Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-23678 State: PUBLISHED Published: 2024-01-22T20:37:43.095Z Last Updated: 2025-06-17T21:19:26.089Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-20 Description: In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk Enterprise for Windows. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-202
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2024-0108 - https://research.splunk.com/application/947d4d2e-1b64-41fc-b32a-736ddb88ce97/
CVE ID: CVE-2024-23679 State: PUBLISHED Published: 2024-01-19T20:23:03.781Z Last Updated: 2025-05-30T14:25:16.986Z Problem Types: CWE-384 Description: Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/enonic/xp/security/advisories/GHSA-4m5p-5w5w-3jcf - https://github.com/enonic/xp/issues/9253 - https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff - https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88ba
mit/0189975691e9e6407a9fee87006f730e84f734ff - https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4 - https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842 - https://github.com/advisories/GHSA-4m5p-5w5w-3jcf - https://vulncheck.com/advisories/vc-advisory-GHSA-4m5p-5w5w-3jcf
CVE ID: CVE-2024-23680 State: PUBLISHED Published: 2024-01-19T20:44:34.957Z Last Updated: 2024-09-10T20:17:04.595Z Problem Types: CWE-347 Description: AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/aws/aws-encryption-sdk-java/security/advisories/GHSA-55xh-53m6-936r - https://github.com/advisories/GHSA-55xh-53m6-936r - https://vulncheck.com/advisories/vc-advisory-GHSA-55xh-53m6-936r
CVE ID: CVE-2024-23681 State: PUBLISHED Published: 2024-01-19T20:51:33.540Z Last Updated: 2025-06-04T15:20:53.275Z Problem Types: CWE-284 Description: Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ls1intum/Ares/security/advisories/GHSA-98hq-4wmw-98w9 - https://github.com/advisories/GHSA-98hq-4wmw-98w9 - https://vulncheck.com/advisories/vc-advisory-GHSA-9
98hq-4wmw-98w9 - https://github.com/advisories/GHSA-98hq-4wmw-98w9 - https://vulncheck.com/advisories/vc-advisory-GHSA-98hq-4wmw-98w9
CVE ID: CVE-2024-23682 State: PUBLISHED Published: 2024-01-19T20:13:55.453Z Last Updated: 2025-06-20T18:25:03.328Z Problem Types: CWE-501, CWE-653 Description: Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ls1intum/Ares/security/advisories/GHSA-227w-wv4j-67h4 - https://github.com/ls1intum/Ares/issues/15 - https://github.com/ls1intum/Ares/releases/tag/1.8.0 - https://git
4j-67h4 - https://github.com/ls1intum/Ares/issues/15 - https://github.com/ls1intum/Ares/releases/tag/1.8.0 - https://github.com/advisories/GHSA-227w-wv4j-67h4 - https://vulncheck.com/advisories/vc-advisory-GHSA-227w-wv4j-67h4
CVE ID: CVE-2024-23683 State: PUBLISHED Published: 2024-01-19T20:48:42.271Z Last Updated: 2025-06-20T18:26:59.260Z Description: Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ls1intum/Ares/security/advisories/GHSA-883x-6fch-6wjx - https://github.com/ls1intum/Ares/issues/15#issuecomment-996449371 - https://github.com/ls1intum/Ares/commit/af4f28a56e2fe600d8750b3b415
com/ls1intum/Ares/issues/15#issuecomment-996449371 - https://github.com/ls1intum/Ares/commit/af4f28a56e2fe600d8750b3b415352a0a3217392 - https://github.com/ls1intum/Ares/releases/tag/1.7.6 - https://github.com/advisories/GHSA-883x-6fch-6wjx - https://vulncheck.com/advisories/vc-advisory-GHSA-883x-6fch-6wjx
CVE ID: CVE-2024-23684 State: PUBLISHED Published: 2024-01-19T20:59:02.723Z Last Updated: 2025-06-20T18:27:45.342Z Problem Types: CWE-407 Description: Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6 - https://github.com/advisories/
ences: - https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6 - https://github.com/advisories/GHSA-fj2w-wfgv-mwq6 - https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6
CVE ID: CVE-2024-23685 State: PUBLISHED Published: 2024-01-19T21:07:13.048Z Last Updated: 2025-05-30T14:24:51.975Z Description: Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/folio-org/mod-remote-storage/security/advisories/GHSA-m8v7-469p-5x89 - https://github.com/folio-org/mod-remote-storage/commit/57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b - https://wiki.folio.org/x/hbMMBw - https://gith
-org/mod-remote-storage/commit/57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b - https://wiki.folio.org/x/hbMMBw - https://github.com/advisories/GHSA-m8v7-469p-5x89 - https://vulncheck.com/advisories/vc-advisory-GHSA-m8v7-469p-5x89
CVE ID: CVE-2024-23686 State: PUBLISHED Published: 2024-01-19T21:12:13.288Z Last Updated: 2025-06-17T15:00:19.778Z Problem Types: CWE-532 Description: DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5 - https://github.com/advisories/GHSA-qqhq-8r2c-c3f5 - https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5
CVE ID: CVE-2024-23687 State: PUBLISHED Published: 2024-01-19T21:15:18.503Z Last Updated: 2025-05-22T18:16:23.825Z Description: Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/folio-org/mod-data-export-spring/security/advisories/GHSA-vf78-3q9f-92g3 - https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446 - https://wiki.folio.org/x/hbMMBw - http
olio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446 - https://wiki.folio.org/x/hbMMBw - https://github.com/advisories/GHSA-vf78-3q9f-92g3 - https://vulncheck.com/advisories/vc-advisory-GHSA-vf78-3q9f-92g3
CVE ID: CVE-2024-23688 State: PUBLISHED Published: 2024-01-19T21:26:35.282Z Last Updated: 2025-06-20T18:28:31.476Z Problem Types: CWE-323 Description: Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ConsenSys/discovery/security/advisories/GHSA-w3hj-wr2q-x83g - https://github.com/advisories/GHSA-w3hj-wr2q-x83g - https://vulncheck.com/advisories/vc-advisory-GHSA-w3hj-wr2q-x8
83g - https://github.com/advisories/GHSA-w3hj-wr2q-x83g - https://vulncheck.com/advisories/vc-advisory-GHSA-w3hj-wr2q-x83g
CVE ID: CVE-2024-23689 State: PUBLISHED Published: 2024-01-19T21:02:29.558Z Last Updated: 2025-05-30T14:24:57.608Z Problem Types: CWE-209 Description: Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message. Additional Analyst Notes: - CVE Program Container: - CIS
cate password is then included in the logged exception message. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ClickHouse/clickhouse-java/security/advisories/GHSA-g8ph-74m6-8m7r - https://github.com/ClickHouse/clickhouse-java/issues/1331 - https://github.com/ClickHouse/clickhouse-java/pull/1334 - https://github.com/ClickHouse/clickhouse-java/releases/tag/v0.4.6 - https://github.com/advisories/GHSA-g8ph-74m6-8m7r - https://vulncheck.com/advisories/vc-advisory-GHSA-g8ph-74m6-8m7r
CVE ID: CVE-2024-23690 State: PUBLISHED Published: 2025-02-04T14:34:00.370Z Last Updated: 2025-11-22T12:19:16.575Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Netgear Products: FVS336Gv3, FVS336Gv2 Problem Types: CWE-78 Description: The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command injection vulnerability in the Telnet interface. An authenticated and remote attacker can execute arbitrary OS commands as root over Telnet by sending crafted "util backup_configuration" commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vulncheck.com/advisories/netgear-fvs336g-rce
CVE ID: CVE-2024-23692 State: PUBLISHED Published: 2024-05-31T09:36:28.763Z Last Updated: 2025-11-22T12:13:59.165Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Rejetto Products: HTTP File Server Problem Types: CWE-1336 Description: Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Reference
o HFS 2.3m is no longer supported. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vulncheck.com/advisories/rejetto-unauth-rce - https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/ - https://github.com/rapid7/metasploit-framework/pull/19240
CVE ID: CVE-2024-23695 State: PUBLISHED Published: 2024-07-09T20:09:14.894Z Last Updated: 2024-08-01T23:06:25.353Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In CacheOpPMRExec of cache_km.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-23696 State: PUBLISHED Published: 2024-07-09T20:09:14.965Z Last Updated: 2024-08-01T23:06:25.367Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In RGXCreateZSBufferKM of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-23697 State: PUBLISHED Published: 2024-07-09T20:09:15.088Z Last Updated: 2024-08-01T23:06:25.425Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In RGXCreateHWRTData_aux of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-23698 State: PUBLISHED Published: 2024-07-09T20:09:15.160Z Last Updated: 2024-08-01T23:06:25.368Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In RGXFWChangeOSidPriority of rgxfwutils.c, there is a possible arbitrary code execution due to a missing bounds check. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-23704 State: PUBLISHED Published: 2024-05-07T21:01:29.094Z Last Updated: 2024-08-01T23:13:07.307Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/2e90322bab7de1deaf3c82e207bf4404b92743d7 - http
es: - https://android.googlesource.com/platform/packages/apps/Settings/+/2e90322bab7de1deaf3c82e207bf4404b92743d7 - https://source.android.com/security/bulletin/2024-04-01
CVE ID: CVE-2024-23705 State: PUBLISHED Published: 2024-05-07T21:03:30.866Z Last Updated: 2024-08-01T23:13:07.248Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/032bee6dc118ce1cc3fde92463b2954c1450f2e8 - https://source.android.com/security/bull
ource.com/platform/frameworks/base/+/032bee6dc118ce1cc3fde92463b2954c1450f2e8 - https://source.android.com/security/bulletin/2024-05-01
CVE ID: CVE-2024-23706 State: PUBLISHED Published: 2024-05-07T21:03:30.941Z Last Updated: 2024-08-01T23:13:07.539Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible bypass of health data permissions due to an improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/packages/modules/HealthFitness/+/6e6896c3fd8139779ff8d51a99ee06667e849d87 - https://source.android.com/secur
om/platform/packages/modules/HealthFitness/+/6e6896c3fd8139779ff8d51a99ee06667e849d87 - https://source.android.com/security/bulletin/2024-05-01
CVE ID: CVE-2024-23707 State: PUBLISHED Published: 2024-05-07T21:03:31.019Z Last Updated: 2024-08-01T23:13:07.332Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/f1d0079c91734168c150f839168544f407b17b06 - https://source.android.com/security/bulletin/2024-05-01
CVE ID: CVE-2024-23708 State: PUBLISHED Published: 2024-05-07T21:03:31.096Z Last Updated: 2024-08-01T23:13:07.187Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has been accessed. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/0c095c365ede36257e829769194f9596a598e560 - https:/
rences: - https://android.googlesource.com/platform/frameworks/base/+/0c095c365ede36257e829769194f9596a598e560 - https://source.android.com/security/bulletin/2024-05-01
CVE ID: CVE-2024-23709 State: PUBLISHED Published: 2024-05-07T21:03:31.178Z Last Updated: 2024-10-25T19:10:30.195Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/external/sonivox/+/3f798575d2d39cd190797427d13471d6e7ceae4c - https://source.android.com/security/bulletin/2024-05-01
CVE ID: CVE-2024-23710 State: PUBLISHED Published: 2024-05-07T21:01:29.174Z Last Updated: 2025-03-26T20:02:30.509Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary app code as a privileged app due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/c7c1193ca7554fc3182ca9a
CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/c7c1193ca7554fc3182ca9ab0f711bd118bdeef2 - https://source.android.com/security/bulletin/2024-04-01
CVE ID: CVE-2024-23711 State: PUBLISHED Published: 2024-07-09T20:09:15.233Z Last Updated: 2024-08-01T23:13:07.122Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In DevmemXIntUnreserveRange of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-23712 State: PUBLISHED Published: 2024-05-07T21:01:29.249Z Last Updated: 2025-03-17T17:50:47.973Z Vendors: Google Products: Android Problem Types: Denial of service Description: In multiple functions of AppOpsService.java, there is a possible way to saturate the content of /data/system/appops_accesses.xml due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/6beb68ca17d1220f3f09a53cf0a0c541db4ead62 - https://source.
- https://android.googlesource.com/platform/frameworks/base/+/6beb68ca17d1220f3f09a53cf0a0c541db4ead62 - https://source.android.com/security/bulletin/2024-04-01
CVE ID: CVE-2024-23713 State: PUBLISHED Published: 2024-05-07T21:01:29.338Z Last Updated: 2024-08-01T23:13:07.259Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In migrateNotificationFilter of NotificationManagerService.java, there is a possible failure to persist notifications settings due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/ffd616dc3b919fe7705dbc7a25868483ae45466b -
r: References: - https://android.googlesource.com/platform/frameworks/base/+/ffd616dc3b919fe7705dbc7a25868483ae45466b - https://source.android.com/security/bulletin/2024-04-01
CVE ID: CVE-2024-23715 State: PUBLISHED Published: 2024-11-13T17:13:19.354Z Last Updated: 2024-11-20T16:17:14.833Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In PMRWritePMPageList of pmr.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-23716 State: PUBLISHED Published: 2024-09-11T00:09:16.547Z Last Updated: 2024-09-12T13:33:14.558Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2024-09-01