Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-14975 State: PUBLISHED Published: 2018-08-06T15:00:00 Last Updated: 2024-08-05T09:46:24.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/album.php has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/QCMS/blob/master/README.md
CVE ID: CVE-2018-14976 State: PUBLISHED Published: 2018-08-06T15:00:00 Last Updated: 2024-08-05T09:46:24.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/QCMS/blob/master/README.md
CVE ID: CVE-2018-14977 State: PUBLISHED Published: 2018-08-06T15:00:00 Last Updated: 2024-08-05T09:46:25.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS, as demonstrated by the name parameter, a different vulnerability than CVE-2018-8070. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/QCMS/blob/master/XSS.md
CVE ID: CVE-2018-14978 State: PUBLISHED Published: 2018-08-06T15:00:00 Last Updated: 2024-08-05T09:46:24.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/QCMS/blob/master/CSRF
CVE ID: CVE-2018-14979 State: PUBLISHED Published: 2018-12-28T21:00:00 Last Updated: 2024-08-05T09:46:24.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains a pre-installed app with a package name of com.asus.loguploader (versionCode=1570000275, versionName=7.0.0.55_170515). This app contains an exported service app component named com.asus.loguploader.LogUploaderService that, when accessed with a particular action string, will write a bugreport (kernel log, logcat log, and the state of system services including the text
cular action string, will write a bugreport (kernel log, logcat log, and the state of system services including the text of active notifications), Wi-Fi Passwords, and other system data to external storage (sdcard). Any app with the READ_EXTERNAL_STORAGE permission on this device can read this data from the sdcard after it has been dumped there by the com.asus.loguploader. Third-party apps are not allowed to directly create a bugreport or access the user's stored wireless network credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-C
owire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf - https://www.kryptowire.com/portal/android-firmware-defcon-2018/
CVE ID: CVE-2018-14980 State: PUBLISHED Published: 2019-04-25T19:27:26 Last Updated: 2024-08-05T09:46:24.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains the android framework (i.e., system_server) with a package name of android (versionCode=24, versionName=7.0) that has been modified by ASUS or another entity in the supply chain. The system_server process in the core android package has an exported broadcast receiver that allows any app co-located on the device to programmatically initiate the taking of a screenshot
broadcast receiver that allows any app co-located on the device to programmatically initiate the taking of a screenshot and have the resulting screenshot be written to external storage (i.e., sdcard). The taking of a screenshot is not transparent to the user; the device has a screen animation as the screenshot is taken and there is a notification indicating that a screenshot occurred. If the attacking app also requests the EXPAND_STATUS_BAR permission, it can wake the device up using certain techniques and expand the status bar to take a screenshot of the user's notifications even if the device has an active screen lock. The notifications may contain sensitive data such as text messages used
ns even if the device has an active screen lock. The notifications may contain sensitive data such as text messages used in two-factor authentication. The system_server process that provides this capability cannot be disabled, as it is part of the Android framework. The notification can be removed by a local Denial of Service (DoS) attack to reboot the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/android-firmware-defcon-2018/ - https://www.kryptowire.com
CVE ID: CVE-2018-14981 State: PUBLISHED Published: 2018-08-17T20:00:00 Last Updated: 2024-08-05T09:46:25.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. The LG ID is LVE-SMP-180005. Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/security_updates.html
CVE ID: CVE-2018-14982 State: PUBLISHED Published: 2018-08-17T20:00:00 Last Updated: 2024-08-05T09:46:25.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is LVE-SMP-180004. Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/security_updates.html
CVE ID: CVE-2018-14983 State: PUBLISHED Published: 2019-04-25T19:29:46 Last Updated: 2024-08-05T09:46:25.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Sony Xperia L1 Android device with a build fingerprint of Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199:user/release-keys contains the android framework (i.e., system_server) with a package name of android (versionCode=24, versionName=7.0) that has been modified by Sony or another entity in the supply chain. The system_server process in the core android package has an exported broadcast receiver that allows any app co-located on the device to programmatically initiate the taking of a screenshot and have the resulting screen
s any app co-located on the device to programmatically initiate the taking of a screenshot and have the resulting screenshot be written to external storage. The taking of a screenshot is not transparent to the user; the device has a screen animation as the screenshot is taken and there is a notification indicating that a screenshot occurred. If the attacking app also requests the EXPAND_STATUS_BAR permission, it can wake the device up using certain techniques and expand the status bar to take a screenshot of the user's notifications even if the device has an active screen lock. The notifications may contain sensitive data such as text messages used in two-factor authentication. The system_se
ock. The notifications may contain sensitive data such as text messages used in two-factor authentication. The system_server process that provides this capability cannot be disabled, as it is part of the Android framework. The notification can be removed by a local Denial of Service (DoS) attack to reboot the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/android-firmware-defcon-2018/ - https://www.kryptowire.com
CVE ID: CVE-2018-14984 State: PUBLISHED Published: 2018-12-28T21:00:00 Last Updated: 2024-08-05T09:46:25.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed app with a package name of com.android.messaging (versionCode=1000110, versionName=1.0.001, (android.20170630.092853-0)) with an exported broadcast receiver app component named com.android.messaging.trackersender.TrackerSender. Any app co-located on the device, even one with no permissions, can send a broadcast intent with certain embedded data to the exported broadcast
e device, even one with no permissions, can send a broadcast intent with certain embedded data to the exported broadcast receiver application component that will result in the programmatic sending of a text message where the phone number and body of the text message is controlled by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf - https://www.kryptowire.com/portal/android-firmware-defcon-2018/
CVE ID: CVE-2018-14985 State: PUBLISHED Published: 2018-12-28T21:00:00 Last Updated: 2024-08-05T09:46:25.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed platform app with a package name of com.android.settings (versionCode=23, versionName=6.0-android.20170630.092853) that contains an exported broadcast receiver that allows any app co-located on the device to programmatically initiate a factory reset. In addition, the app initiating the factory reset does not require any permissions. A factory reset will remove all user
n addition, the app initiating the factory reset does not require any permissions. A factory reset will remove all user data and apps from the device. This will result in the loss of any data that have not been backed up or synced externally. The capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves with the exception of enabled Mobile Device Management (MDM) apps), although this capability can be obtained by leveraging an unprotected app component of a pre-installed platform app. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson
s: - CVE Program Container: References: - https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf - https://www.kryptowire.com/portal/android-firmware-defcon-2018/
CVE ID: CVE-2018-14986 State: PUBLISHED Published: 2018-12-28T21:00:00 Last Updated: 2024-08-05T09:46:25.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed app with a package name of com.android.messaging (versionCode=1000110, versionName=1.0.001, (android.20170630.092853-0)) containing an exported content provider named com.android.messaging.datamodel.MessagingContentProvider. Any app co-located on the device can read the most recent text message from each conversation. That is, for each phone number where the user has ei
evice can read the most recent text message from each conversation. That is, for each phone number where the user has either sent or received a text message from, a zero-permission third-party app can obtain the body of the text message, phone number, name of the contact (if it exists), and a timestamp for the most recent text message of each conversation. As the querying of the vulnerable content provider app component can be performed silently in the background, a malicious app can continuously monitor the content provider to see if the current message in each conversation has changed to obtain new text messages. Additional Analyst Notes: - CVE Program Container: References: - https://www.
n has changed to obtain new text messages. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf - https://www.kryptowire.com/portal/android-firmware-defcon-2018/
CVE ID: CVE-2018-14987 State: PUBLISHED Published: 2018-12-28T21:00:00 Last Updated: 2024-08-05T09:46:25.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201_N/m201_N:4.4.2/KOT49H/20160106:user/test-keys contains the Android framework with a package name of android (versionCode=19, versionName=4.4.2-20170213) that dynamically registers a broadcast receiver app component named com.android.server.MasterClearReceiver instead of statically registering it in the AndroidManifest.xml file of the core Android package, as done in Android Open Source Project (AOSP) code for Android 4.4.2. The dynamic-registration of th
re Android package, as done in Android Open Source Project (AOSP) code for Android 4.4.2. The dynamic-registration of the MasterClearReceiver broadcast receiver app component is not protected with the android.permission.MASTER_CLEAR permission during registration, so any app co-located on the device, even those without any permissions, can programmatically initiate a factory reset of the device. A factory reset will remove all user data and apps from the device. This will result in the loss of any data that have not been backed up or synced externally. The capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves with the exc
form a factory reset is not directly available to third-party apps (those that the user installs themselves with the exception of enabled Mobile Device Management (MDM) apps), although this capability can be obtained by leveraging an unprotected app component of core Android process. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf - https://www.kryptowire.com/portal/android-firmware-defcon-2018/
CVE ID: CVE-2018-14988 State: PUBLISHED Published: 2018-12-28T21:00:00 Last Updated: 2024-08-05T09:46:25.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201_N/m201_N:4.4.2/KOT49H/20160106:user/test-keys contains the Android framework with a package name of android (versionCode=19, versionName=4.4.2-20170213) that contains an exported broadcast receiver application component that, when called, will make the device inoperable. The vulnerable component named com.android.server.SystemRestoreReceiver will write a value of --restore_system\n--locale=<localeto the /cache/recovery/command file and boot into recovery
eiver will write a value of --restore_system\n--locale=<localeto the /cache/recovery/command file and boot into recovery mode. During this process, it appears that when booting into recovery mode, the system partition gets formatted or modified and will be unable to boot properly thereafter. After the device wouldn't boot properly, a factory reset of the device in recovery mode does not regain properly functionality of the device. The com.android.server.SystemRestoreReceiver broadcast receiver app component is accessible to any app co-located on the device and does not require any permission to access. The user can most likely recover the device by flashing clean firmware images placed on an
ire any permission to access. The user can most likely recover the device by flashing clean firmware images placed on an SD card. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf - https://www.kryptowire.com/portal/android-firmware-defcon-2018/
CVE ID: CVE-2018-14989 State: PUBLISHED Published: 2019-04-25T19:32:49 Last Updated: 2024-08-05T09:46:25.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Plum Compass Android device with a build fingerprint of PLUM/c179_hwf_221/c179_hwf_221:6.0/MRA58K/W16.51.5-22:user/release-keys contains a pre-installed platform app with a package name of com.android.settings (versionCode=23, versionName=6.0-eng.root.20161223.224055) that contains an exported broadcast receiver app component which allows any app co-located on the device to programmatically perform a factory reset. In addition, the app initiating the factory reset does not require any permissions. A factory reset will rem
tory reset. In addition, the app initiating the factory reset does not require any permissions. A factory reset will remove all user data and apps from the device. This will result in the loss of any data that have not been backed up or synced externally. The capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves with the exception of enabled Mobile Device Management (MDM) apps), although this capability can be obtained by leveraging an unprotected app component of a pre-installed platform app. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFC
Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf - https://www.kryptowire.com/portal/android-firmware-defcon-2018/ - https://www.kryptowire.com
CVE ID: CVE-2018-14990 State: PUBLISHED Published: 2019-04-25T19:33:20 Last Updated: 2024-08-05T09:46:25.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20170418.114928:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of Coolpad/alchemy/alchemy:7.1.1/143.14.171129.3701A-TMO/buildf_nj_02-206:user/release-keys all contain a vulnerable, pre-installed Rich Communication Services (RCS) app. These devices contain an that app has a package name of com.suntek.mway.rcs.a
led Rich Communication Services (RCS) app. These devices contain an that app has a package name of com.suntek.mway.rcs.app.service (versionCode=1, versionName=RCS_sdk_M_native_20161008_01; versionCode=1, versionName=RCS_sdk_M_native_20170406_01) with a broadcast receiver app component named com.suntek.mway.rcs.app.test.TestReceiver and a refactored version of the app with a package name of com.rcs.gsma.na.sdk (versionCode=1, versionName=RCS_SDK_20170804_01) with a broadcast receiver app component named com.rcs.gsma.na.test.TestReceiver allow any app co-located on the device to programmatically send text messages where the number and body of the text message is controlled by the attacker due
to programmatically send text messages where the number and body of the text message is controlled by the attacker due to an exported broadcast receiver app component. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. A separate vulnerability in the app allows a zero-permission app to programmatically delete text messages, so the sent text messages can be removed to not alert the user. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf - https://www.kryptowire.com/p
n-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf - https://www.kryptowire.com/portal/android-firmware-defcon-2018/ - https://www.kryptowire.com
CVE ID: CVE-2018-14991 State: PUBLISHED Published: 2019-04-25T19:33:52 Last Updated: 2024-08-05T09:46:25.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20170418.114928:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of Coolpad/alchemy/alchemy:7.1.1/143.14.171129.3701A-TMO/buildf_nj_02-206:user/release-keys all contain a vulnerable, pre-installed Rich Communication Services (RCS) app. These devices contain an that app has a package name of com.suntek.mway.rcs.a
led Rich Communication Services (RCS) app. These devices contain an that app has a package name of com.suntek.mway.rcs.app.service (versionCode=1, versionName=RCS_sdk_M_native_20161008_01; versionCode=1, versionName=RCS_sdk_M_native_20170406_01) with an exported content provider named com.suntek.mway.rcs.app.service.provider.message.MessageProvider and a refactored version of the app with a package name of com.rcs.gsma.na.sdk (versionCode=1, versionName=RCS_SDK_20170804_01) with a content provider named com.rcs.gsma.na.provider.message.MessageProvider allow any app co-located on the device to read, write, insert, and modify the user's text messages. This is enabled by an exported content pro
ed on the device to read, write, insert, and modify the user's text messages. This is enabled by an exported content provider app component that serves as a wrapper to the official content provider that contains the user's text messages. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf - https://www.kryptowire.com/portal/android-firmware-defcon-2018/ - https://www.kryptowire.com
CVE ID: CVE-2018-14992 State: PUBLISHED Published: 2018-12-28T21:00:00 Last Updated: 2024-08-05T09:46:25.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains a pre-installed platform app with a package name of com.asus.dm (versionCode=1510500200, versionName=1.5.0.40_171122) has an exposed interface in an exported service named com.asus.dm.installer.DMInstallerService that allows any app co-located on the device to use its capabilities to download an arbitrary app over the internet and install it. Any app on the device ca
e device to use its capabilities to download an arbitrary app over the internet and install it. Any app on the device can send an intent with specific embedded data that will cause the com.asus.dm app to programmatically download and install the app. For the app to be downloaded and installed, certain data needs to be provided: download URL, package name, version name from the app's AndroidManifest.xml file, and the MD5 hash of the app. Moreover, any app that is installed using this method can also be programmatically uninstalled using the same unprotected component named com.asus.dm.installer.DMInstallerService. Additional Analyst Notes: - CVE Program Container: References: - https://www.kr
om.asus.dm.installer.DMInstallerService. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf - https://www.kryptowire.com/portal/android-firmware-defcon-2018/