deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-34734
Published: 2022-09-13
Description: Microsoft ODBC Driver Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34734; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34734
CVE: CVE-2022-35803
Published: 2022-09-13
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35803; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35803
CVE: CVE-2022-35805
Published: 2022-09-13
Description: Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35805; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35805
CVE: CVE-2022-35823
Published: 2022-09-13
Description: Microsoft SharePoint Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35823; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35823
CVE: CVE-2022-35828
Published: 2022-09-13
Description: Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35828; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-35828
CVE: CVE-2022-35830
Published: 2022-09-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35830; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35830
CVE: CVE-2022-35831
Published: 2022-09-13
Description: Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35831; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35831
CVE: CVE-2022-35832
Published: 2022-09-13
Description: Windows Event Tracing Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35832; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35832
CVE: CVE-2022-35833
Published: 2022-09-13
Description: Windows Secure Channel Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35833; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35833
CVE: CVE-2022-35834
Published: 2022-09-13
Description: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35834; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35834
CVE: CVE-2022-35835
Published: 2022-09-13
Description: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35835; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35835
CVE: CVE-2022-35836
Published: 2022-09-13
Description: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35836; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35836
CVE: CVE-2022-35837
Published: 2022-09-13
Description: Windows Graphics Component Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35837; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35837
CVE: CVE-2022-35838
Published: 2022-09-13
Description: HTTP V3 Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35838; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35838
CVE: CVE-2022-35840
Published: 2022-09-13
Description: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35840; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35840
CVE: CVE-2022-35841
Published: 2022-09-13
Description: Windows Enterprise App Management Service Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35841; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35841
CVE: CVE-2022-37954
Published: 2022-09-13
Description: DirectX Graphics Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37954; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37954
CVE: CVE-2022-37955
Published: 2022-09-13
Description: Windows Group Policy Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37955; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37955
CVE: CVE-2022-37956
Published: 2022-09-13
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37956; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37956
CVE: CVE-2022-37957
Published: 2022-09-13
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37957; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37957
CVE: CVE-2022-37958
Published: 2022-09-13
Description: SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37958; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37958
CVE: CVE-2022-37959
Published: 2022-09-13
Description: Network Device Enrollment Service (NDES) Security Feature Bypass Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37959; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37959
CVE: CVE-2022-37961
Published: 2022-09-13
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37961; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37961
CVE: CVE-2022-37962
Published: 2022-09-13
Description: Microsoft PowerPoint Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37962; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37962
CVE: CVE-2022-37963
Published: 2022-09-13
Description: Microsoft Office Visio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37963; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37963
CVE: CVE-2022-37964
Published: 2022-09-13
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37964; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37964
CVE: CVE-2022-37969
Published: 2022-09-13
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37969; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37969; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-37969
CVE: CVE-2022-38004
Published: 2022-09-13
Description: Windows Fax Service Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38004; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38004
CVE: CVE-2022-38005
Published: 2022-09-13
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38005; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38005
CVE: CVE-2022-38006
Published: 2022-09-13
Description: Windows Graphics Component Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38006; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38006
CVE: CVE-2022-38007
Published: 2022-09-13
Description: Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38007; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38007
CVE: CVE-2022-38008
Published: 2022-09-13
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38008; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38008
CVE: CVE-2022-38009
Published: 2022-09-13
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38009; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38009
CVE: CVE-2022-38010
Published: 2022-09-13
Description: Microsoft Office Visio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38010; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38010
CVE: CVE-2022-38011
Published: 2022-09-13
Description: Raw Image Extension Remote Code Execution Vulnerability
CVSS Score: 7.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38011; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38011
CVE: CVE-2022-38012
Published: 2022-09-13
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 7.7 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38012; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38012
CVE: CVE-2022-38013
Published: 2022-09-13
Description: .NET Core and Visual Studio Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38013; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2CUL3Z7MEED7RFQZVGQL2MTKSFFZKAAY/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HCV4TQGOTOFHO5ETRKGFKAGYV2YAUVE/
CVE: CVE-2022-38019
Published: 2022-09-13
Description: AV1 Video Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38019; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38019
CVE: CVE-2022-38020
Published: 2022-09-13
Description: Visual Studio Code Elevation of Privilege Vulnerability
CVSS Score: 7.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38020; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38020
CVE: CVE-2022-39203
Published: 2022-09-13
Description: matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround operators may disable dynamic channel joining via `dynamicChannels.enabled` to prevent users from joining new channels, which prevents any new channels being bridged outside of what is already bridged, and what is specified in the config.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-xvqg-mv25-rwvw; https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity/; https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-xvqg-mv25-rwvw
CVE: CVE-2022-39205
Published: 2022-09-13
Description: Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev instance if there is no properly configured reverse proxy. The /git-prereceive-callback endpoint is used by the pre-receive git hook on the server to check for branch protections during a push event. It is only intended to be accessed from localhost, but the check relies on the X-Forwarded-For header. Invoking this endpoint leads to the execution of one of various git commands. The environment variables of this command execution can be controlled via query parameters. This allows attackers to write to arbitrary files, which can in turn lead to the execution of arbitrary code. Such an attack would be very hard to detect, which increases the potential impact even more. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-287
References: https://blog.sonarsource.com/onedev-remote-code-execution/; https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e; https://github.com/theonedev/onedev/releases/tag/v7.3.0
CVE: CVE-2022-39206
Published: 2022-09-13
Description: Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/run/docker.sock on Linux) is mounted into each Docker step. Users that can define and trigger CI/CD jobs on a project could use this to control the Docker daemon on the host machine. This is a known dangerous pattern, as it can be used to break out of Docker containers and, in most cases, gain root privileges on the host system. This issue allows regular (non-admin) users to potentially take over the build infrastructure of a OneDev instance. Attackers need to have an account (or be able to register one) and need permission to create a project. Since code.onedev.io has the right preconditions for this to be exploited by remote attackers, it could have been used to hijack builds of OneDev itself, e.g. by injecting malware into the docker images that are built and pushed to Docker Hub. The impact is increased by this as described before. Users are advised to upgrade to 7.3.0 or higher. There are no known workarounds for this issue.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-610
References: https://blog.sonarsource.com/onedev-remote-code-execution/; https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22; https://github.com/theonedev/onedev/security/advisories/GHSA-gjq9-4xx9-cr3q
CVE: CVE-2022-39207
Published: 2022-09-13
Description: Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for later retrieval. They can be accessed through OneDev's web UI after the successful run of a build. These artifact files are served by the webserver in the same context as the UI without any further restrictions. This leads to Cross-Site Scripting (XSS) when a user creates a build artifact that contains HTML. When accessing the artifact, the content is rendered by the browser, including any JavaScript that it contains. Since all cookies (except for the rememberMe one) do not set the HttpOnly flag, an attacker could steal the session of a victim and use it to impersonate them. To exploit this issue, attackers need to be able to modify the content of artifacts, which usually means they need to be able to modify a project's build spec. The exploitation requires the victim to click on an attacker's link. It can be used to elevate privileges by targeting admins of a OneDev instance. In the worst case, this can lead to arbitrary code execution on the server, because admins can create Server Shell Executors and use them to run any command on the server. This issue has been patched in version 7.3.0. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-732
References: https://blog.sonarsource.com/onedev-remote-code-execution/; https://github.com/theonedev/onedev/commit/adb6e31476621f824fc3227a695232df830d83ab; https://github.com/theonedev/onedev/security/advisories/GHSA-27fw-gv88-qrpg
CVE: CVE-2022-39208
Published: 2022-09-13
Description: Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the /opt/onedev/sites/ directory are exposed and can be read by unauthenticated users. This directory contains all projects, including their bare git repos and build artifacts. This file disclosure vulnerability can be used by unauthenticated attackers to leak all project files of any project. Since project IDs are incremental, an attacker could iterate through them and leak all project data. This issue has been resolved in version 7.3.0 and users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://blog.sonarsource.com/onedev-remote-code-execution/; https://github.com/theonedev/onedev/commit/8aa94e0daf8447cdf76d4f27bfda0a85a7ea5822; https://github.com/theonedev/onedev/security/advisories/GHSA-h427-rv56-c9h2
CVE: CVE-2022-40634
Published: 2022-09-13
Description: Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-913, CWE-913
References: https://docs.craftercms.org/en/3.1/security/advisory.html#cv[PII_REDACTED]; https://docs.craftercms.org/en/3.1/security/advisory.html#cv[PII_REDACTED]
CVE: CVE-2022-40635
Published: 2022-09-13
Description: Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-913, CWE-913
References: https://docs.craftercms.org/en/3.1/security/advisory.html#cv[PII_REDACTED]; https://docs.craftercms.org/en/3.1/security/advisory.html#cv[PII_REDACTED]
CVE: CVE-2021-0697
Published: 2022-09-13
Description: In PVRSRVRGXSubmitTransferKM of rgxtransfer.c, there is a possible user after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-238918403
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/2022-09-01; https://source.android.com/security/bulletin/2022-09-01
CVE: CVE-2021-0871
Published: 2022-09-13
Description: In PVRSRVBridgePMRPDumpSymbolicAddr of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-238921253
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://source.android.com/security/bulletin/2022-09-01; https://source.android.com/security/bulletin/2022-09-01
CVE: CVE-2021-0942
Published: 2022-09-13
Description: The path in this case is a little bit convoluted. The end result is that via an ioctl an untrusted app can control the ui32PageIndex offset in the expression:sPA.uiAddr = page_to_phys(psOSPageArrayData->pagearray[ui32PageIndex]);With the current PoC this crashes as an OOB read. However, given that the OOB read value is ending up as the address field of a struct I think i seems plausible that this could lead to an OOB write if the attacker is able to cause the OOB read to pull an interesting kernel address. Regardless if this is a read or write, it is a High severity issue in the kernel.Product: AndroidVersions: Android SoCAndroid ID: A-238904312
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2022-09-01; https://source.android.com/security/bulletin/2022-09-01
CVE: CVE-2021-0943
Published: 2022-09-13
Description: In MMU_MapPages of TBD, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-238916921
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2022-09-01; https://source.android.com/security/bulletin/2022-09-01
CVE: CVE-2022-20385
Published: 2022-09-13
Description: a function called 'nla_parse', do not check the len of para, it will check nla_type (which can be controlled by userspace) with 'maxtype' (in this case, it is GSCAN_MAX), then it access polciy array 'policy[type]', which OOB access happens.Product: AndroidVersions: Android SoCAndroid ID: A-238379819
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1284
References: https://source.android.com/security/bulletin/2022-09-01; https://source.android.com/security/bulletin/2022-09-01
CVE: CVE-2022-20386
Published: 2022-09-13
Description: Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227328
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/2022-09-01; https://source.android.com/security/bulletin/2022-09-01
CVE: CVE-2022-20387
Published: 2022-09-13
Description: Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227324
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/2022-09-01; https://source.android.com/security/bulletin/2022-09-01
CVE: CVE-2022-20388
Published: 2022-09-13
Description: Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227323
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/2022-09-01; https://source.android.com/security/bulletin/2022-09-01
CVE: CVE-2022-20389
Published: 2022-09-13
Description: Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257004
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/2022-09-01; https://source.android.com/security/bulletin/2022-09-01
CVE: CVE-2022-20390
Published: 2022-09-13
Description: Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257002
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/2022-09-01; https://source.android.com/security/bulletin/2022-09-01
CVE: CVE-2022-20391
Published: 2022-09-13
Description: Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257000
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/2022-09-01; https://source.android.com/security/bulletin/2022-09-01
CVE: CVE-2022-20392
Published: 2022-09-13
Description: In declareDuplicatePermission of ParsedPermissionUtils.java, there is a possible way to obtain a dangerous permission without user consent due to improper input validation. This could lead to local escalation of privilege during app installation or upgrade with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-213323615
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://source.android.com/security/bulletin/2022-09-01; https://source.android.com/security/bulletin/2022-09-01