deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-20125
Published: 2022-06-15
Description: In GBoard, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of privilege if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-194402515
CVSS Score: 6.8 (MEDIUM)
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20126
Published: 2022-06-15
Description: In setScanMode of AdapterService.java, there is a possible way to enable Bluetooth discovery mode without user interaction due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-203431023
CVSS Score: 7.3 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20127
Published: 2022-06-15
Description: In ce_t4t_data_cback of ce_t4t.cc, there is a possible out of bounds write due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-221862119
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415, CWE-787
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20129
Published: 2022-06-15
Description: In registerPhoneAccount of PhoneAccountRegistrar.java, there is a possible way to prevent the user from selecting a phone account due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-217934478
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20130
Published: 2022-06-15
Description: In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-224314979
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-754
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20131
Published: 2022-06-15
Description: In nci_proc_rf_management_ntf of nci_hrcv.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-221856662
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20132
Published: 2022-06-15
Description: In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20133
Published: 2022-06-15
Description: In setDiscoverableTimeout of AdapterService.java, there is a possible bypass of user interaction due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-206807679
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20134
Published: 2022-06-15
Description: In readArguments of CallSubjectDialog.java, there is a possible way to trick the user to call the wrong phone number due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-218341397
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20135
Published: 2022-06-15
Description: In writeToParcel of GateKeeperResponse.java, there is a possible parcel format mismatch. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-220303465
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20137
Published: 2022-06-15
Description: In onCreateContextMenu of NetworkProviderSettings.java, there is a possible way for non-owner users to change WiFi settings due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-206986392
CVSS Score: 7.3 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-2086
Published: 2022-06-15
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Bank Management System 1.0. Affected by this issue is login.php. The manipulation of the argument password with the input 1'and 1=2 union select 1,sleep(10),3,4,5 --+ leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/joinia/webray.com.cn/blob/main/php-bank/phpbanksql.md; https://vuldb.com/?id.202034; https://github.com/joinia/webray.com.cn/blob/main/php-bank/phpbanksql.md
CVE: CVE-2022-2087
Published: 2022-06-15
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Bank Management System 1.0. This affects the file /mnotice.php?id=2. The manipulation of the argument notice with the input <script>alert(1)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/joinia/webray.com.cn/blob/main/php-bank/phpbankxss.md; https://vuldb.com/?id.202035; https://github.com/joinia/webray.com.cn/blob/main/php-bank/phpbankxss.md
CVE: CVE-2021-36901
Published: 2022-06-15
Description: Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Phil Baker's Age Gate plugin <= 2.17.0 at WordPress.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/age-gate/wordpress-age-gate-plugin-2-17-0-unauthenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/age-gate/#developers; https://patchstack.com/database/vulnerability/age-gate/wordpress-age-gate-plugin-2-17-0-unauthenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-39806
Published: 2022-06-15
Description: In closef of label_backends_android.c, there is a possible way to corrupt memory due to a double free. This could lead to local escalation of privilege during startup of servicemanager, if an attacker can trigger an initialization failure, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-215387420
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20138
Published: 2022-06-15
Description: In ACTION_MANAGED_PROFILE_PROVISIONED of DevicePolicyManagerService.java, there is a possible way for unprivileged app to send MANAGED_PROFILE_PROVISIONED intent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-210469972
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20140
Published: 2022-06-15
Description: In read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-227618988
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20141
Published: 2022-06-15
Description: In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-112551163References: Upstream kernel
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416, CWE-667
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20142
Published: 2022-06-15
Description: In createFromParcel of GeofenceHardwareRequestParcelable.java, there is a possible arbitrary code execution due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-216631962
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20143
Published: 2022-06-15
Description: In addAutomaticZenRule of ZenModeHelper.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-220735360
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20144
Published: 2022-06-15
Description: In multiple functions of AvatarPhotoController.java, there is a possible access to content owned by system content providers due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-250637906
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/aaos/2022-12-01; https://source.android.com/security/bulletin/aaos/2022-12-01
CVE: CVE-2022-20145
Published: 2022-06-15
Description: In startLegacyVpnPrivileged of Vpn.java, there is a possible way to retrieve VPN credentials due to a protocol downgrade attack. This could lead to remote escalation of privilege if a malicious Wi-Fi AP is used, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-201660636
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20146
Published: 2022-06-15
Description: In uploadFile of FileUploadServiceImpl.java, there is a possible incorrect file access due to a confused deputy. This could lead to local information disclosure of private files with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-211757677References: N/A
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20147
Published: 2022-06-15
Description: In nfa_dm_check_set_config of nfa_dm_main.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-221216105
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2022-20148
Published: 2022-06-15
Description: In TBD of TBD, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-219513976References: Upstream kernel
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20149
Published: 2022-06-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-211685939References: N/A
CVSS Score: 7.5 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20151
Published: 2022-06-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-210712565References: N/A
CVSS Score: 7.5 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20152
Published: 2022-06-15
Description: In the TitanM chip, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-202006198References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20153
Published: 2022-06-15
Description: In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-222091980References: Upstream kernel
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-667
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20154
Published: 2022-06-15
Description: In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20155
Published: 2022-06-15
Description: In ipu_core_jqs_msg_transport_kernel_write_sync of ipu-core-jqs-msg-transport.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-176754369References: N/A
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20156
Published: 2022-06-15
Description: In unflatten of GraphicBuffer.cpp, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-212803946References: N/A
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20159
Published: 2022-06-15
Description: In asn1_ec_pkey_parse of acropora/crypto/asn1_common.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210971465References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20160
Published: 2022-06-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-210083655References: N/A
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20162
Published: 2022-06-15
Description: In asn1_p256_int of crypto/asn1.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-223492713References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20164
Published: 2022-06-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-204891956References: N/A
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20165
Published: 2022-06-15
Description: In asn1_parse of asn1.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-220868345References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20166
Published: 2022-06-15
Description: In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-182388481References: Upstream kernel
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20167
Published: 2022-06-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-204956204References: N/A
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20168
Published: 2022-06-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-210594998References: N/A
CVSS Score: 7.5 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20169
Published: 2022-06-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-211162353References: N/A
CVSS Score: 7.5 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20170
Published: 2022-06-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-209421931References: N/A
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20171
Published: 2022-06-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-215565667References: N/A
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20172
Published: 2022-06-15
Description: In onbind of ShannonRcsService.java, there is a possible access to protect data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-206987222References: N/A
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20173
Published: 2022-06-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-207116951References: N/A
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20174
Published: 2022-06-15
Description: In exynos_secEnv_init of mach-gs101.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210847407References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2022-20175
Published: 2022-06-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-209252491References: N/A
CVSS Score: 7.5 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01