deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21594
Published: 2021-08-16
Description: Dell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive query strings vulnerability. It can lead to potential disclosure of sensitive data. Dell recommends upgrading at your earliest opportunity.
CVSS Score: 8.2 (HIGH)
CWE: CWE-598
References: https://www.dell.com/support/kbdoc/000190408; https://www.dell.com/support/kbdoc/000190408
CVE: CVE-2021-21595
Published: 2021-08-16
Description: Dell EMC PowerScale OneFS versions 8.2.x - 9.1.1.x contain an improper neutralization of special elements used in an OS command. This vulnerability could allow the compadmin user to elevate privileges. This only impacts Smartlock WORM compliance mode clusters as a critical vulnerability and Dell recommends to update/upgrade at the earliest opportunity.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://www.dell.com/support/kbdoc/000190408; https://www.dell.com/support/kbdoc/000190408
CVE: CVE-2021-21599
Published: 2021-08-16
Description: Dell EMC PowerScale OneFS versions 8.2.x - 9.2.1.x contain an OS command injection vulnerability. This may allow a user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE to escalate privileges and escape the compliance guarantees. This only impacts Smartlock WORM compliance mode clusters as a critical vulnerability and Dell recommends to update/upgrade at the earliest opportunity.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/000190408; https://www.dell.com/support/kbdoc/000190408
CVE: CVE-2021-36278
Published: 2021-08-16
Description: Dell EMC PowerScale OneFS versions 8.2.x, 9.1.0.x, and 9.1.1.1 contain a sensitive information exposure vulnerability in log files. A local malicious user with ISI_PRIV_LOGIN_SSH, ISI_PRIV_LOGIN_CONSOLE, or ISI_PRIV_SYS_SUPPORT privileges may exploit this vulnerability to access sensitive information. If any third-party consumes those logs, the same sensitive information is available to those systems as well.
CVSS Score: 8.1 (HIGH)
CWE: CWE-532, CWE-532
References: https://www.dell.com/support/kbdoc/000190408; https://www.dell.com/support/kbdoc/000190408
CVE: CVE-2021-36279
Published: 2021-08-16
Description: Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE to access privileged information about the cluster.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.dell.com/support/kbdoc/000190408; https://www.dell.com/support/kbdoc/000190408
CVE: CVE-2021-36280
Published: 2021-08-16
Description: Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE to access privileged information about the cluster.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.dell.com/support/kbdoc/000190408; https://www.dell.com/support/kbdoc/000190408
CVE: CVE-2021-36281
Published: 2021-08-16
Description: Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment vulnerability. A low privileged authenticated user can potentially exploit this vulnerability to escalate privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://www.dell.com/support/kbdoc/000190408; https://www.dell.com/support/kbdoc/000190408
CVE: CVE-2021-36282
Published: 2021-08-16
Description: Dell EMC PowerScale OneFS versions 8.2.x - 9.1.0.x contain a use of uninitialized resource vulnerability. This can potentially allow an authenticated user with ISI_PRIV_LOGIN_CONSOLE or ISI_PRIV_LOGIN_SSH privileges to gain access up to 24 bytes of data within the /ifs kernel stack under certain conditions.
CVSS Score: 2.5 (LOW)
CWE: CWE-908
References: https://www.dell.com/support/kbdoc/000190408; https://www.dell.com/support/kbdoc/000190408
CVE: CVE-2021-37709
Published: 2021-08-16
Description: Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of the Import/Export feature. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-639
References: https://github.com/shopware/platform/commit/a9f52abb6eb503654c492b6b2076f8d924831fec; https://github.com/shopware/platform/security/advisories/GHSA-54gp-qff8-946c; https://github.com/shopware/platform/commit/a9f52abb6eb503654c492b6b2076f8d924831fec
CVE: CVE-2021-37710
Published: 2021-08-16
Description: Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Scripting vulnerability via SVG media files. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://github.com/shopware/platform/commit/abe9f69e1f667800f974acccd3047b4930e4b423; https://github.com/shopware/platform/security/advisories/GHSA-fc38-mxwr-pfhx; https://github.com/shopware/platform/commit/abe9f69e1f667800f974acccd3047b4930e4b423
CVE: CVE-2021-37711
Published: 2021-08-16
Description: Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/shopware/platform/commit/b9f330e652b743dd2374c02bbe68f28b59a3f502; https://github.com/shopware/platform/security/advisories/GHSA-gcvv-gq92-x94r; https://github.com/shopware/platform/commit/b9f330e652b743dd2374c02bbe68f28b59a3f502
CVE: CVE-2020-4706
Published: 2021-08-17
Description: IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 187194.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/187194; https://www.ibm.com/support/pages/node/6481879; https://exchange.xforce.ibmcloud.com/vulnerabilities/187194
CVE: CVE-2020-4992
Published: 2021-08-17
Description: IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 192737.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192737; https://www.ibm.com/support/pages/node/6481679; https://exchange.xforce.ibmcloud.com/vulnerabilities/192737
CVE: CVE-2021-34407
Published: 2021-08-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-30480. Reason: This candidate is a reservation duplicate of CVE-2021-30480. Notes: All CVE users should reference CVE-2021-30480 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-25956
Published: 2021-08-17
Description: In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284
References: https://github.com/Dolibarr/dolibarr/commit/c4cba43bade736ab89e31013a6ccee59a6e077ee; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25956; https://github.com/Dolibarr/dolibarr/commit/c4cba43bade736ab89e31013a6ccee59a6e077ee
CVE: CVE-2021-25957
Published: 2021-08-17
Description: In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-640, CWE-640
References: https://github.com/Dolibarr/dolibarr/commit/87f[PII_REDACTED]f0d651f59337a35661faeb6f377; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25957; https://github.com/Dolibarr/dolibarr/commit/87f[PII_REDACTED]f0d651f59337a35661faeb6f377
CVE: CVE-2020-28846
Published: 2021-08-17
Description: Cross Site Request Forgery (CSRF) vulnerability exists in SeaCMS 10.7 in admin_manager.php, which could let a malicious user add an admin account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/wh1tes/wh1te_blog/issues/8; https://github.com/wh1tes/wh1te_blog/issues/8
CVE: CVE-2021-32829
Published: 2021-08-17
Description: ZStack is open source IaaS(infrastructure as a service) software aiming to automate datacenters, managing resources of compute, storage, and networking all by APIs. Affected versions of ZStack REST API are vulnerable to post-authentication Remote Code Execution (RCE) via bypass of the Groovy shell sandbox. The REST API exposes the GET zstack/v1/batch-queries?script endpoint which is backed up by the BatchQueryAction class. Messages are represented by the APIBatchQueryMsg, dispatched to the QueryFacadeImpl facade and handled by the BatchQuery class. The HTTP request parameter script is mapped to the APIBatchQueryMsg.script property and evaluated as a Groovy script in BatchQuery.query the evaluation of the user-controlled Groovy script is sandboxed by SandboxTransformer which will apply the restrictions defined in the registered (sandbox.register()) GroovyInterceptor. Even though the sandbox heavily restricts the receiver types to a small set of allowed types, the sandbox is non effective at controlling any code placed in Java annotations and therefore vulnerable to meta-programming escapes. This issue leads to post-authenticated remote code execution. For more details see the referenced GHSL-2021-065. This issue is patched in versions 3.8.21, 3.10.8, and 4.1.0.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-94, CWE-863
References: https://blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html; https://github.com/zstackio/zstack/security/advisories/GHSA-6xgq-7rqg-x3q5; https://securitylab.github.com/advisories/GHSL-2021-065-zstack/
CVE: CVE-2021-3458
Published: 2021-08-17
Description: The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://motorolamentor.zendesk.com/hc/en-us/articles/[PII_REDACTED]50; https://motorolamentor.zendesk.com/hc/en-us/articles/[PII_REDACTED]50
CVE: CVE-2021-3459
Published: 2021-08-17
Description: A privilege escalation vulnerability was reported in the MM1000 device configuration web server, which could allow privileged shell access and/or arbitrary privileged commands to be executed on the adapter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://motorolamentor.zendesk.com/hc/en-us/articles/[PII_REDACTED]50; https://motorolamentor.zendesk.com/hc/en-us/articles/[PII_REDACTED]50
CVE: CVE-2021-3615
Published: 2021-08-17
Description: A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attached SD card. This vulnerability is the same as CNVD-2021-45262.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94
References: https://iknow.lenovo.com.cn/detail/dc_198417.html; https://www.cnvd.org.cn/flaw/show/CNVD-2021-45262; https://iknow.lenovo.com.cn/detail/dc_198417.html
CVE: CVE-2021-3616
Published: 2021-08-17
Description: A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content and device configuration. This vulnerability is the same as CNVD-2020-68651.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-285
References: https://iknow.lenovo.com.cn/detail/dc_198417.html; https://www.cnvd.org.cn/flaw/show/CNVD-2020-68651; https://iknow.lenovo.com.cn/detail/dc_198417.html
CVE: CVE-2021-3617
Published: 2021-08-17
Description: A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. This vulnerability is the same as CNVD-2020-68652.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-77
References: https://iknow.lenovo.com.cn/detail/dc_198417.html; https://www.cnvd.org.cn/flaw/show/CNVD-2020-68652; https://iknow.lenovo.com.cn/detail/dc_198417.html
CVE: CVE-2021-3633
Published: 2021-08-17
Description: A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege escalation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-347, CWE-427
References: https://iknow.lenovo.com.cn/detail/dc_198418.html; https://iknow.lenovo.com.cn/detail/dc_198418.html
CVE: CVE-2020-15955
Published: 2021-08-17
Description: In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client and s/qmail. This allows e-mail messages and user credentials to be sent to the MitM attacker.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-77
References: https://nostarttls.secvuln.info/; https://www.fehcom.de/sqmail/sqmail.html; https://nostarttls.secvuln.info/
CVE: CVE-2020-29548
Published: 2021-08-17
Description: An issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline commands after a POP3 STLS command, injecting plaintext commands into an encrypted user session.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://nostarttls.secvuln.info/; https://www.smartertools.com/smartermail/release-notes/current; https://nostarttls.secvuln.info/
CVE: CVE-2021-29056
Published: 2021-08-17
Description: Cross Site Scripting (XSS) vulnerability exists in Pixelimity 1.0 via the HTTP POST parameter to admin/setting.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/pixelimity/pixelimity/issues/21; https://github.com/pixelimity/pixelimity/issues/21
CVE: CVE-2021-32830
Published: 2021-08-17
Description: The @diez/generation npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/generation library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. All versions of this package are vulnerable as of the writing of this CVE.
CVSS Score: 3.9 (LOW)
CWE: CWE-78, CWE-77
References: https://github.com/diez/diez; https://securitylab.github.com/advisories/GHSL-2021-061-diez-generation-cmd-injection/; https://www.npmjs.com/package/%40diez/generation
CVE: CVE-2020-22937
Published: 2021-08-17
Description: A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious code to the install file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://cwe.mitre.org/data/definitions/96.html; https://github.com/leadscloud/EmpireCMS/issues/4; https://cwe.mitre.org/data/definitions/96.html
CVE: CVE-2021-0519
Published: 2021-08-17
Description: In BITSTREAM_FLUSH of ih264e_bitstream.h, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-176533109
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0573
Published: 2021-08-17
Description: In asf extractor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187231635
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0574
Published: 2021-08-17
Description: In asf extractor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187234876
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0576
Published: 2021-08-17
Description: In flv extractor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187236084
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0578
Published: 2021-08-17
Description: In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187161772
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0579
Published: 2021-08-17
Description: In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187231636
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0580
Published: 2021-08-17
Description: In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187231637
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0581
Published: 2021-08-17
Description: In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187231638
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0582
Published: 2021-08-17
Description: In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187149601
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0584
Published: 2021-08-17
Description: In verifyBufferObject of Parcel.cpp, there is a possible out of bounds read due to an improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-179289794
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0591
Published: 2021-08-17
Description: In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcast receivers due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-179386960
CVSS Score: 7.3 (HIGH)
CWE: CWE-610
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0593
Published: 2021-08-17
Description: In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiver due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-179386068
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0639
Published: 2021-08-17
Description: In multiple functions of libl3oemcrypto.cpp, there is a possible weakness in the existing obfuscation mechanism due to the way sensitive data is handled. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-190724551
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0640
Published: 2021-08-17
Description: In noteAtomLogged of StatsdStats.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-187957589
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01
CVE: CVE-2021-0641
Published: 2021-08-17
Description: In getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifiers due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-185235454
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://source.android.com/security/bulletin/2021-08-01; https://source.android.com/security/bulletin/2021-08-01