deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-44653
Published: 2021-12-15
Description: Online Magazine Management System 1.0 contains a SQL injection authentication bypass vulnerability. The Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form allowing attacker to gain access as admin to the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44653; https://www.exploit-db.com/exploits/50561; https://www.nu11secur1ty.com/2021/12/cve-2021-44653.html
CVE: CVE-2021-44655
Published: 2021-12-15
Description: Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form allowing attacker to get admin access on the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44655; https://www.exploit-db.com/exploits/50560; https://www.nu11secur1ty.com/2021/12/cve-2021-44655.html
CVE: CVE-2021-42216
Published: 2021-12-15
Description: A Broken or Risky Cryptographic Algorithm exists in AnonAddy 0.8.5 via VerificationController.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-326
References: http://anonaddy.com; https://github.com/anonaddy/anonaddy/blob/0478d9e8d364787f[PII_REDACTED]23048a41f022c0/app/Http/Controllers/Auth/VerificationController.php#L67; https://huntr.dev/bounties/419f4e8a-ee15-4f80-bcbf-5c83513515dd
CVE: CVE-2021-0434
Published: 2021-12-15
Description: In onReceive of BluetoothPermissionRequest.java, there is a possible phishing attack allowing a malicious Bluetooth device to acquire permissions based on insufficient information presented to the user in the consent dialog. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-167403112
CVSS Score: 7.3 (HIGH)
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0649
Published: 2021-12-15
Description: In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass. This could lead to local escalation of privilege CONTROL_ALWAYS_ON_VPN with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-191382886
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0650
Published: 2021-12-15
Description: In WT_InterpolateNoLoop of eas_wtengine.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-190286685
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0653
Published: 2021-12-15
Description: In enqueueNotification of NetworkPolicyManagerService.java, there is a possible way to retrieve a trackable identifier due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-177931370
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0675
Published: 2021-12-15
Description: In alac decoder, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06064258; Issue ID: ALPS06064258.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0704
Published: 2021-12-15
Description: In createNoCredentialsPermissionNotification and related functions of AccountManagerService.java, there is a possible way to retrieve accounts from the device without permissions due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-179338675
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-281
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0769
Published: 2021-12-15
Description: In onCreate of AllowBindAppWidgetActivity.java, there is a possible bypass of user interaction requirements due to unclear UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-184676316
CVSS Score: 7.3 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0799
Published: 2021-12-15
Description: In ActivityThread.java, there is a possible way to collide the content provider's authorities. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197647956
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0889
Published: 2021-12-15
Description: In Android TV , there is a possible silent pairing due to lack of rate limiting in the pairing flow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-8.1 Android-9Android ID: A-180745296
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0904
Published: 2021-12-15
Description: In SRAMROM, there is a possible permission bypass due to an insecure permission setting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06076938; Issue ID: ALPS06076938.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0918
Published: 2021-12-15
Description: In gatt_process_notification of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197536150
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0919
Published: 2021-12-15
Description: In getService of IServiceManager.cpp, there is a possible unhandled exception due to an integer overflow. This could lead to local denial of service making the lockscreen unusable with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-197336441
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-190
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0920
Published: 2021-12-15
Description: In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-416, CWE-416
References: https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html; https://source.android.com/security/bulletin/2021-11-01; https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
CVE: CVE-2021-0921
Published: 2021-12-15
Description: In ParsingPackageImpl of ParsingPackageImpl.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-195962697
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0922
Published: 2021-12-15
Description: In enforceCrossUserOrProfilePermission of PackageManagerService.java, there is a possible bypass of INTERACT_ACROSS_PROFILES permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-195630721
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0923
Published: 2021-12-15
Description: In createOrUpdate of Permission.java, there is a possible way to gain internal permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195338390
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0924
Published: 2021-12-15
Description: In xhci_vendor_get_ops of xhci.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194461020References: Upstream kernel
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0925
Published: 2021-12-15
Description: In rw_t4t_sm_detect_ndef of rw_t4t.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure due to a limited change in behavior based on the out of bounds data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-191444150
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0926
Published: 2021-12-15
Description: In onCreate of NfcImportVCardActivity.java, there is a possible way to add a contact without user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-191053931
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0927
Published: 2021-12-15
Description: In requestChannelBrowsable of TvInputManagerService.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-8.1 Android-9Android ID: A-189824175
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0928
Published: 2021-12-15
Description: In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-188675581
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-755
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0929
Published: 2021-12-15
Description: In ion_dma_buf_end_cpu_access and related functions of ion.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-187527909References: Upstream kernel
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0930
Published: 2021-12-15
Description: In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-181660091
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0931
Published: 2021-12-15
Description: In getAlias of BluetoothDevice.java, there is a possible way to create misleading permission dialogs due to missing data filtering. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-180747689
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0932
Published: 2021-12-15
Description: In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent. This could lead to local escalation of privilege that allows actions performed as the System UI with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-173025705
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0933
Published: 2021-12-15
Description: In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consent dialog due to improper input validation. This could lead to remote escalation of privilege, confusing the user into accepting pairing of a malicious Bluetooth device, with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-172251622
CVSS Score: 8.0 (HIGH)
CWE: CWE-20, CWE-116
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-0952
Published: 2021-12-15
Description: In doCropPhoto of PhotoSelectionHandler.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure of user's contacts with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-195748381
CVSS Score: 5.0 (MEDIUM)
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0953
Published: 2021-12-15
Description: In setOnClickActivityIntent of SearchWidgetProvider.java, there is a possible way to access contacts and history bookmarks without permission due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-184046278
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0954
Published: 2021-12-15
Description: In ResolverActivity, there is a possible user interaction bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-143559931
CVSS Score: 7.3 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0955
Published: 2021-12-15
Description: In pf_write_buf of FuseDaemon.cpp, there is possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-192085766
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0956
Published: 2021-12-15
Description: In NfcTag::discoverTechnologies (activation) of NfcTag.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additionalSystem execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-189942532
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0958
Published: 2021-12-15
Description: In update of km_compat.cpp, there is a possible loss of potentially sensitive data due to a logic error in the code. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-200041882
CVSS Score: 4.4 (MEDIUM)
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0961
Published: 2021-12-15
Description: In quota_proc_write of xt_quota2.c, there is a possible way to read kernel memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196046570References: Upstream kernel
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-909
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0963
Published: 2021-12-15
Description: In onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in keychain due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-199754277
CVSS Score: 7.1 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0964
Published: 2021-12-15
Description: In C2SoftMP3::process() of C2SoftMp3Dec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-193363621
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-681
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0965
Published: 2021-12-15
Description: In AndroidManifest.xml of Settings, there is a possible pairing of a Bluetooth device without user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-194300867
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0966
Published: 2021-12-15
Description: In code generated by BuildParcelFields of generate_cpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process due to uninitialized data. This could lead to local information disclosure across Binder transactions with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-198346478
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-909
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0967
Published: 2021-12-15
Description: In vorbis_book_decodev_set of codebook.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-199065614
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0968
Published: 2021-12-15
Description: In osi_malloc and osi_calloc of allocator.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-197868577
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01