deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-15378
Published: 2019-11-14
Description: The Panasonic Eluga Ray 600 Android device with a build fingerprint of Panasonic/ELUGA_Ray_600/ELUGA_Ray_600:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS Score: 5.5 (MEDIUM)
References: https://mobile.panasonic.com/in/advisory; https://www.kryptowire.com/android-firmware-2019/; https://mobile.panasonic.com/in/advisory
CVE: CVE-2019-15379
Published: 2019-11-14
Description: The Walton Primo G3 Android device with a build fingerprint of WALTON/Primo_GM3/Primo_GM3:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS Score: 5.5 (MEDIUM)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15380
Published: 2019-11-14
Description: The Fly Photo Pro Android device with a build fingerprint of Fly/PhotoPro/Photo_Pro:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS Score: 5.5 (MEDIUM)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15381
Published: 2019-11-14
Description: The BQ 5515L Android device with a build fingerprint of BQru/BQru-5515L/BQru-5515L:8.1.0/O11019/20[PII_REDACTED]25:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS Score: 5.5 (MEDIUM)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15382
Published: 2019-11-14
Description: The Cubot Nova Android device with a build fingerprint of CUBOT/CUBOT_NOVA/CUBOT_NOVA:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS Score: 5.5 (MEDIUM)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15383
Published: 2019-11-14
Description: The Allview X5 Android device with a build fingerprint of ALLVIEW/X5_Soul_Mini/X5_Soul_Mini:8.1.0/O11019/[PII_REDACTED]:userdebug/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS Score: 5.5 (MEDIUM)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15384
Published: 2019-11-14
Description: The Elephone A4 Android device with a build fingerprint of Elephone/A4/A4:8.1.0/O11019/20[PII_REDACTED]59:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS Score: 5.5 (MEDIUM)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15385
Published: 2019-11-14
Description: The Infinix Note 5 Android device with a build fingerprint of Infinix/H633B/Infinix-X604_sprout:8.1.0/O11019/L-IN-180206V64:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS Score: 5.5 (MEDIUM)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15386
Published: 2019-11-14
Description: The Lava Z60s Android device with a build fingerprint of LAVA/Z60s/Z60s:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15387
Published: 2019-11-14
Description: The Archos Core 101 Android device with a build fingerprint of archos/MTKAC101CR3G_ARCHOS/ac101cr3g:7.0/NRD90M/20[PII_REDACTED]42:user/release-keys contains a pre-installed app with a package name of com.roco.autogen app (versionCode=1, versionName=1) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface.
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15388
Published: 2019-11-14
Description: The Coolpad 1851 Android device with a build fingerprint of Coolpad/android/android:8.1.0/O11019/[PII_REDACTED]:userdebug/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.1.13). This app contains an exported service named com.lovelyfont.manager.FontCoverService that allows any app co-located on the device to supply arbitrary commands to be executed as the system user. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. In addition to the local attack surface, its accompanying app with a package name of com.ekesoo.lovelyhifonts makes network requests using HTTP and an attacker can perform a Man-in-the-Middle (MITM) attack on the connection to inject a command in a network response that will be executed as the system user by the com.lovelyfont.defcontainer app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing commands as the system user can allow a third-party app to factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15389
Published: 2019-11-14
Description: The Haier A6 Android device with a build fingerprint of Haier/A6/A6:8.1.0/O11019/[PII_REDACTED]:userdebug/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.1.13). This app contains an exported service named com.lovelyfont.manager.FontCoverService that allows any app co-located on the device to supply arbitrary commands to be executed as the system user. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. In addition to the local attack surface, its accompanying app with a package name of com.ekesoo.lovelyhifonts makes network requests using HTTP and an attacker can perform a Man-in-the-Middle (MITM) attack on the connection to inject a command in a network response that will be executed as the system user by the com.lovelyfont.defcontainer app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing commands as the system user can allow a third-party app to factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more.
CVSS Score: 8.1 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15390
Published: 2019-11-14
Description: The Haier G8 Android device with a build fingerprint of Haier/HM-G559-FL/G8:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.qiku.service.container app (versionCode=5, versionName=1.03.00_VER_[PII_REDACTED]8984) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS Score: 5.5 (MEDIUM)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15391
Published: 2019-11-14
Description: The Asus ZenFone 4 Selfie Android device with a build fingerprint of asus/WW_Phone/ASUS_X00LD_1:8.1.0/OPM1.171019.011/15.0400.1809.405-0:user/release-keys contains a pre-installed app with a package name of com.log.logservice app (versionCode=1, versionName=1) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS Score: 5.5 (MEDIUM)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15392
Published: 2019-11-14
Description: The Asus ZenFone 4 Selfie Android device with a build fingerprint of Android/sdm660_64/sdm660_64:8.1.0/OPM1/14.2016.[PII_REDACTED]0419:user/release-keys contains a pre-installed app with a package name of com.log.logservice app (versionCode=1, versionName=1) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS Score: 5.5 (MEDIUM)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15393
Published: 2019-11-14
Description: The Asus ZenFone Live Android device with a build fingerprint of asus/WW_Phone/ASUS_X00LD_3:7.1.1/NMF26F/14.0400.[PII_REDACTED]0720:user/release-keys contains a pre-installed app with a package name of com.asus.atd.smmitest app (versionCode=1, versionName=1) that allows unauthorized wireless settings modification via a confused deputy attack. This capability can be accessed by any app co-located on the device.
CVSS Score: 3.3 (LOW)
CWE: CWE-610
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15394
Published: 2019-11-14
Description: The Asus ZenFone 5 Selfie Android device with a build fingerprint of asus/WW_Phone/ASUS_X017D_1:7.1.1/NMF26F/14.0400.[PII_REDACTED]1107:user/release-keys contains a pre-installed app with a package name of com.asus.atd.smmitest app (versionCode=1, versionName=1) that allows unauthorized wireless settings modification via a confused deputy attack. This capability can be accessed by any app co-located on the device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15395
Published: 2019-11-14
Description: The Asus ZenFone 3s Max Android device with a build fingerprint of asus/IN_X00G/ASUS_X00G_1:7.0/NRD90M/IN_X00G-14.02.1807.33-20180706:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.3_161222) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15396
Published: 2019-11-14
Description: The Asus ZenFone 3 Android device with a build fingerprint of asus/WW_Phone/ASUS_Z012D:7.0/NRD90M/14.2020.1708.56-20170719:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.3_161222) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15397
Published: 2019-11-14
Description: The Asus ZenFone Max 4 Android device with a build fingerprint of asus/WW_Phone/ASUS_X00HD_4:7.1.1/NMF26F/14.2016.[PII_REDACTED]0308:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.4_170901) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15398
Published: 2019-11-14
Description: The Asus ZenFone 4 Selfie Android device with a build fingerprint of asus/WW_Z01M/ASUS_Z01M_1:7.1.1/NMF26F/WW_user_11.40.208.77_20170922:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.3_161222) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15399
Published: 2019-11-14
Description: The Asus ZenFone 5Q Android device with a build fingerprint of asus/WW_Phone/ASUS_X017D_2:7.1.1/NGI77B/14.0400.[PII_REDACTED]1016:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.4_170901) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15400
Published: 2019-11-14
Description: The Asus ZenFone 3 Ultra Android device with a build fingerprint of asus/WW_Phone/ASUS_A001:7.0/NRD90M/14.1010.1804.75-20180612:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.4_170901) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15401
Published: 2019-11-14
Description: The Asus ASUS_A002 Android device with a build fingerprint of asus/WW_ASUS_A002/ASUS_A002:7.0/NRD90M/14.1600.1805.51-20180626:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.4_170901) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15402
Published: 2019-11-14
Description: The Asus ASUS_A002_2 Android device with a build fingerprint of asus/WW_ASUS_A002_2/ASUS_A002_2:7.0/NRD90M/14.1610.1802.18-20180321:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.4_170901) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15403
Published: 2019-11-14
Description: The Asus ZenFone 3s Max Android device with a build fingerprint of asus/IN_X00G/ASUS_X00G_1:7.0/NRD90M/IN_X00G-14.02.1807.33-20180706:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.4_170901) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15404
Published: 2019-11-14
Description: The Asus ZenFone Max 4 Android device with a build fingerprint of asus/WW_Phone/ASUS_X00HD_4:7.1.1/NMF26F/14.2016.[PII_REDACTED]1225:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.4_170901) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15405
Published: 2019-11-14
Description: The Asus ASUS_X00K_1 Android device with a build fingerprint of asus/CN_X00K/ASUS_X00K_1:7.0/NRD90M/CN_X00K-14.01.1711.27-20180420:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.3_161222) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15406
Published: 2019-11-14
Description: The Asus ASUS_X00LD_3 Android device with a build fingerprint of asus/WW_Phone/ASUS_X00LD_3:7.1.1/NMF26F/14.0400.[PII_REDACTED]0720:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.4_170901) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15407
Published: 2019-11-14
Description: The Asus ASUS_X015_1 Android device with a build fingerprint of asus/CN_X015/ASUS_X015_1:7.0/NRD90M/CN_X015-14.00.1709.35-20171215:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.3_161222) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15408
Published: 2019-11-14
Description: The Asus ZenFone 5 Lite Android device with a build fingerprint of asus/WW_Phone/ASUS_X017D_1:7.1.1/NMF26F/14.0400.[PII_REDACTED]1107:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.4_170901) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15409
Published: 2019-11-14
Description: The Asus ZenFone 5Q Android device with a build fingerprint of asus/WW_Phone/ASUS_X017D_2:7.1.1/NGI77B/14.0400.[PII_REDACTED]1016:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=[PII_REDACTED], versionName=7.0.0.4_170901) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/