Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-43024 State: PUBLISHED Published: 2024-09-18T00:00:00.000Z Last Updated: 2025-03-25T16:20:43.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in RWS MultiTrans v7.0.23324.2 and earlier allow attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.rws.com/product-groups/translation_management/multitrans/w/releases/5112/multitrans-7-releases - https://github.com/tomdantuma/CVE/tree/main/2024-43024 - https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2024-43024
CVE ID: CVE-2024-43025 State: PUBLISHED Published: 2024-09-18T00:00:00.000Z Last Updated: 2025-03-25T16:20:46.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: An HTML injection vulnerability in RWS MultiTrans v7.0.23324.2 and earlier allows attackers to alter the HTML-layout and possibly execute a phishing attack via a crafted payload injected into a sent e-mail. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.rws.com/product-groups/translation_management/multitrans/w/releases/5112/multitrans-7-releases - https://github.com/tomdantuma/CVE/tree/main/2024-43025 - https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2024-43025
CVE ID: CVE-2024-43027 State: PUBLISHED Published: 2024-08-21T00:00:00 Last Updated: 2024-08-23T17:57:39.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before v1.5.1.5_Beta were discovered to contain a command injection vulnerability via the action parameter at cgi-bin/mainfunction.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/N1nEmAn/wp/blob/main/V3900.md
CVE ID: CVE-2024-43031 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-23T17:52:23.509218 Vendors: n/a Products: n/a Problem Types: n/a Description: autMan v2.9.6 was discovered to contain an access control issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://autman.com - https://github.com/hdbjlizhe/fanli
CVE ID: CVE-2024-43032 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-23T17:50:20.482877 Vendors: n/a Products: n/a Problem Types: n/a Description: autMan v2.9.6 allows attackers to bypass authentication via a crafted web request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hdbjlizhe/fanli/releases/tag/2.9.6
CVE ID: CVE-2024-43033 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-23T15:24:23.081609 Vendors: n/a Products: n/a Problem Types: n/a Description: JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JPressProjects/jpress/issues/188 - https://cwe.mitre.org/data/definitions/69.html - https://github.com/lazy-forever/CVE-Reference/tree
/jpress/issues/188 - https://cwe.mitre.org/data/definitions/69.html - https://github.com/lazy-forever/CVE-Reference/tree/main/2024/43033
CVE ID: CVE-2024-43040 State: PUBLISHED Published: 2024-09-10T00:00:00 Last Updated: 2024-09-12T14:00:21.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: Renwoxing Enterprise Intelligent Management System before v3.0 was discovered to contain a SQL injection vulnerability via the parid parameter at /fx/baseinfo/SearchInfo. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/X1lyS/75a8ea48c4997b683e8b41c94e79e5f9
CVE ID: CVE-2024-43042 State: PUBLISHED Published: 2024-08-16T00:00:00.000Z Last Updated: 2025-03-19T20:12:55.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pluck-cms/pluck - https://drive.google.com/file/d/1FnLCFP8xDrE1e_4Ft_TZ7VhC-JBkpsL0/view?usp=sharing
CVE ID: CVE-2024-43044 State: PUBLISHED Published: 2024-08-07T13:27:11.438Z Last Updated: 2025-03-14T19:38:08.229Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2024-08-07/#SECURITY-3430
CVE ID: CVE-2024-43045 State: PUBLISHED Published: 2024-08-07T13:27:12.065Z Last Updated: 2025-03-25T16:30:48.110Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2024-08-07/#SECURITY-3349
CVE ID: CVE-2024-43046 State: PUBLISHED Published: 2025-04-07T10:15:31.869Z Last Updated: 2025-04-07T16:02:40.607Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-200 Description: There may be information disclosure during memory re-allocation in TZ Secure OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
CVE ID: CVE-2024-43047 State: PUBLISHED Published: 2024-10-07T12:59:01.656Z Last Updated: 2025-10-21T22:55:43.826Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while maintaining memory maps of HLOS memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE ID: CVE-2024-43048 State: PUBLISHED Published: 2024-12-02T10:18:49.110Z Last Updated: 2024-12-03T04:55:36.961Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-121 Description: Memory corruption when invalid input is passed to invoke GPU Headroom API call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE ID: CVE-2024-43049 State: PUBLISHED Published: 2024-12-02T10:18:50.243Z Last Updated: 2024-12-03T04:55:38.243Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-119 Description: Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE ID: CVE-2024-43050 State: PUBLISHED Published: 2024-12-02T10:18:51.326Z Last Updated: 2024-12-03T04:55:39.595Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-121 Description: Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE ID: CVE-2024-43051 State: PUBLISHED Published: 2025-03-03T10:07:20.982Z Last Updated: 2025-03-03T16:14:33.850Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-285 Description: Information disclosure while deriving keys for a session for any Widevine use case. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html
CVE ID: CVE-2024-43052 State: PUBLISHED Published: 2024-12-02T10:18:52.423Z Last Updated: 2024-12-03T04:55:40.842Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-20 Description: Memory corruption while processing API calls to NPU with invalid input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE ID: CVE-2024-43053 State: PUBLISHED Published: 2024-12-02T10:18:53.503Z Last Updated: 2024-12-03T04:55:42.097Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-119 Description: Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE ID: CVE-2024-43055 State: PUBLISHED Published: 2025-03-03T10:07:22.414Z Last Updated: 2025-03-03T13:14:52.949Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-120 Description: Memory corruption while processing camera use case IOCTL call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html
CVE ID: CVE-2024-43056 State: PUBLISHED Published: 2025-03-03T10:07:23.551Z Last Updated: 2025-03-03T13:14:30.395Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Transient DOS during hypervisor virtual I/O operation in a virtual machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html
CVE ID: CVE-2024-43057 State: PUBLISHED Published: 2025-03-03T10:07:24.713Z Last Updated: 2025-03-03T13:11:53.199Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while processing command in Glink linux. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html
CVE ID: CVE-2024-43058 State: PUBLISHED Published: 2025-04-07T10:15:33.770Z Last Updated: 2025-04-07T16:00:21.199Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-704 Description: Memory corruption while processing IOCTL calls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
CVE ID: CVE-2024-43059 State: PUBLISHED Published: 2025-03-03T10:07:25.800Z Last Updated: 2025-03-03T13:10:33.111Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html
CVE ID: CVE-2024-43060 State: PUBLISHED Published: 2025-03-03T10:07:26.897Z Last Updated: 2025-03-03T13:08:15.920Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-823 Description: Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html
CVE ID: CVE-2024-43061 State: PUBLISHED Published: 2025-03-03T10:07:28.054Z Last Updated: 2025-03-03T12:28:46.985Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html
CVE ID: CVE-2024-43062 State: PUBLISHED Published: 2025-03-03T10:07:29.197Z Last Updated: 2025-03-03T12:27:47.129Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html
CVE ID: CVE-2024-43063 State: PUBLISHED Published: 2025-01-06T10:33:20.733Z Last Updated: 2025-01-06T14:18:35.659Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: information disclosure while invoking the mailbox read API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE ID: CVE-2024-43064 State: PUBLISHED Published: 2025-01-06T10:33:21.864Z Last Updated: 2025-02-28T06:09:02.181Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-264 Description: Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE ID: CVE-2024-43065 State: PUBLISHED Published: 2025-04-07T10:15:35.110Z Last Updated: 2025-04-07T15:56:17.559Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-749 Description: Cryptographic issues while generating an asymmetric key pair for RKP use cases. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
CVE ID: CVE-2024-43066 State: PUBLISHED Published: 2025-04-07T10:15:36.557Z Last Updated: 2025-04-07T18:57:53.736Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while handling file descriptor during listener registration/de-registration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
CVE ID: CVE-2024-43067 State: PUBLISHED Published: 2025-04-07T10:15:37.780Z Last Updated: 2025-04-08T03:56:16.694Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-367 Description: Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
CVE ID: CVE-2024-43077 State: PUBLISHED Published: 2025-01-02T23:58:26.607Z Last Updated: 2025-01-03T21:20:56.256Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In DevmemValidateFlags of devicemem_server.c , there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2024-12-01
CVE ID: CVE-2024-43080 State: PUBLISHED Published: 2024-11-13T17:25:12.658Z Last Updated: 2024-12-04T04:55:41.724Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onReceive of AppRestrictionsFragment.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/26ce013dfd7e59a451acc66e7f05564e0884d46b - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-43081 State: PUBLISHED Published: 2024-11-13T17:25:12.752Z Last Updated: 2024-11-16T04:55:31.701Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/31c098c4271ad4fdfb3809e05017ead8d9f6580f - https://source.android.com/security/bulleti
ce.com/platform/frameworks/base/+/31c098c4271ad4fdfb3809e05017ead8d9f6580f - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-43082 State: PUBLISHED Published: 2024-11-13T17:25:12.836Z Last Updated: 2024-11-14T15:21:47.409Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/6aa1b4fbf5936a1ff5bdbb79397c94910a6ed8f5 - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-43083 State: PUBLISHED Published: 2024-11-13T17:25:12.930Z Last Updated: 2024-11-13T21:50:55.699Z Vendors: Google Products: Android Problem Types: Denial of service Description: In validate of WifiConfigurationUtil.java , there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Wifi/+/62f61e19524e9a55cadd1116c9448ff34b977e50 - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-43084 State: PUBLISHED Published: 2024-11-13T17:25:13.042Z Last Updated: 2025-03-13T18:40:40.406Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/50eec20b570cd4cbbe8c5971af4c9dda3ddcb858 - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-43085 State: PUBLISHED Published: 2024-11-13T17:25:13.283Z Last Updated: 2024-11-16T04:55:32.876Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/2457d4e459ee6ffd099b9ff7cce9c83119c3ce66 - https://source.and
ttps://android.googlesource.com/platform/frameworks/base/+/2457d4e459ee6ffd099b9ff7cce9c83119c3ce66 - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-43086 State: PUBLISHED Published: 2024-11-13T17:25:13.382Z Last Updated: 2024-11-14T15:16:02.013Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a third party app due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/55a3d36701bb874358f685d3ac3381eda10fcff0 - https://source.android.com/se
oid.googlesource.com/platform/frameworks/base/+/55a3d36701bb874358f685d3ac3381eda10fcff0 - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-43087 State: PUBLISHED Published: 2024-11-13T17:25:13.467Z Last Updated: 2024-11-22T04:55:13.453Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In getInstalledAccessibilityPreferences of AccessibilitySettings.java, there is a possible way to hide an enabled accessibility service in the accessibility service settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/6253b87704bb097ad9
SA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/6253b87704bb097ad9963941bdddf3b86906a73e - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-43088 State: PUBLISHED Published: 2024-11-13T17:25:13.585Z Last Updated: 2024-11-22T04:55:09.679Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple functions in AppInfoBase.java, there is a possible way to manipulate app permission settings belonging to another user on the device due to a missing permission check. This could lead to local escalation of privilege across user boundaries with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/975c28535419be1cc45
A ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/975c28535419be1cc45f66712f41e4a7a40e6001 - https://source.android.com/security/bulletin/2024-11-01