devices running Android 7.2, 8.0, 8.1, 9, and 10. A crafted app can obtain control of device input through the window system service, enabling partial to high impact on confidentiality, integrity, and availability as per CVSS metrics. Root cause centered on window...

CVE-2020-13832

Technical details about CVE-2020-13832 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2020-26601

Technical details about CVE-2020-26601 are not publicly provided in the connected documents. Monitor for updates from Samsung and security advisories.

CVE-2020-27098

CVE-2020-27098 affects Android 11 and targets UriGrantsManagerService.checkGrantUriPermission. The vulnerability describes a permissions bypass that could allow an app to access contacts via a local, privilege-escalation path without user interaction. It is a local information-disclosure issue (c...

CVE-2021-0351

In the Android WLAN driver, CVE-2021-0351 is an out-of-bounds write vulnerability due to a missing bounds check, leading to remote denial of service without user interaction or privileges. Affected products/versions include Android 8.1–11; patch ALPS05412917 is available. Monitor for updates and ...

CVE-2021-0354

CVE-2021-0354: A local privilege-escalation flaw in ged on Android (Android 8.1–11) arises from an out-of-bounds write caused by an integer overflow. The issue allows an attacker with local access to potentially execute with System privileges without user interaction. Affected components are tied...

CVE-2021-0374

CVE-2021-0374 affects Android 11 with a vulnerability in BnAudioPolicyService::onTransact (IAudioPolicyService.cpp) where a missing bounds check allows an out-of-bounds read, enabling local information disclosure with System privileges and no user interaction. Documented impact: confidentiality i...

CVE-2021-0401

Summary: CVE-2021-0401 describes a memory corruption due to a race condition in vow that could enable local privilege escalation to SYSTEM on Android devices (Android-10/Android-11). The issue is triggered by a race in vow’s handling, requiring user interaction for exploitation. The patches refer...

CVE-2021-0405

CVE-2021-0405 affects Android 10 and Android 11, where the MediaTek performance driver’s out-of-bounds write stems from a missing bounds check in the driver code. This can permit local escalation of privilege to System execution level without user interaction, as described in multiple sources (in...

CVE-2021-0451

In CVE-2021-0451, the Titan M chip firmware contains an issue where uninitialized data can disclose stack memory, enabling local information disclosure with System execution privileges. The impact is described as requiring no user interaction. Affected software areas include the Titan M component...

CVE-2021-0663

CVE-2021-0663 describes an out-of-bounds write in the Mediatek audio DSP caused by an incorrect bounds check. Affects MediaTek DSP firmware across multiple MT chipsets and Android versions (9.0–11.0) with potential for local privilege escalation to System execution privileges, without user intera...

CVE-2021-25461

CVE-2021-25461 concerns a stack-based buffer overflow caused by an improper length check in APAService prior to Samsung SMR Sep-2021 Release 1. The vulnerability affects the APAService component and has documented impact in CVSS: CVSSv3.1 base score 7.8 (HIGH) with LOCAL attack vector, LOW attack...

CVE-2022-20016

The CVE-2022-20016 issue affects the vow driver, where improper locking leads to memory corruption. This results in local privilege escalation to System level with no user interaction required. Public details consistently state the impact as local elevation of privilege and (in CVSS terms) high i...

CVE-2022-20265

CVE-2022-20265 concerns Android 13 where the Settings component allows a permissions bypass that can lead to local elevation of privilege with physical access and no user interaction. Affected product: Android 13 (Settings). Root cause: a permissions bypass in the Settings flow that bypasses fact...

CVE-2022-20267

The CVE-2022-20267 issue affects Android 13’s Bluetooth implementation. It arises from a missing permission check that could allow enabling or disabling Bluetooth connections without user consent, enabling local elevation of privilege with no user interaction required. Affected component: Bluetoo...

CVE-2022-20293

CVE-2022-20293 affects Android 13 LauncherApps: a side-channel disclosure lets a local attacker determine whether an app is installed without query permissions, enabling local information disclosure with no execution privileges and no user interaction. Affected component: LauncherApps; root cause...

CVE-2022-20303

CVE-2022-20303 (Android 13) in ContentService: a missing permission check allows an account-detection information disclosure without GET_ACCOUNTS permission. Local attacker with low privileges and no user interaction can reveal whether an account exists on the device. Mitigation is included in An...

CVE-2022-26450

CVE-2022-26450 affects MediaTek Apusys. The vulnerability is a use-after-free caused by a race condition in apusys that can lead to local escalation of privileges with System execution privileges required; exploitation does not require user interaction. The issue is documented across multiple sou...

CVE-2022-26451

In ged, a use-after-free due to improper locking is described, enabling local escalation to SYSTEM privileges with no user interaction required. Patch ID ALPS07202966 (Issue ALPS07202966) is noted as the remediation; exploitation status is not detailed in the provided documents.

CVE-2022-32605

CVE-2022-32605 affects MediaTek’s isp (MediaTek ISP) with an out-of-bounds write caused by an incorrect bounds check. This could allow local escalation to System privileges without user interaction. Patch: ALPS07213898 (Issue ALPS07213898) is referenced; exploitation status is not provided in the...

CVE-2022-32629

CVE-2022-32629 affects the isp component and is caused by a missing bounds check that enables an out-of-bounds write. This can lead to local escalation of privilege with system execution privileges required; exploitation does not require user interaction. The entry lists a patch reference: ALPS07...

CVE-2022-36858

CVE-2022-36858 is a heap-based overflow in GetCorrectDbLanguageTypeEsPKc() within libSDKRecognitionText.spensdk.samsung.so, affecting Samsung devices prior to SMR Sep-2022 Release 1. The vulnerability can cause a memory access fault due to heap overflow in the affected function. Available documen...

CVE-2022-38677

Summary (CVE-2022-38677) : Multiple sources describe a vulnerability in the cell service caused by a missing permission check, enabling local denial of service without requiring additional privileges. Reported impact is availability degradation; CVSSv3.1 base score ~5.5 (Medium) with local attack...

CVE-2022-39127

The CVE-2022-39127 entry concerns a vulnerability in a sensor driver where a missing bounds check can cause an out-of-bounds write, leading to local denial of service in the kernel. The issue is described across multiple sources (NVD/Red Hat/CNNVD) as affecting the sensor driver (kernel level); C...

CVE-2022-39880

CVE-2022-39880 affects DualOutFocusViewer prior to Samsung SMR Nov-2022 Release 1. Root cause: improper input validation leading to local arbitrary code execution. Impact (per sources): local attacker can execute code with affected privileges; CVSSv3.1 base score 7.8 (HIGH) with LOCAL access, LOW...

CVE-2022-39895

The CVE-2022-39895 entry concerns an improper access control vulnerability in ContactListUtils on Samsung Phone software prior to SMR Dec-2022 Release 1. The issue allows access to contact group information via implicit intents, attributed to the ContactListUtils component. Affected product scope...

CVE-2022-42762

CVE-2022-42762 describes a local denial-of-service vulnerability in the WLAN subsystem due to a missing bounds check in the WLAN driver (UNISOC chipset context appears in multiple sources). The flaw can be triggered locally and could impact WLAN services. Connected sources corroborate the basic i...

CVE-2022-42777

CVE-2022-42777 concerns a missing permission check in the power management service, enabling setup of the service with no additional execution privileges. The issue is described as local attack vector with low attack complexity, requiring low privileges and no user interaction, and it is assessed...

CVE-2022-44421

CVE-2022-44421 concerns a vulnerability in the WLAN driver where a missing permission check could allow local information disclosure. The initial description identifies the issue as a local vulnerability in the WLAN driver with a CVSSv3.1 base score of 5.5 (Impact: Confidentiality High; Attack Ve...

CVE-2022-44441

CVE-2022-44441 affects the WLAN driver with a missing bounds check in the driver code, causing local denial of service in WLAN services. The base CVSS v3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) yields a MEDIUM base score of 5.5. Multiple sources corroborate the description, including Red H...

CVE-2022-47333

The CVE-2022-47333 entry concerns a vulnerability in the wlan driver where a missing permission check could enable local information disclosure. Affected component: WLAN driver; root cause: insufficient permission validation. Impact: local information disclosure (confidentiality impact high; inte...

CVE-2022-47481

CVE-2022-47481 affects the telephony service where a missing permission check can allow a local denial-of-service without requiring extra privileges. The available documents consistently describe this as a local impact (AV:L/PR:L/UI:N) with a high availability impact and no confidentiality/integr...

CVE-2022-48231

Summary (CVE-2022-48231): The vulnerability is described as a missing permission check in the soter service, leading to local denial of service with no additional execution privileges. Public references indicate the issue in the UNISOC/“Soter service” used in chipsets and related Red Hat/NVD reco...

CVE-2022-48233

CVE-2022-48233 involves the FM service (notably in UNISOC Chipsets’ FM service module) with a missing parameters check that can lead to local denial of service. The linked sources consistently describe the issue as a local DoS due to insufficient input validation, with no public details on affect...

CVE-2022-48376

CVE-2022-48376 affects UNISOC chipsets’ dialer service module. The root cause is a missing permission check, which could allow a local attacker to trigger a denial of service without gaining additional execution privileges. The CVE is documented with a CVSS v3.1 base score of 5.5 (Local attack, L...

CVE-2023-20615

CVE-2023-20615 affects MediaTek ril with an out-of-bounds write caused by a missing bounds check, enabling local escalation of privilege with SYSTEM-level execution rights. Exploitation reportedly does not require user interaction. Public references consistently indicate the issue resides in ril ...

CVE-2023-20663

CVE-2023-20663 describes a potential out-of-bounds write in wlan due to an integer overflow, enabling local privilege escalation with System execution privileges required and no user interaction. The vulnerability is tied to a patch ID ALPS07560741 / Issue ID ALPS07560741. Connected sources menti...

CVE-2023-21229

CVE-2023-21229 concerns Google Wear OS (Framework/ManagedServices.java: registerServiceLocked) where an unsafe PendingIntent can bypass background activity launch restrictions. This vulnerability enables local escalation of privilege with no additional privileges and no user interaction required,...

CVE-2023-21293

CVE-2023-21293 affects Android’s PackageManagerNative, enabling a side‑channel check to determine if an app is installed without query permissions. Impact: potential information disclosure leading to local elevation of privilege, with no extra execution privileges and no user interaction required...

CVE-2023-21321

CVE-2023-21321 affects Android's Package Manager, enabling cross-user information disclosure due to a missing permission check. The vulnerability allows local information disclosure with no privileges and no user interaction required. The connected sources list this CVE as part of Android 14 secu...

CVE-2023-21324

CVE-2023-21324 is listed in Android 14 release notes under the Framework section as an elevation-of-privilege (EoP) vulnerability with moderate severity. The exact affected packages/versions are not detailed in the provided sources, but the Android bulletin states these issues are fixed in Androi...

CVE-2023-21335

CVE-2023-21335 affects Android, describing a side-channel in Settings that allows determining if an app is installed without query permissions. The vulnerability enables local information disclosure with no extra privileges and no user interaction required. Connected sources (RH security advisory...

CVE-2023-32827

CVE-2023-32827 concerns the camera middleware in MediaTek devices, where a missing input validation can cause an out-of-bounds write. The vulnerability enables local escalation of privilege with System-level execution privileges; exploitation is reported as not requiring user interaction. Public ...

CVE-2023-32884

In netdagent, the vulnerability is an information disclosure caused by an incorrect bounds check, enabling local escalation of privilege with System-level execution privileges. Affected component: netdagent (no specific versions provided in the connected docs). Impact is described as high for con...

CVE-2023-32889

CVE-2023-32889 affects the Modem IMS Call UA component, where a missing bounds check enables an out-of-bounds write leading to remote denial of service without user interaction. The issue is documented across NVD, Red Hat, PRION, CVE listings, and related advisories, with a patch ID MOLY01161825 ...

CVE-2023-40631

No public technical details are provided in the supplied documents for CVE-2023-40631 beyond the description of a missing permission check in Dialer causing local information disclosure; monitor for updates.

CVE-2023-40648

The CVE-2023-40648 entry concerns the Messaging component where a missing permission check could allow local information disclosure without requiring additional execution privileges. Reported across multiple sources, the issue affects Information Confidentiality (per CVSS) with local attack vecto...

CVE-2023-44128

CVE-2023-44128 affects LGInstallService (com.lge.lginstallservies) on LG devices, where the exported AIDL-based InstallService exposes installPackage* methods that call installPackageVerify() for signature validation after a delete-file operation. An attacker can manipulate conditions so the secu...

CVE-2023-45780

CVE-2023-45780 affects the Android Print Service. The issue stems from a logic error enabling a background activity launch, potentially causing local privilege escalation with no extra execution privileges required beyond user interaction. Documented impact covers confidentiality, integrity, and ...