Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2019-1963
A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, remote attacker to cause the SNMP application on an affected device to restart unexpectedly. The vulnerability is due to improper validation of Abstract Syntax Notation One (ASN.1)-encoded variables in SNMP packets. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the SNMP daemon on the affected device. A successful exploit could allow the attacker to cause the SNMP application to restart multiple times, leading to a system-level restart and a denial of service (DoS) condition.
Affected Products: Cisco Unified Computing System (Managed) 
References: [{'name': '20190828 Cisco FXOS and NX-OS Software Authenticated Simple Network Management Protocol Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-fxnxos-snmp-dos'}]
CVE State: PUBLISHED
Explain CVE-2019-1964
A vulnerability in the IPv6 traffic processing of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an unexpected restart of the netstack process on an affected device. The vulnerability is due to improper validation of IPv6 traffic sent through an affected device. An attacker could exploit this vulnerability by sending a malformed IPv6 packet through an affected device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition while the netstack process restarts. A sustained attack could lead to a reboot of the device.
Affected Products: Cisco NX-OS Software 8.1(1)
References: [{'name': '20190828 Cisco NX-OS Software IPv6 Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-ipv6-dos'}]
CVE State: PUBLISHED
Explain CVE-2019-1965
A vulnerability in the Virtual Shell (VSH) session management for Cisco NX-OS Software could allow an authenticated, remote attacker to cause a VSH process to fail to delete upon termination. This can lead to a build-up of VSH processes that overtime can deplete system memory. When there is no system memory available, this can cause unexpected system behaviors and crashes. The vulnerability is due to the VSH process not being properly deleted when a remote management connection to the device is disconnected. An attacker could exploit this vulnerability by repeatedly performing a remote management connection to the device and terminating the connection in an unexpected manner. A successful exploit could allow the attacker to cause the VSH processes to fail to delete, which can lead to a system-wide denial of service (DoS) condition. The attacker must have valid user credentials to log in to the device using the remote management connection.
Affected Products: Cisco NX-OS Software
References: [{'name': '20190828 Cisco NX-OS Software Remote Management Memory Leak Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-memleak-dos'}]
CVE State: PUBLISHED
Explain CVE-2019-1966
A vulnerability in a specific CLI command within the local management (local-mgmt) context for Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to gain elevated privileges as the root user on an affected device. The vulnerability is due to extraneous subcommand options present for a specific CLI command within the local-mgmt context. An attacker could exploit this vulnerability by authenticating to an affected device, entering the local-mgmt context, and issuing a specific CLI command and submitting user input. A successful exploit could allow the attacker to execute arbitrary operating system commands as root on an affected device. The attacker would need to have valid user credentials for the device.
Affected Products: Cisco Unified Computing System (Managed) 
References: [{'name': '20190828 Cisco Unified Computing System Fabric Interconnect root Privilege Escalation Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-ucs-privescalation'}]
CVE State: PUBLISHED
Explain CVE-2019-1967
A vulnerability in the Network Time Protocol (NTP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to excessive use of system resources when the affected device is logging a drop action for received MODE_PRIVATE (Mode 7) NTP packets. An attacker could exploit this vulnerability by flooding the device with a steady stream of Mode 7 NTP packets. A successful exploit could allow the attacker to cause high CPU and memory usage on the affected device, which could cause internal system processes to restart or cause the affected device to unexpectedly reload. Note: The NTP feature is enabled by default.
Affected Products: Cisco NX-OS Software
References: [{'name': '20190828 Cisco NX-OS Software Network Time Protocol Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-ntp-dos'}]
CVE State: PUBLISHED
Explain CVE-2019-1968
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly restart. The vulnerability is due to incorrect validation of the HTTP header of a request that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API on an affected device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition in the NX-API service; however, the NX-OS device itself would still be available and passing network traffic. Note: The NX-API feature is disabled by default.
Affected Products: Cisco NX-OS Software 6.0(2)A4(1)
References: [{'name': '20190828 Cisco NX-OS Software NX-API Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-api-dos'}]
CVE State: PUBLISHED
Explain CVE-2019-1969
A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) Access Control List (ACL) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to perform SNMP polling of an affected device, even if it is configured to deny SNMP traffic. The vulnerability is due to an incorrect length check when the configured ACL name is the maximum length, which is 32 ASCII characters. An attacker could exploit this vulnerability by performing SNMP polling of an affected device. A successful exploit could allow the attacker to perform SNMP polling that should have been denied. The attacker has no control of the configuration of the SNMP ACL name.
Affected Products: Cisco NX-OS Software
References: [{'name': '20190828 Cisco NX-OS Software SNMP Access Control List Configuration Name Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-snmp-bypass'}]
CVE State: PUBLISHED
Explain CVE-2019-1970
A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the configured file policies on an affected system. The vulnerability is due to errors when handling specific SSL/TLS messages. An attacker could exploit this vulnerability by sending crafted HTTP packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured file policies and deliver a malicious payload to the protected network.
Affected Products: Cisco Firepower Threat Defense Software 
References: [{'name': '20190807 Cisco Firepower Threat Defense Software File Policy Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-ftd-bypass'}]
CVE State: PUBLISHED
Explain CVE-2019-1971
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command injection attack and execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the web portal framework. An attacker could exploit this vulnerability by providing malicious input during web portal authentication. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system.
Affected Products: Cisco Enterprise NFV Infrastructure Software 
References: [{'name': '20190807 Cisco Enterprise NFV Infrastructure Software Command Injection Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-commandinj'}]
CVE State: PUBLISHED
Explain CVE-2019-1972
A vulnerability the Cisco Enterprise NFV Infrastructure Software (NFVIS) restricted CLI could allow an authenticated, local attacker with valid administrator-level credentials to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An attacker could exploit this vulnerability by leveraging the insufficient restrictions during the execution of an affected command. A successful exploit could allow the attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root.
Affected Products: Cisco Enterprise NFV Infrastructure Software 
References: [{'name': '20190807 Cisco Enterprise NFV Infrastructure Software Privilege Escalation Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-privescal'}]
CVE State: PUBLISHED
Explain CVE-2019-1973
A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to improper input validation of log file content stored on the affected device. An attacker could exploit this vulnerability by modifying a log file with malicious code and getting a user to view the modified log file. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive, browser-based information.
Affected Products: Cisco Enterprise NFV Infrastructure Software 
References: [{'name': '20190807 Cisco Enterprise NFV Infrastructure Software Cross-site Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-xss'}]
CVE State: PUBLISHED
Explain CVE-2019-1974
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass user authentication and gain access as an administrative user. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to gain full administrative access to the affected device.
Affected Products: Cisco Unified Computing System Director 
References: [{'name': '20190821 Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-authbypass'}]
CVE State: PUBLISHED
Explain CVE-2019-1975
A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack on an affected device. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user to an attacker-controlled web page that contains a malicious HTML iframe. A successful exploit could allow the attacker to conduct clickjacking or other clientside browser attacks.
Affected Products: Cisco HyperFlex HX-Series 
References: [{'name': '20190918 Cisco HyperFlex Software Cross-Frame Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190918-hyperflex-xfs'}]
CVE State: PUBLISHED
Explain CVE-2019-1976
A vulnerability in the &ldquo;plug-and-play&rdquo; services component of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper access restrictions on the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access running configuration information about devices managed by the IND, including administrative credentials.
Affected Products: Cisco Industrial Network Director 
References: [{'name': '20190904 Cisco Industrial Network Director Configuration Data Information Disclosure Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-ind'}]
CVE State: PUBLISHED
Explain CVE-2019-1977
A vulnerability within the Endpoint Learning feature of Cisco Nexus 9000 Series Switches running in Application Centric Infrastructure (ACI) mode could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an endpoint device in certain circumstances. The vulnerability is due to improper endpoint learning when packets are received on a specific port from outside the ACI fabric and destined to an endpoint located on a border leaf when Disable Remote Endpoint Learning has been enabled. This can result in a Remote (XR) entry being created for the impacted endpoint that will become stale if the endpoint migrates to a different port or leaf switch. This results in traffic not reaching the impacted endpoint until the Remote entry can be relearned by another mechanism.
Affected Products: Cisco Nexus 9000 Series Fabric Switches in ACI
References: [{'name': '20190828 Cisco Nexus 9000 Series Fabric Switches ACI Mode Border Leaf Endpoint Learning Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nexus-aci-dos'}]
CVE State: PUBLISHED
Explain CVE-2019-1978
A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to improper reassembly of traffic streams. An attacker could exploit this vulnerability by sending crafted streams through an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious requests to protected systems that would otherwise be blocked.
Affected Products: Cisco Firepower Threat Defense Software 
References: [{'name': '20190816 Cisco Firepower Threat Defense Software Stream Reassembly Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190816-ftd-srb'}]
CVE State: PUBLISHED
Explain CVE-2019-1980
A vulnerability in the protocol detection component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to improper detection of the initial use of a protocol on a nonstandard port. An attacker could exploit this vulnerability by sending traffic on a nonstandard port for the protocol in use through an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious requests to protected systems that would otherwise be blocked. Once the initial protocol flow on the nonstandard port is detected, future flows on the nonstandard port will be successfully detected and handled as configured by the applied policy.
Affected Products: Cisco Firepower Threat Defense Software 
References: [{'name': '20190816 Cisco Firepower Threat Defense Software Nonstandard Protocol Detection Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190816-ftd-nspd'}]
CVE State: PUBLISHED
Explain CVE-2019-1981
A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to insufficient normalization of a text-based payload. An attacker could exploit this vulnerability by sending traffic that contains specifically obfuscated payloads through an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious payloads to protected systems that would otherwise be blocked.
Affected Products: Cisco Firepower Threat Defense Software 
References: [{'name': '20190816 Cisco Firepower Threat Defense Software NULL Character Obfuscation Detection Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190816-ftd-null'}]
CVE State: PUBLISHED
Explain CVE-2019-1982
A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to improper handling of HTTP requests, including those communicated over a secure HTTPS connection, that contain maliciously crafted headers. An attacker could exploit this vulnerability by sending malicious requests to an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious requests to protected systems, allowing attackers to deliver malicious content that would otherwise be blocked.
Affected Products: Cisco Firepower Management Center 
References: [{'name': '20190816 Cisco Firepower Threat Defense Software HTTP Filtering Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190816-ftd-http'}]
CVE State: PUBLISHED
Explain CVE-2019-1983
A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to cause repeated crashes in some internal processes that are running on the affected devices, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient input validation of email attachments. An attacker could exploit this vulnerability by sending an email message with a crafted attachment through an affected device. A successful exploit could allow the attacker to cause specific processes to crash repeatedly, resulting in the complete unavailability of both the Cisco Advanced Malware Protection (AMP) and message tracking features and in severe performance degradation while processing email. After the affected processes restart, the software resumes filtering for the same attachment, causing the affected processes to crash and restart again. A successful exploit could also allow the attacker to cause a repeated DoS condition. Manual intervention may be required to recover from this situation.
Affected Products: Cisco Email Security Appliance (ESA) 
References: [{'name': '20200219 Cisco Email Security Appliance and Cisco Content Security Management Appliance Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-esa-sma-dos'}]
CVE State: PUBLISHED
Explain CVE-2019-1984
A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrite files on the underlying operating system (OS) of an affected device. The vulnerability is due to improper input validation in an NFVIS file-system command. An attacker could exploit this vulnerability by using crafted variables during the execution of an affected command. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying OS.
Affected Products: Cisco Enterprise NFV Infrastructure Software 
References: [{'name': '20190821 Cisco Enterprise Network Functions Virtualization Infrastructure Software Arbitrary File Write Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-nfv-filewrite'}]
CVE State: PUBLISHED
Explain CVE-2019-1985
In findAvailSpellCheckerLocked of TextServicesManagerService.java, there is a possible way to bypass the warning dialog when selecting an untrusted spell checker due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0Android ID: A-118694079
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2019-03-01'}]
CVE State: PUBLISHED
Explain CVE-2019-1986
In SkSwizzler::onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege in system_server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-117838472.
Affected Products: Android
References: [{'name': '106842', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106842'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2019-02-01'}]
CVE State: PUBLISHED
Explain CVE-2019-1987
In onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-118143775.
Affected Products: Android
References: [{'name': '106842', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106842'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2019-02-01'}]
CVE State: PUBLISHED
Explain CVE-2019-1988
In sample6 of SkSwizzler.cpp, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution in system_server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-118372692.
Affected Products: Android
References: [{'name': '106842', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106842'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2019-02-01'}]
CVE State: PUBLISHED
Explain CVE-2019-1989
In ih264d_fmt_conv_420sp_to_420p of ih264d_format_conv.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-118399205
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2019-03-01'}]
CVE State: PUBLISHED
Explain CVE-2019-1990
In ihevcd_fmt_conv_420sp_to_420p of ihevcd_fmt_conv.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-118453553
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2019-03-01'}]
CVE State: PUBLISHED
Explain CVE-2019-1991
In btif_dm_data_copy of btif_core.cc, there is a possible out of bounds write due to a buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-110166268.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2019-02-01'}, {'name': '106946', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106946'}]
CVE State: PUBLISHED
Explain CVE-2019-1992
In bta_hl_sdp_query_results of bta_hl_main.cc, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-116222069.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2019-02-01'}, {'name': '106946', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106946'}]
CVE State: PUBLISHED
Explain CVE-2019-1993
In register_app of btif_hd.cc, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-119819889.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2019-02-01'}, {'name': '106946', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106946'}]
CVE State: PUBLISHED
Explain CVE-2019-1994
In refresh of DevelopmentTiles.java, there is the possibility of leaving development settings accessible due to an insecure default value. This could lead to unwanted access to development settings, with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-117770924.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2019-02-01'}, {'name': '106946', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106946'}]
CVE State: PUBLISHED
Explain CVE-2019-1995
In ComposeActivityEmail of ComposeActivityEmail.java, there is a possible way to silently attach files to an email due to a confused deputy. This could lead to local information disclosure, sending files accessible to AOSP Mail to a remote email recipient, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-32589229.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2019-02-01'}, {'name': '106946', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106946'}]
CVE State: PUBLISHED
Explain CVE-2019-1996
In avrc_pars_browse_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-111451066.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2019-02-01'}, {'name': '106946', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106946'}]
CVE State: PUBLISHED
Explain CVE-2019-1997
In random_get_bytes of random.c, there is a possible degradation of randomness due to an insecure default value. This could lead to local information disclosure via an insecure wireless connection with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-117508900.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2019-02-01'}, {'name': '106946', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106946'}]
CVE State: PUBLISHED
Explain CVE-2019-1998
In event_handler of keymaster_app.c, there is possible resource exhaustion due to a table being lost on reboot. This could lead to local denial of service that is not fixed by a factory reset, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116055338.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2019-02-01'}, {'name': '106946', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106946'}]
CVE State: PUBLISHED
Explain CVE-2019-1999
In binder_alloc_free_page of binder_alloc.c, there is a possible double free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-120025196.
Affected Products: Android
References: [{'name': '106851', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106851'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2019-02-01'}, {'name': '46357', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/46357/'}, {'name': 'USN-3979-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3979-1/'}, {'name': 'DSA-4495', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2019/dsa-4495'}, {'name': '20190812 [SECURITY] [DSA 4495-1] linux security update', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'https://seclists.org/bugtraq/2019/Aug/13'}]
CVE State: PUBLISHED
Explain CVE-2020-0001
In getProcessRecordLocked of ActivityManagerService.java isolated apps are not handled correctly. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0, Android-8.1, Android-9, and Android-10 Android ID: A-140055304
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2020-01-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0002
In ih264d_init_decoder of ih264d_api.c, there is a possible out of bounds write due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation Product: Android Versions: Android-8.0, Android-8.1, Android-9, and Android-10 Android ID: A-142602711
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2020-01-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0003
In onCreate of InstallStart.java, there is a possible package validation bypass due to a time-of-check time-of-use vulnerability. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.0 Android ID: A-140195904
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2020-01-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0004
In generateCrop of WallpaperManagerService.java, there is a possible sysui crash due to image exceeding maximum texture size. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-120847476
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2020-01-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0005
In btm_read_remote_ext_features_complete of btm_acl.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-141552859
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-02-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0006
In rw_i93_send_cmd_write_single_block of rw_i93.cc, there is a possible information disclosure of heap memory due to uninitialized data. This could lead to remote information disclosure in the NFC server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.0, Android-8.1, Android-9, and Android-10 Android ID: A-139738828
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2020-01-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0007
In flattenString8 of Sensor.cpp, there is a possible information disclosure of heap memory due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0, Android-8.1, Android-9, and Android-10 Android ID: A-141890807
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2020-01-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0008
In LowEnergyClient::MtuChangedCallback of low_energy_client.cc, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0, Android-8.1, Android-9, and Android-10 Android ID: A-142558228
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2020-01-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0009
In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-142938932
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2020-01-01'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/155903/Android-ashmem-Read-Only-Bypasses.html'}, {'name': '[debian-lts-announce] 20200609 [SECURITY] [DLA 2241-1] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html'}, {'name': '[debian-lts-announce] 20200610 [SECURITY] [DLA 2241-2] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html'}]
CVE State: PUBLISHED
Explain CVE-2020-0010
In fpc_ta_get_build_info of fpc_ta_kpi.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-137014293References: N/A
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-03-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0011
In get_auth_result of fpc_ta_hw_auth.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-137648045References: N/A
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-03-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0012
In fpc_ta_pn_get_unencrypted_image of fpc_ta_pn.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-137648844
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-03-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0014
It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable. This could lead to a local escalation of privilege with no additional execution privileges needed. User action is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-128674520
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-02-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0015
In onCreate of CertInstaller.java, there is a possible way to overlay the Certificate Installation dialog by a malicious application. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139017101
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-02-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0016
In the Broadcom Nexus firmware, there is an insecure default password. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-171413483
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-12-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0017
In multiple places, it was possible for the primary user’s dictionary to be visible to and modifiable by secondary users. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-123232892
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-02-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0018
In MotionEntry::appendDescription of InputDispatcher.cpp, there is a possible log information disclosure. This could lead to local disclosure of user input with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139945049
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-02-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0019
In the Broadcom Nexus firmware, there is an insecure default password. This could lead to local information disclosure in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-171413798
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-12-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0020
In getAttributeRange of ExifInterface.java, there is a possible failure to redact location information from media files due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-143118731
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-02-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0021
In removeUnusedPackagesLPw of PackageManagerService.java, there is a possible permanent denial-of-service due to a missing package dependency test. This could lead to remote denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141413692
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-02-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0022
In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143894715
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-02-01'}, {'name': '20200214 Re: [FD] Critical Bluetooth Vulnerability in Android (CVE-2020-0022) - BlueFrag', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2020/Feb/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/156891/Android-Bluetooth-Remote-Denial-Of-Service.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200513-03-smartphone-en'}]
CVE State: PUBLISHED
Explain CVE-2020-0023
In setPhonebookAccessPermission of AdapterService.java, there is a possible disclosure of user contacts over bluetooth due to a missing permission check. This could lead to local information disclosure if a malicious app enables contacts over a bluetooth connection, with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145130871
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-02-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0024
In onCreate of SettingsBaseActivity.java, there is a possible unauthorized setting modification due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-8.0Android ID: A-137015265
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-05-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0025
In deletePackageVersionedInternal of PackageManagerService.java, there is a possible way to exit Screen Pinning due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-135604684
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-03-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0026
In Parcel::continueWrite of Parcel.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-140419401
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-02-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0027
In HidRawSensor::batch of HidRawSensor.cpp, there is a possible out of bounds write due to an unexpected switch fallthrough. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-144040966
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-02-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0029
In the WifiConfigManager, there is a possible storage of location history which can only be deleted by triggering a factory reset. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-140065828
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-03-01'}]
CVE State: PUBLISHED
Explain CVE-2020-0030
In binder_thread_release of binder.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145286050References: Upstream kernel
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2020-02-01'}]
CVE State: PUBLISHED