deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-0391
Published: 2021-03-10
Description: In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-172841550
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2021-03-01; https://source.android.com/security/bulletin/2021-03-01
CVE: CVE-2021-0392
Published: 2021-03-10
Description: In main of main.cpp, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-175124730
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://source.android.com/security/bulletin/2021-03-01; https://source.android.com/security/bulletin/2021-03-01
CVE: CVE-2021-0393
Published: 2021-03-10
Description: In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if an attacker can supply a malicious PAC file, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-168041375
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787
References: https://source.android.com/security/bulletin/2021-03-01; https://source.android.com/security/bulletin/2021-03-01
CVE: CVE-2021-0394
Published: 2021-03-10
Description: In android_os_Parcel_readString8 of android_os_Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-172655291
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2021-03-01; https://source.android.com/security/bulletin/2021-03-01
CVE: CVE-2021-0395
Published: 2021-03-10
Description: In StopServicesAndLogViolations of reboot.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-170315126
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2021-03-01; https://source.android.com/security/bulletin/2021-03-01
CVE: CVE-2021-0396
Published: 2021-03-10
Description: In Builtins::Generate_ArgumentsAdaptorTrampoline of builtins-arm.cc and related files, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-160610106
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-03-01; https://source.android.com/security/bulletin/2021-03-01
CVE: CVE-2021-0397
Published: 2021-03-10
Description: In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174052148
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://source.android.com/security/bulletin/2021-03-01; https://source.android.com/security/bulletin/2021-03-01
CVE: CVE-2021-0398
Published: 2021-03-10
Description: In bindServiceLocked of ActiveServices.java, there is a possible foreground service launch due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173516292
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2021-03-01; https://source.android.com/security/bulletin/2021-03-01
CVE: CVE-2021-0399
Published: 2021-03-10
Description: In qtaguid_untag of xt_qtaguid.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-176919394References: Upstream kernel
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2021-03-01; https://source.android.com/security/bulletin/2021-03-01
CVE: CVE-2021-20265
Published: 2021-03-10
Description: A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1908827; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fa0dc04df259ba2df3ce1920e9690c7842f8fa4b; https://www.oracle.com/security-alerts/cpuoct2021.html
CVE: CVE-2021-24025
Published: 2021-03-10
Description: Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading to a heap overflow. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-190
References: https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca; https://hhvm.com/blog/2021/02/25/security-update.html; https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca
CVE: CVE-2021-24030
Published: 2021-03-10
Description: The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows a malicious URL to cause code execution. This issue affects versions prior to v1.26.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88, CWE-88
References: https://www.facebook.com/security/advisories/cve-2021-24030; https://www.facebook.com/security/advisories/cve-2021-24030
CVE: CVE-2021-0379
Published: 2021-03-10
Description: In getUpTo17bits of pvmp3_getbits.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-154075955
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0380
Published: 2021-03-10
Description: In onReceive of DcTracker.java, there is a possible way to trigger a provisioning URL and modify other telephony settings due to a missing permission check. This could lead to local escalation of privilege during the onboarding flow with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-172459128
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0381
Published: 2021-03-10
Description: In updateNotifications of DeviceStorageMonitorService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153466381
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0382
Published: 2021-03-10
Description: In checkSlicePermission of SliceManagerService.java, there is a possible resource exposure due to an incorrect permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-140727941
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0383
Published: 2021-03-10
Description: In done of CaptivePortalLoginActivity.java, there is a confused deputy. This could lead to local escalation of privilege in carrier settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-160871056
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0384
Published: 2021-03-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-0385
Published: 2021-03-10
Description: In createConnectToAvailableNetworkNotification of ConnectToNetworkNotificationBuilder.java, there is a possible connection to untrusted WiFi networks due to notification interaction above the lockscreen. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-172584372
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0386
Published: 2021-03-10
Description: In onCreate of UsbConfirmActivity, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173421110
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0387
Published: 2021-03-10
Description: In FindQuotaDeviceForUuid of QuotaUtils.cpp, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-169421939
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0388
Published: 2021-03-10
Description: In onReceive of ImsPhoneCallTracker.java, there is a possible misattribution of data usage due to an incorrect broadcast handler. This could lead to local escalation of privilege resulting in attributing video call data to the wrong app, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-162741489
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0389
Published: 2021-03-10
Description: In setNightModeActivated of UiModeManagerService.java, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-168039904
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0449
Published: 2021-03-10
Description: In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175117965
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-665
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0450
Published: 2021-03-10
Description: In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175117880
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-665
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0451
Published: 2021-03-10
Description: In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175117871
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-665
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0452
Published: 2021-03-10
Description: In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175117261
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-665
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0453
Published: 2021-03-10
Description: In the Titan-M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175117199
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-665
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0454
Published: 2021-03-10
Description: In the Citadel chip firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175117047
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0455
Published: 2021-03-10
Description: In the Citadel chip firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175116439
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0456
Published: 2021-03-10
Description: In the Citadel chip firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174769927
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0457
Published: 2021-03-10
Description: In the FingerTipS touch screen driver, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-157155375
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://www.zerodayinitiative.com/advisories/ZDI-21-279/; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0458
Published: 2021-03-10
Description: In the FingerTipS touch screen driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-157156744
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://www.zerodayinitiative.com/advisories/ZDI-21-280/; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0459
Published: 2021-03-10
Description: In fts_driver_test_write of fts_proc.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-157154534
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://www.zerodayinitiative.com/advisories/ZDI-21-278/; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0460
Published: 2021-03-10
Description: In the FingerTipS touch screen driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-156739245
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0461
Published: 2021-03-10
Description: In iaxxx_core_sensor_change_state of iaxxx-module.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175124074
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0462
Published: 2021-03-10
Description: In the NXP NFC firmware, there is a possible insecure firmware update due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168799695
CVSS Score: 6.7 (MEDIUM)
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-08-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0463
Published: 2021-03-10
Description: In convertToHidl of convert.cpp, there is a possible out of bounds read due to uninitialized data from ReturnFrameworkMessage. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154867068
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-908
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0464
Published: 2021-03-10
Description: In sound_trigger_event_alloc of platform.h, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-167663878
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-0465
Published: 2021-03-10
Description: In GenerateFaceMask of face.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-172005755
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-03-01; https://source.android.com/security/bulletin/pixel/2021-03-01
CVE: CVE-2021-20205
Published: 2021-03-10
Description: Libjpeg-turbo versions 2.0.91 and 2.0.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted GIF image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://bugzilla.redhat.com/show_bug.cgi?id=1937385; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMLEY6HLVZAGXIOGGPPUAMRJUA6LB3FD/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TM3AHZEYGYFEDL6AW5RLEAJNVRWEJDFL/
CVE: CVE-2021-21772
Published: 2021-03-10
Description: A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHMMHD2EOMIVJ7EKZTJJMX4C7E6ZRWDL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPBS642OYVA6DUKK3HZHEINVWEDZSMEU/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDGGB65YBQL662M3MOBNNJJNRNURW4TG/
CVE: CVE-2020-19417
Published: 2021-03-10
Description: Emerson Smart Wireless Gateway 1420 4.6.59 allows non-privileged users (such as the default account 'maint') to perform administrative tasks by sending specially crafted HTTP requests to the application.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/161700/Emerson-Smart-Wireless-Gateway-1420-4.6.59-Privilege-Escalation.html; http://packetstormsecurity.com/files/161700/Emerson-Smart-Wireless-Gateway-1420-4.6.59-Privilege-Escalation.html