deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-1015
Published: 2021-12-15
Description: In getMeidForSlot of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-186530496
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1016
Published: 2021-12-15
Description: In onCreate of UsbPermissionActivity.java, there is a possible way to grant an app access to USB without informed user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-183610267
CVSS Score: 7.3 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1017
Published: 2021-12-15
Description: In AdapterService and GattService definition of AndroidManifest.xml, there is a possible way to disable bluetooth connection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-182583850
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1018
Published: 2021-12-15
Description: In adjustStreamVolume of AudioService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-194110891
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1019
Published: 2021-12-15
Description: In snoozeNotification of NotificationListenerService.java, there is a possible permission confusion due to a misleading user consent dialog. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195031401
CVSS Score: 7.3 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1020
Published: 2021-12-15
Description: In snoozeNotification of NotificationListenerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195111725
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1021
Published: 2021-12-15
Description: In snoozeNotificationInt of NotificationManagerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195031703
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1022
Published: 2021-12-15
Description: In btif_in_hf_client_generic_evt of btif_hf_client.cc, there is a possible Bluetooth service crash due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-180420059
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1023
Published: 2021-12-15
Description: In onCreate of RequestIgnoreBatteryOptimizations.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195963373
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1024
Published: 2021-12-15
Description: In onEventReceived of EventResultPersister.java, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-191283525
CVSS Score: 6.7 (MEDIUM)
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1025
Published: 2021-12-15
Description: In hasNamedWallpaper of WallpaperManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-193800652
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1026
Published: 2021-12-15
Description: In startRanging of RttServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-194798757
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1027
Published: 2021-12-15
Description: In setTransactionState of SurfaceFlinger, there is possible arbitrary code execution in a privileged process due to improper casting. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-193033243
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1028
Published: 2021-12-15
Description: In setClientStateLocked of SurfaceFlinger.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-193034683
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1029
Published: 2021-12-15
Description: In setClientStateLocked of SurfaceFlinger.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-193034677
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1030
Published: 2021-12-15
Description: In setNotificationsShownFromListener of NotificationManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-194697001
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1031
Published: 2021-12-15
Description: In cancelNotificationsFromListener of NotificationManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-194697004
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1032
Published: 2021-12-15
Description: In getMimeGroup of PackageManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-184745603
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1034
Published: 2021-12-15
Description: In getLine1NumberForDisplay of PhoneInterfaceManager.java, there is apossible way to determine whether an app is installed, without querypermissions due to a missing permission check. This could lead to localinformation disclosure with no additional execution privileges needed. Userinteraction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-193441322
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1038
Published: 2021-12-15
Description: In UserDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-183411279
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/aaos/2021-12-01; https://source.android.com/security/bulletin/aaos/2021-12-01
CVE: CVE-2021-1039
Published: 2021-12-15
Description: In NotificationAccessActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-182808318
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/aaos/2021-12-01; https://source.android.com/security/bulletin/aaos/2021-12-01
CVE: CVE-2021-1040
Published: 2021-12-15
Description: In onCreate of BluetoothPairingSelectionFragment.java, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-182810085
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/aaos/2021-12-01; https://source.android.com/security/bulletin/aaos/2021-12-01
CVE: CVE-2021-1041
Published: 2021-12-15
Description: In (TBD) of (TBD), there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-182950799References: N/A
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2021-11-01; https://source.android.com/security/bulletin/pixel/2021-11-01
CVE: CVE-2021-1042
Published: 2021-12-15
Description: In dsi_panel_debugfs_read_cmdset of dsi_panel.c, there is a possible disclosure of freed kernel heap memory due to a use after free. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-187851056References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2021-11-01; https://source.android.com/security/bulletin/pixel/2021-11-01
CVE: CVE-2021-1043
Published: 2021-12-15
Description: In TBD of TBD, there is a possible downgrade attack due to under utilized anti-rollback protections. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194697257References: N/A
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/pixel/2021-11-01; https://source.android.com/security/bulletin/pixel/2021-11-01
CVE: CVE-2021-1044
Published: 2021-12-15
Description: In eicOpsDecryptAes128Gcm of acropora/app/identity/identity_support.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-195570681References: N/A
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-11-01; https://source.android.com/security/bulletin/pixel/2021-11-01
CVE: CVE-2021-1045
Published: 2021-12-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-195580473References: N/A
CVSS Score: 7.5 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2021-11-01; https://source.android.com/security/bulletin/pixel/2021-11-01
CVE: CVE-2021-1046
Published: 2021-12-15
Description: In lwis_dpm_update_clock of lwis_device_dpm.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-195609074References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1047
Published: 2021-12-15
Description: In valid_ipc_dram_addr of cm_access_control.c, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-197966306References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1048
Published: 2021-12-15
Description: In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-204573007References: Upstream kernel
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1048
CVE: CVE-2021-36888
Published: 2021-12-15
Description: Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284, CWE-306
References: https://patchstack.com/database/vulnerability/image-hover-effects-ultimate/wordpress-image-hover-effects-ultimate-plugin-9-6-1-unauthenticated-arbitrary-options-update-leading-to-full-website-compromise; https://wordpress.org/plugins/image-hover-effects-ultimate/#developers; https://patchstack.com/database/vulnerability/image-hover-effects-ultimate/wordpress-image-hover-effects-ultimate-plugin-9-6-1-unauthenticated-arbitrary-options-update-leading-to-full-website-compromise
CVE: CVE-2021-39636
Published: 2021-12-15
Description: In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to leak kernel information due to uninitialized data. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-120612905References: Upstream kernel
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-665
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39637
Published: 2021-12-15
Description: In CreateDeviceInfo of trusty_remote_provisioning_context.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-193579873References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39638
Published: 2021-12-15
Description: In periodic_io_work_func of lwis_periodic_io.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-195607566References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39639
Published: 2021-12-15
Description: In TBD of fvp.c, there is a possible way to glitch CPU behavior due to a missing permission check. This could lead to local escalation of privilege with physical access to device internals with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-198291476References: N/A
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39640
Published: 2021-12-15
Description: In __dwc3_gadget_ep0_queue of ep0.c, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-157294279References: N/A
CVSS Score: 7.8 (HIGH)
CWE: CWE-667
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39641
Published: 2021-12-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-126949257References: N/A
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39642
Published: 2021-12-15
Description: In synchronous_process_io_entries of lwis_ioctl.c, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-195731663References: N/A
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39643
Published: 2021-12-15
Description: In ic_startRetrieveEntryValue of acropora/app/identity/ic.c, there is a possible bypass of defense-in-depth due to missing validation of the return value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-195573629References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-252
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39644
Published: 2021-12-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-199809304References: N/A
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39645
Published: 2021-12-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-199805112References: N/A
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39646
Published: 2021-12-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-201537251References: N/A
CVSS Score: 7.5 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39647
Published: 2021-12-15
Description: In mon_smc_load_sp of gs101-sc/plat/samsung/exynos/soc/exynos9845/smc_booting.S, there is a possible reinitialization of TEE due to improper locking. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-198713939References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-667
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39648
Published: 2021-12-15
Description: In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-160822094References: Upstream kernel
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01