deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-20471
Published: 2022-12-13
Description: In SendIncDecRestoreCmdPart2 of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-238177877
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20472
Published: 2022-12-13
Description: In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-239210579
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20473
Published: 2022-12-13
Description: In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-239267173
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20474
Published: 2022-12-13
Description: In readLazyValue of Parcel.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-240138294
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20475
Published: 2022-12-13
Description: In test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting="true" due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-240663194
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20476
Published: 2022-12-13
Description: In setEnabledSetting of PackageManager.java, there is a possible way to get the device into an infinite reboot loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-240936919
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20477
Published: 2022-12-13
Description: In shouldHideNotification of KeyguardNotificationVisibilityProvider.kt, there is a possible way to show hidden notifications due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-241611867
CVSS Score: 7.8 (HIGH)
CWE: CWE-783
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20478
Published: 2022-12-13
Description: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-241764135
CVSS Score: 7.8 (HIGH)
CWE: CWE-770, CWE-770
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20479
Published: 2022-12-13
Description: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-241764340
CVSS Score: 7.8 (HIGH)
CWE: CWE-770, CWE-770
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20480
Published: 2022-12-13
Description: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-241764350
CVSS Score: 7.8 (HIGH)
CWE: CWE-770
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20482
Published: 2022-12-13
Description: In createNotificationChannel of NotificationManager.java, there is a possible way to make the device unusable and require factory reset due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-240422263
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20483
Published: 2022-12-13
Description: In several functions that parse avrc response in avrc_pars_ct.cc and related files, there are possible out of bounds reads due to integer overflows. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242459126
CVSS Score: 7.5 (HIGH)
CWE: CWE-191, CWE-191
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20484
Published: 2022-12-13
Description: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242702851
CVSS Score: 7.8 (HIGH)
CWE: CWE-770, CWE-770
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20485
Published: 2022-12-13
Description: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242702935
CVSS Score: 7.8 (HIGH)
CWE: CWE-770, CWE-770
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20486
Published: 2022-12-13
Description: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703118
CVSS Score: 7.8 (HIGH)
CWE: CWE-770, CWE-770
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20487
Published: 2022-12-13
Description: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703202
CVSS Score: 7.8 (HIGH)
CWE: CWE-770, CWE-770
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20488
Published: 2022-12-13
Description: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703217
CVSS Score: 7.8 (HIGH)
CWE: CWE-1284, CWE-1284
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20491
Published: 2022-12-13
Description: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703556
CVSS Score: 7.8 (HIGH)
CWE: CWE-1284, CWE-1284
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20495
Published: 2022-12-13
Description: In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility service due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-243849844
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20496
Published: 2022-12-13
Description: In setDataSource of initMediaExtractor.cpp, there is a possibility of arbitrary code execution due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-245242273
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20497
Published: 2022-12-13
Description: In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifications on the lockscreen due to an incorrect state transition. This could lead to local information disclosure with physical access required and an app that runs above the lockscreen, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-246301979
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20498
Published: 2022-12-13
Description: In fdt_path_offset_namelen of fdt_ro.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246465319
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20500
Published: 2022-12-13
Description: In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246540168
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20501
Published: 2022-12-13
Description: In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246933359
CVSS Score: 7.3 (HIGH)
CWE: CWE-1021, CWE-1021
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20502
Published: 2022-12-13
Description: In GetResolvedMethod of entrypoint_utils-inl.h, there is a possible use after free due to a stale cache. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-222166527
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-20611
Published: 2022-12-13
Description: In deletePackageVersionedInternal of DeletePackageHelper.java, there is a possible way to bypass carrier restrictions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242996180
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://source.android.com/security/bulletin/2022-12-01; https://source.android.com/security/bulletin/2022-12-01
CVE: CVE-2022-25672
Published: 2022-12-13
Description: Denial of service in MODEM due to reachable assertion while processing SIB1 with invalid Bandwidth in Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25673
Published: 2022-12-13
Description: Denial of service in MODEM due to reachable assertion while processing configuration from network in Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25675
Published: 2022-12-13
Description: Denial of service due to reachable assertion in modem while processing filter rule from application client in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25677
Published: 2022-12-13
Description: Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25681
Published: 2022-12-13
Description: Possible memory corruption in kernel while performing memory access due to hypervisor not correctly invalidated the processor translation caches in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25682
Published: 2022-12-13
Description: Memory corruption in MODEM UIM due to usage of out of range pointer offset while decoding command from card in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25685
Published: 2022-12-13
Description: Denial of service in Modem module due to improper authorization while error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25689
Published: 2022-12-13
Description: Denial of service in Modem due to reachable assertion in Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25691
Published: 2022-12-13
Description: Denial of service in Modem due to reachable assertion while processing SIB1 with invalid SCS and bandwidth settings in Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25692
Published: 2022-12-13
Description: Denial of service in Modem due to reachable assertion while processing the common config procedure in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25695
Published: 2022-12-13
Description: Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-129, CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25697
Published: 2022-12-13
Description: Memory corruption in i2c buses due to improper input validation while reading address configuration from i2c driver in Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25698
Published: 2022-12-13
Description: Memory corruption in SPI buses due to improper input validation while reading address configuration from spi buses in Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25702
Published: 2022-12-13
Description: Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25711
Published: 2022-12-13
Description: Memory corruption in camera due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-129, CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-25712
Published: 2022-12-13
Description: Memory corruption in camera due to buffer copy without checking size of input in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin
CVE: CVE-2022-27581
Published: 2022-12-13
Description: Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327, CWE-327, CWE-327
References: https://sick.com/psirt; https://sick.com/psirt
CVE: CVE-2022-31696
Published: 2022-12-13
Description: VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.vmware.com/security/advisories/VMSA-2022-0030.html; https://www.vmware.com/security/advisories/VMSA-2022-0030.html