deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-13729
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13730
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13731
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13732
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13733
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13734
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13735
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13736
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13737
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13738
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13739
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13740
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13741
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13742
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13743
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13744
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13745
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13746
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13747
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13748
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13749
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13750
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13751
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-13752
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2021-24046
Published: 2022-01-14
Description: A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebook View application. This issue affected versions of device software before 2[PII_REDACTED].0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-471, CWE-425
References: https://www.facebook.com/security/advisories/cve-2021-24046; https://www.facebook.com/security/advisories/cve-2021-24046
CVE: CVE-2021-36734
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none
CVE: CVE-2021-36735
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none
CVE: CVE-2021-36736
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none
CVE: CVE-2021-45468
Published: 2022-01-14
Description: Imperva Web Application Firewall (WAF) before 2021-12-23 allows remote unauthenticated attackers to use "Content-Encoding: gzip" to evade WAF security controls and send malicious HTTP POST requests to web servers behind the WAF.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: https://bishopfox.com/blog/imperva-eliminates-critical-exposure; https://bishopfox.com/blog/imperva-eliminates-critical-exposure
CVE: CVE-2022-0224
Published: 2022-01-14
Description: dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/dolibarr/dolibarr/commit/b9b45fb50618aa8053961f50bc8604b188d0ea79; https://huntr.dev/bounties/f1d1ce3e-ca92-4c7b-b1b8-934e28eaa486; https://github.com/dolibarr/dolibarr/commit/b9b45fb50618aa8053961f50bc8604b188d0ea79
CVE: CVE-2022-23227
Published: 2022-01-14
Description: NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd; https://github.com/rapid7/metasploit-framework/pull/16044; https://news.ycombinator.com/item?id=29936569
CVE: CVE-2021-45761
Published: 2022-01-14
Description: ROPium v3.1 was discovered to contain an invalid memory address dereference via the find() function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/Boyan-MILANOV/ropium/issues/32; https://github.com/Boyan-MILANOV/ropium/issues/32
CVE: CVE-2021-45762
Published: 2022-01-14
Description: GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function gf_sg_vrml_mf_reset(). This vulnerability allows attackers to cause a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/gpac/gpac/issues/1978; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1978
CVE: CVE-2021-45763
Published: 2022-01-14
Description: GPAC v1.1.0 was discovered to contain an invalid call in the function gf_node_changed(). This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/gpac/gpac/issues/1974; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1974
CVE: CVE-2022-0226
Published: 2022-01-14
Description: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/livehelperchat/livehelperchat/commit/f59ffb02984c0ce2fbb19ac[PII_REDACTED]7de9370; https://huntr.dev/bounties/635d0abf-7680-47f6-a277-d9a91471c73f; https://github.com/livehelperchat/livehelperchat/commit/f59ffb02984c0ce2fbb19ac[PII_REDACTED]7de9370
CVE: CVE-2021-0959
Published: 2022-01-14
Description: In jit_memory_region.cc, there is a possible bypass of memory restrictions due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-200284993
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-1035
Published: 2022-01-14
Description: In setLaunchIntent of BluetoothDevicePickerPreferenceController.java, there is a possible way to invoke an arbitrary broadcast receiver due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-12Android ID: A-195668284
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://source.android.com/security/bulletin/aaos/2022-01-01; https://source.android.com/security/bulletin/aaos/2022-01-01
CVE: CVE-2021-1036
Published: 2022-01-14
Description: In LocationSettingsActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-182812255
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/aaos/2022-01-01; https://source.android.com/security/bulletin/aaos/2022-01-01
CVE: CVE-2021-1037
Published: 2022-01-14
Description: The broadcast that DevicePickerFragment sends when a new device is paired doesn't have any permission checks, so any app can register to listen for it. This lets apps keep track of what devices are paired without requesting BLUETOOTH permissions.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-162951906
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/aaos/2022-01-01; https://source.android.com/security/bulletin/aaos/2022-01-01
CVE: CVE-2021-1049
Published: 2022-01-14
Description: Hacker one bug ID: 1343975Product: AndroidVersions: Android SoCAndroid ID: A-204256722
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-20612
Published: 2022-01-14
Description: Lack of administrator control over security vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.14 and prior, FX3U-ENET-L Firmware version 1.14 and prior and FX3U-ENET-P502 Firmware version 1.14 and prior allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition in communication function of the product or other unspecified effects by sending specially crafted packets to an unnecessary opening of TCP port. Control by MELSEC-F series PLC is not affected by this vulnerability, but system reset is required for recovery.
CVSS Score: 7.5 (HIGH)
References: https://jvn.jp/vu/JVNVU93268332/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-013-01; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-023_en.pdf
CVE: CVE-2021-20613
Published: 2022-01-14
Description: Improper initialization vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.16 and prior, FX3U-ENET-L Firmware version 1.16 and prior and FX3U-ENET-P502 Firmware version 1.16 and prior allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition in communication function of the product by sending specially crafted packets. Control by MELSEC-F series PLC is not affected by this vulnerability, but system reset is required for recovery.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665
References: https://jvn.jp/vu/JVNVU93268332/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-013-07; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-024_en.pdf
CVE: CVE-2021-23138
Published: 2022-01-14
Description: WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-03; https://www.zerodayinitiative.com/advisories/ZDI-22-129/; https://www.zerodayinitiative.com/advisories/ZDI-22-131/
CVE: CVE-2021-23157
Published: 2022-01-14
Description: WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-03; https://www.zerodayinitiative.com/advisories/ZDI-22-130/; https://www.zerodayinitiative.com/advisories/ZDI-22-132/
CVE: CVE-2021-23566
Published: 2022-01-14
Description: The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-704
References: https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444; https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575; https://github.com/ai/nanoid/pull/328
CVE: CVE-2021-23567
Published: 2022-01-14
Description: The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6%23diff-92bbac9a308cd5fcf9db165841f2d90ce981baddcb2b1e26cfff170929af3bd1R18; https://github.com/Marak/colors.js/issues/285; https://github.com/Marak/colors.js/issues/285%23issuecomment[PII_REDACTED]
CVE: CVE-2021-28500
Published: 2022-01-14
Description: An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-285
References: https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071; https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071
CVE: CVE-2021-28501
Published: 2022-01-14
Description: An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-285
References: https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071; https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071
CVE: CVE-2021-28506
Published: 2022-01-14
Description: An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-285, CWE-306, CWE-862
References: https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071; https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071
CVE: CVE-2021-28507
Published: 2022-01-14
Description: An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the denied requests being forwarded to the agent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071; https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071
CVE: CVE-2021-36199
Published: 2022-01-14
Description: Running a vulnerability scanner against VideoEdge NVRs can cause some functionality to stop.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-228
References: https://us-cert.gov/ics/advisories/ICSA-22-011-01; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://us-cert.gov/ics/advisories/ICSA-22-011-01
CVE: CVE-2021-36920
Published: 2022-01-14
Description: Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-4-6-authenticated-reflected-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/download-monitor/#developers; https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-4-6-authenticated-reflected-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-38126
Published: 2022-01-14
Description: Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://portal.microfocus.com/s/article/KM000003453?language=en_US; https://portal.microfocus.com/s/article/KM000003453?language=en_US
CVE: CVE-2021-38127
Published: 2022-01-14
Description: Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://portal.microfocus.com/s/article/KM000003453?language=en_US; https://portal.microfocus.com/s/article/KM000003453?language=en_US
CVE: CVE-2021-39618
Published: 2022-01-14
Description: In multiple methods of EuiccNotificationManager.java, there is a possible way to install existing packages without user consent due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-196855999
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39620
Published: 2022-01-14
Description: In ipcSetDataReference of Parcel.cpp, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-203847542
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39621
Published: 2022-01-14
Description: In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-185126319
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39622
Published: 2022-01-14
Description: In GBoard, there is a possible way to bypass Factory Reset Protection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-192663648
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39623
Published: 2022-01-14
Description: In doRead of SimpleDecodingSource.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-194105348
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39625
Published: 2022-01-14
Description: In showCarrierAppInstallationNotification of EuiccNotificationManager.java, there is a possible way to gain an access to MediaProvider content due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-194695347
CVSS Score: 7.3 (HIGH)
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39626
Published: 2022-01-14
Description: In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege in Bluetooth settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-194695497
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01