Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-31294 State: PUBLISHED Published: 2024-06-09T08:50:46.511Z Last Updated: 2024-08-02T01:46:04.968Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Fahad Mahmood Products: WP Sort Order Problem Types: CWE-862 Description: Missing Authorization vulnerability in Fahad Mahmood WP Sort Order.This issue affects WP Sort Order: from n/a through 1.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-sort-order/wordpress-wp-sort-order-plugin-1-3-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-31295 State: PUBLISHED Published: 2024-05-17T08:19:49.152Z Last Updated: 2024-08-02T01:52:56.483Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: BestWebSoft Products: Captcha by BestWebSoft Problem Types: CWE-804 Description: Guessable CAPTCHA vulnerability in BestWebSoft Captcha by BestWebSoft allows Functionality Bypass.This issue affects Captcha by BestWebSoft: from n/a through 5.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/captcha-bws/wordpress-captcha-by-bestwebsoft-plugin-5-2-0-captcha-bypass-vulnerability?_s_id=cve
CVE ID: CVE-2024-31296 State: PUBLISHED Published: 2024-04-07T18:07:00.960Z Last Updated: 2024-08-02T01:52:56.134Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Repute Infosystems Products: BookingPress Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/bookingpress-appointment-booking/wordpress-bookingpress-plugin-1-0-81-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2024-31297 State: PUBLISHED Published: 2024-04-10T15:58:55.935Z Last Updated: 2024-08-08T17:26:05.673Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: WPExperts Products: Wholesale For WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-wholesale-pricing/wordpress-wholesale-for-woocommerce-plugin-2-3-1-unauthenticated-arbitrary-post-page-vulnerability?_s_id=cve
CVE ID: CVE-2024-31298 State: PUBLISHED Published: 2024-04-10T15:34:28.786Z Last Updated: 2024-08-02T01:52:56.219Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Joel Hardi Products: User Spam Remover Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File vulnerability in Joel Hardi User Spam Remover.This issue affects User Spam Remover: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/user-spam-remover/wordpress-user-spam-remover-plugin-1-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE ID: CVE-2024-31299 State: PUBLISHED Published: 2024-04-10T16:27:48.253Z Last Updated: 2024-08-02T01:52:56.293Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Reservation Diary Products: ReDi Restaurant Reservation Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Reservation Diary ReDi Restaurant Reservation allows Cross-Site Scripting (XSS).This issue affects ReDi Restaurant Reservation: from n/a through 24.0128. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/redi-restaurant-reservation/wordpress-redi-restaurant-reservation-plugin
- https://patchstack.com/database/vulnerability/redi-restaurant-reservation/wordpress-redi-restaurant-reservation-plugin-24-0128-cross-site-request-forgery-csrf-to-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-31300 State: PUBLISHED Published: 2024-05-17T08:54:58.034Z Last Updated: 2024-08-02T01:52:56.323Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: appscreo Products: Easy Social Share Buttons Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in appscreo Easy Social Share Buttons allows PHP Local File Inclusion.This issue affects Easy Social Share Buttons: from n/a through 9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/easy-social-share-buttons3/wordpress-easy-social-share-but
: References: - https://patchstack.com/database/vulnerability/easy-social-share-buttons3/wordpress-easy-social-share-buttons-plugin-9-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-31301 State: PUBLISHED Published: 2024-04-12T12:32:01.111Z Last Updated: 2024-08-02T01:52:56.328Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Themeisle Products: Multiple Page Generator Plugin – MPG Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/multiple-pages-generator-by-porthas/wordpress-multiple-page-generator-plugin-mpg-plugin-3-4-0-c
m/database/vulnerability/multiple-pages-generator-by-porthas/wordpress-multiple-page-generator-plugin-mpg-plugin-3-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31302 State: PUBLISHED Published: 2024-04-10T15:32:41.272Z Last Updated: 2024-08-02T01:52:56.370Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: CodePeople Products: Contact Form Email Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.This issue affects Contact Form Email: from n/a through 1.3.44. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/contact-form-to-email/wordpress-contact-form-email-plugin-1-3-44-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-31303 State: PUBLISHED Published: 2024-04-12T12:30:25.665Z Last Updated: 2024-08-02T01:52:56.551Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Fetch Designs Products: Sign-up Sheets Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets.This issue affects Sign-up Sheets: from n/a through 2.2.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/sign-up-sheets/wordpress-sign-up-sheets-plugin-2-2-11-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31304 State: PUBLISHED Published: 2024-06-09T18:09:28.264Z Last Updated: 2024-08-02T01:52:56.161Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: MultiVendorX Products: WC Marketplace Problem Types: CWE-862 Description: Missing Authorization vulnerability in MultiVendorX WC Marketplace.This issue affects WC Marketplace: from n/a through 4.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/dc-woocommerce-multi-vendor/wordpress-multivendorx-marketplace-4-1-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-31305 State: PUBLISHED Published: 2024-04-12T12:25:47.068Z Last Updated: 2024-08-02T01:52:56.115Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: rtCamp Products: Transcoder Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in rtCamp Transcoder.This issue affects Transcoder: from n/a through 1.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/transcoder/wordpress-transcoder-plugin-1-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31306 State: PUBLISHED Published: 2024-04-07T17:42:54.112Z Last Updated: 2024-08-02T01:52:56.168Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPDeveloper Products: Essential Blocks for Gutenberg Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Stored XSS.This issue affects Essential Blocks for Gutenberg: from n/a through 4.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/essential-blocks/wordpress-essential-bloc
Program Container: References: - https://patchstack.com/database/vulnerability/essential-blocks/wordpress-essential-blocks-plugin-4-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-31307 State: PUBLISHED Published: 2024-06-09T18:08:07.045Z Last Updated: 2024-08-02T01:52:56.107Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: appscreo Products: Easy Social Share Buttons Problem Types: CWE-862 Description: Missing Authorization vulnerability in appscreo Easy Social Share Buttons.This issue affects Easy Social Share Buttons: from n/a through 9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/easy-social-share-buttons3/wordpress-easy-social-share-buttons-plugin-9-4-multiple-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-31308 State: PUBLISHED Published: 2024-04-07T17:20:42.898Z Last Updated: 2024-08-02T01:52:56.327Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: VJInfotech Products: WP Import Export Lite Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-import-export-lite/wordpress-wp-import-export-lite-wp-import-export-plugin-3-9-26-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-31309 State: PUBLISHED Published: 2024-04-10T12:07:16.975Z Last Updated: 2025-11-04T18:30:48.185Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-20 Description: HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or
st can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/ - h
s.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/ - https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html - http://www.openwall.com/lists/oss-security/2024/04/03/16 - http://www.openwall.com/lists/oss-security/2024/04/10/7
CVE ID: CVE-2024-31310 State: PUBLISHED Published: 2024-07-09T20:09:15.312Z Last Updated: 2025-03-27T15:47:47.460Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In newServiceInfoLocked of AutofillManagerServiceImpl.java, there is a possible way to hide an enabled Autofill service app in the Autofill service settings due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/74afbb05ca08738f6
nt: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/74afbb05ca08738f66d82df867bbee66de4884bc - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-31311 State: PUBLISHED Published: 2024-07-09T20:09:15.382Z Last Updated: 2024-08-02T01:52:56.159Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In increment_annotation_count of stats_event.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/packages/modules/StatsD/+/b6aab6c000ab85f4e4d8bb3941bcc33800550374 - https://source.android.com/securit
rce.com/platform/packages/modules/StatsD/+/b6aab6c000ab85f4e4d8bb3941bcc33800550374 - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-31312 State: PUBLISHED Published: 2024-07-09T20:09:15.484Z Last Updated: 2024-10-31T14:49:02.306Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In multiple locations, there is a possible information leak due to a missing permission check. This could lead to local information disclosure exposing played media with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/748055291460bcaafa3e53c7da1601a687959477 - https://source.android.com/security/bulletin/
.com/platform/frameworks/base/+/748055291460bcaafa3e53c7da1601a687959477 - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-31313 State: PUBLISHED Published: 2024-07-09T20:09:15.601Z Last Updated: 2024-08-02T01:52:56.323Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In availableToWriteBytes of MessageQueueBase.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/system/libfmq/+/79bbf4aeef4b254c52da670a972e22956c8c659d - https://source.android.com/security/bulle
source.com/platform/system/libfmq/+/79bbf4aeef4b254c52da670a972e22956c8c659d - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-31314 State: PUBLISHED Published: 2024-07-09T20:09:15.683Z Last Updated: 2024-11-05T22:02:01.856Z Vendors: Google Products: Android Problem Types: Denial of service Description: In multiple functions of ShortcutService.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/c0d5f75e01308fb7d6d86639a0a6e2ff81b30be6 - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-31315 State: PUBLISHED Published: 2024-07-09T20:09:15.779Z Last Updated: 2025-03-19T17:48:15.629Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple functions of ManagedServices.java, there is a possible way to hide an app with notification access in the Device & app notifications settings due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/a9ee2793068235ff423d
- CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/a9ee2793068235ff423d08cc0964870c054d1983 - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-31316 State: PUBLISHED Published: 2024-07-09T20:09:15.859Z Last Updated: 2025-03-13T19:53:48.800Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/3457d82f8e265ad615b38f6a2aa3c33f1e100cb9 - https://source.andr
tps://android.googlesource.com/platform/frameworks/base/+/3457d82f8e265ad615b38f6a2aa3c33f1e100cb9 - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-31317 State: PUBLISHED Published: 2024-07-09T20:09:15.933Z Last Updated: 2024-08-02T01:52:56.288Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SECURE_SETTINGS due to unsafe deserialization. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/e25a0e394bbfd6143a557e1019bb7ad992d11985 - https:/
rences: - https://android.googlesource.com/platform/frameworks/base/+/e25a0e394bbfd6143a557e1019bb7ad992d11985 - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-31318 State: PUBLISHED Published: 2024-07-09T20:09:16.004Z Last Updated: 2024-08-02T01:52:56.195Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In CompanionDeviceManagerService.java, there is a possible way to pair a companion device without user acceptance due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/b68b257d56a8600d53b4d2d06fb82aa44086a4a5 - https://sour
s: - https://android.googlesource.com/platform/frameworks/base/+/b68b257d56a8600d53b4d2d06fb82aa44086a4a5 - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-31319 State: PUBLISHED Published: 2024-07-09T20:09:16.083Z Last Updated: 2024-08-02T01:52:56.306Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/3cc021bf608fa813a9a40932028fdde2b12a2d5e - https:/
rences: - https://android.googlesource.com/platform/frameworks/base/+/3cc021bf608fa813a9a40932028fdde2b12a2d5e - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-31320 State: PUBLISHED Published: 2024-07-09T20:11:27.398Z Last Updated: 2024-08-02T01:52:56.211Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association without any confirmation due to CDM. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/9722ce9d733edab76163fbcd21b231424e3d7061 - https://an
ces: - https://android.googlesource.com/platform/frameworks/base/+/9722ce9d733edab76163fbcd21b231424e3d7061 - https://android.googlesource.com/platform/frameworks/base/+/df49e0e3083b0707e2cca5a5956b49f14ded078e - https://source.android.com/security/bulletin/2024-07-01
CVE ID: CVE-2024-31322 State: PUBLISHED Published: 2024-07-09T20:09:16.169Z Last Updated: 2024-08-02T01:52:56.298Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In updateServicesLocked of AccessibilityManagerService.java, there is a possible way for an app to be hidden from the Setting while retaining Accessibility Service due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/c1bc907a64
nrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/c1bc907a649addd5b97d489fd39afb956164a46c - https://source.android.com/security/bulletin/2024-06-01
CVE ID: CVE-2024-31323 State: PUBLISHED Published: 2024-07-09T20:09:16.244Z Last Updated: 2024-08-02T01:52:56.548Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onCreate of multiple files, there is a possible way to trick the user into granting health permissions due to tapjacking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/packages/modules/HealthFitness/+/c4e13d15e8dd1df1bd827117d1a74c187ed2b3c2 - https://source.androi
glesource.com/platform/packages/modules/HealthFitness/+/c4e13d15e8dd1df1bd827117d1a74c187ed2b3c2 - https://source.android.com/security/bulletin/2024-06-01