deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-18839
Published: 2019-11-13
Description: FUDForum 3.0.9 is vulnerable to Stored XSS via the nlogin parameter. This may result in remote code execution. An attacker can use a user account to fully compromise the system using a POST request. When the admin visits the user information, the payload will execute. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-78, CWE-79
References: https://github.com/fuzzlove/FUDforum-XSS-RCE; https://packetstormsecurity.com/files/155261/FUDForum-3.0.9-Code-Execution-Cross-Site-Scripting.html; https://github.com/fuzzlove/FUDforum-XSS-RCE
CVE: CVE-2019-5287
Published: 2019-11-13
Description: P30 smart phones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1) have an integer overflow vulnerability due to insufficient check on specific parameters. An attacker tricks the user into installing a malicious application, obtains the root permission and constructs specific parameters to the camera program to exploit this vulnerability. Successful exploit could cause the program to break down or allow for arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190925-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190925-01-smartphone-en
CVE: CVE-2019-5288
Published: 2019-11-13
Description: P30 smart phones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1) have an integer overflow vulnerability due to insufficient check on specific parameters. An attacker tricks the user into installing a malicious application, obtains the root permission and constructs specific parameters to the camera program to exploit this vulnerability. Successful exploit could cause the program to break down or allow for arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190925-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190925-01-smartphone-en
CVE: CVE-2012-4384
Published: 2019-11-13
Description: letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in Calendar
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/08/31/19; https://security-tracker.debian.org/tracker/CVE-2012-4384; http://www.openwall.com/lists/oss-security/2012/08/31/19
CVE: CVE-2013-4654
Published: 2019-11-13
Description: Symlink Traversal vulnerability in TP-LINK TL-WDR4300 and TL-1043ND..
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.ise.io/casestudies/exploiting-soho-routers/; https://www.ise.io/soho_service_hacks/; https://www.ise.io/wp-content/uploads/2017/07/soho_techreport.pdf
CVE: CVE-2013-4655
Published: 2019-11-13
Description: Symlink Traversal vulnerability in Belkin N900 due to misconfiguration in the SMB service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: https://www.ise.io/casestudies/exploiting-soho-routers/; https://www.ise.io/soho_service_hacks/; https://www.ise.io/wp-content/uploads/2017/07/soho_techreport.pdf
CVE: CVE-2014-3592
Published: 2019-11-13
Description: OpenShift Origin: Improperly validated team names could allow stored XSS attacks
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/cve-2014-3592; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3592; https://access.redhat.com/security/cve/cve-2014-3592
CVE: CVE-2014-3655
Published: 2019-11-13
Description: JBoss KeyCloak is vulnerable to soft token deletion via CSRF
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://access.redhat.com/security/cve/cve-2014-3655; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3655; https://snyk.io/vuln/SNYK-JAVA-ORGKEYCLOAK-30138
CVE: CVE-2019-15948
Published: 2019-11-13
Description: Texas Instruments CC256x and WL18xx dual-mode Bluetooth controller devices, when LE scan mode is used, allow remote attackers to trigger a buffer overflow via a malformed Bluetooth Low Energy advertising packet, to cause a denial of service or potentially execute arbitrary code. This affects CC256xC-BT-SP 1.2, CC256xB-BT-SP 1.8, and WL18xx-BT-SP 4.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://e2e.ti.com/support/wireless-connectivity/bluetooth/f/538/t/856161; https://github.com/darkmentorllc/jackbnimble/blob/master/host/pocs/ti_wl18xx_adv_rce.py; https://github.com/darkmentorllc/publications/tree/master/2020/TI_SILABS_BLE_RCEs
CVE: CVE-2019-18929
Published: 2019-11-13
Description: Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest accounts) to remotely execute arbitrary code via a download_mgr.cgi stack-based buffer overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/DelspoN/CVE/blob/master/CVE-2019-18929/description.txt; https://github.com/DelspoN/CVE/tree/master/CVE-2019-18929; https://github.com/DelspoN/CVE/blob/master/CVE-2019-18929/description.txt
CVE: CVE-2019-18930
Published: 2019-11-13
Description: Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest account) to remotely execute arbitrary code via a stack-based buffer overflow. There is no size verification logic in one of functions in libscheddl.so, and download_mgr.cgi makes it possible to enter large-sized f_idx inputs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/DelspoN/CVE/blob/master/CVE-2019-18930/description.txt; https://github.com/DelspoN/CVE/tree/master/CVE-2019-18930; https://github.com/DelspoN/CVE/blob/master/CVE-2019-18930/description.txt
CVE: CVE-2019-18931
Published: 2019-11-13
Description: Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows a Buffer Overflow with Extended Instruction Pointer (EIP) control via crafted GET/POST parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/DelspoN/CVE/blob/master/CVE-2019-18931/description.txt; https://github.com/DelspoN/CVE/tree/master/CVE-2019-18931; https://github.com/DelspoN/CVE/blob/master/CVE-2019-18931/description.txt
CVE: CVE-2019-4159
Published: 2019-11-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-5292
Published: 2019-11-13
Description: Honor 10 Lite, Honor 8A, Huawei Y6 mobile phones with the versions before 9.1.0.217(C00E215R3P1), the versions before 9.1.0.205(C00E97R1P9), the versions before 9.1.0.205(C00E97R2P2) have an information leak vulnerability. Due to improper function error records of some module, an attacker with the access permission may exploit the vulnerability to obtain some information.
CVSS Score: 3.3 (LOW)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-phone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-phone-en
CVE: CVE-2012-4385
Published: 2019-11-13
Description: letodms 3.3.6 has CSRF via change password
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2012/08/31/19; https://security-tracker.debian.org/tracker/CVE-2012-4385; https://vulmon.com/exploitdetails?qidtp=EDB&qid=20759
CVE: CVE-2014-8167
Published: 2019-11-13
Description: vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://access.redhat.com/security/cve/cve-2014-8167; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8167; https://access.redhat.com/security/cve/cve-2014-8167
CVE: CVE-2019-16948
Published: 2019-11-13
Description: An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at WebServiceLocation=http://localhost:8085/UCWebServices/ with a range of ports to determine what is visible on the internal network (as opposed to what general web traffic would see on the product's host). The response from open ports is different than from closed ports. The product does not allow one to change the protocol: anything except http(s) will throw an error; however, it is the type of error that allows one to determine if a port is open or not.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/; https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/
CVE: CVE-2019-5289
Published: 2019-11-13
Description: Gauss100 OLTP database in ManageOne with versions of 6.5.0 have an out-of-bounds read vulnerability due to the insufficient checks of the specific packet length. Attackers can construct invalid packets to attack the active and standby communication channels. Successful exploit of this vulnerability could allow the attacker to crash the database on the standby node.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190925-01-database-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190925-01-database-en
CVE: CVE-2019-5293
Published: 2019-11-13
Description: Some Huawei products have a memory leak vulnerability when handling some messages. A remote attacker with operation privilege could exploit the vulnerability by sending specific messages continuously. Successful exploit may cause some service to be abnormal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191023-01-memory-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191023-01-memory-en
CVE: CVE-2019-5294
Published: 2019-11-13
Description: There is an out of bound read vulnerability in some Huawei products. A remote, unauthenticated attacker may send a corrupt or crafted message to the affected products. Due to a buffer read overflow error when parsing the message, successful exploit may cause some service to be abnormal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191023-01-buffer-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191023-01-buffer-en
CVE: CVE-2010-4532
Published: 2019-11-13
Description: offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://access.redhat.com/security/cve/cve-2010-4532; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=603450; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4532
CVE: CVE-2011-3586
Published: 2019-11-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-3504. Reason: This candidate is a duplicate of CVE-2011-3504. Notes: All CVE users should reference CVE-2011-3504 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-4657
Published: 2019-11-13
Description: Symlink Traversal vulnerability in NETGEAR WNR3500U and WNR3500L due to misconfiguration in the SMB service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.ise.io/soho_service_hacks/; https://www.ise.io/soho_service_hacks/
CVE: CVE-2019-16949
Published: 2019-11-13
Description: An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at the beginning of the chat (where the user enters in their name and e-mail address). This POST request can be modified to change the message as well as the end recipient of the message. The e-mail address will have the same domain name and user as the product allotted. This can be used in phishing campaigns against users on the same domain.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/; https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/
CVE: CVE-2019-18279
Published: 2019-11-13
Description: In Phoenix SCT WinFlash 1.1.12.0 through 1.5.74.0, the included drivers could be used by a malicious Windows application to gain elevated privileges. Adverse impacts are limited to the Windows environment and there is no known direct impact to the UEFI firmware. This was fixed in late June 2019.
CVSS Score: 8.8 (HIGH)
References: https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/; https://eclypsium.com/wp-content/uploads/2019/08/EXTERNAL-Get-off-the-kernel-if-you-cant-drive-DEFCON27.pdf; https://www.phoenix.com/content/uploads/Security-Newsletter-September-2019.pdf
CVE: CVE-2019-2036
Published: 2019-11-13
Description: In okToConnect of HidHostService.java, there is a possible permission bypass due to an incorrect state check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-79703832
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2192
Published: 2019-11-13
Description: In call of SliceProvider.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-138441555
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2193
Published: 2019-11-13
Description: In WelcomeActivity.java and related files, there is a possible permissions bypass due to a partially provisioned Device Policy Client. This could lead to local escalation of privilege, leaving an Admin app installed with no indication to the user, with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-132261064
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2195
Published: 2019-11-13
Description: In tokenize of sqlite3_android.cpp, there is a possible attacker controlled INSERT statement due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139186193
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-89
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2196
Published: 2019-11-13
Description: In Download Provider, there is possible SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-135269143
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2197
Published: 2019-11-13
Description: In processPhonebookAccess of CachedBluetoothDevice.java, there is a possible permission bypass due to an insecure default value. This could lead to local information disclosure of the user's contact list with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-138529441
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1188
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2198
Published: 2019-11-13
Description: In Download Provider, there is a possible SQL injection vulnerability. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-135270103
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2199
Published: 2019-11-13
Description: In createSessionInternal of PackageInstallerService.java, there is a possible permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-138650665
CVSS Score: 6.7 (MEDIUM)
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2201
Published: 2019-11-13
Description: In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-120551338
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00048.html; https://lists.apache.org/thread.html/rc800763a88775ac9abb83b3402bcd0913d41ac65fdfc759af38f2280%40%3Ccommits.mxnet.apache.org%3E
CVE: CVE-2019-2202
Published: 2019-11-13
Description: In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-137283376
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2203
Published: 2019-11-13
Description: In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-137370777
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2204
Published: 2019-11-13
Description: In FindSharedFunctionInfo of objects.cc, there is a possible out of bounds read due to a mistake in AST traversal. This could lead to remote code execution in the pacprocessor with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9 Android ID: A-138442295
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2020-01-01; https://source.android.com/security/bulletin/2020-01-01
CVE: CVE-2019-2205
Published: 2019-11-13
Description: In ProxyResolverV8::SetPacScript of proxy_resolver_v8.cc, there is a possible memory corruption due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139806216
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2206
Published: 2019-11-13
Description: In rw_i93_sm_set_read_only of rw_i93.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139188579
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2207
Published: 2019-11-13
Description: In nfa_hci_handle_admin_gate_rsp of nfa_hci_act.cc, there is a possible out of bound write due to missing bounds checks. This could lead to local escalation of privilege with system execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-124524315
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2208
Published: 2019-11-13
Description: In PromiseBuiltinsAssembler::NewPromiseCapability of builtins-promise.cc, there is a possible out of bounds read in v8 JIT code due to a bug in code generation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9 Android ID: A-138441919
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2020-01-01; https://source.android.com/security/bulletin/2020-01-01
CVE: CVE-2019-2209
Published: 2019-11-13
Description: In BTA_DmPinReply of bta_dm_api.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139287605
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2211
Published: 2019-11-13
Description: In createProjectionMapForQuery of TvProvider.java, there is possible SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-135269669
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2212
Published: 2019-11-13
Description: In poisson_distribution of random, there is an out of bounds read. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139690488
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01
CVE: CVE-2019-2213
Published: 2019-11-13
Description: In binder_free_transaction of binder.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-133758011References: Upstream kernel
CVSS Score: 7.4 (HIGH)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/2019-11-01; https://source.android.com/security/bulletin/2019-11-01