deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-0969
Published: 2021-12-15
Description: In getTitle of AccessPoint.java, there is a possible unhandled exception due to a missing null check. This could lead to remote denial of service if a proximal Wi-Fi AP provides invalid information with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-199922685
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0970
Published: 2021-12-15
Description: In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-196970023
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0971
Published: 2021-12-15
Description: In MPEG4Source::read of MPEG4Extractor.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-188893559
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-12-01; https://source.android.com/security/bulletin/2021-12-01
CVE: CVE-2021-0973
Published: 2021-12-15
Description: In isFileUri of UriUtil.java, there is a possible way to bypass ignoring file://URI attachment due to improper handling of case sensitivity. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197328178
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-178
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0976
Published: 2021-12-15
Description: In toBARK of floor0.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-199680600
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0977
Published: 2021-12-15
Description: In phNxpNHal_DtaUpdate of phNxpNciHal_dta.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-183487770
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0978
Published: 2021-12-15
Description: In getSerialForPackage of DeviceIdentifiersPolicyService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-192587406
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0979
Published: 2021-12-15
Description: In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create pinned shortcuts due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-191772737
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0981
Published: 2021-12-15
Description: In enqueueNotificationInternal of NotificationManagerService.java, there is a possible way to run a foreground service without showing a notification due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-191981182
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2022-07-01; https://source.android.com/security/bulletin/2022-07-01
CVE: CVE-2021-0982
Published: 2021-12-15
Description: In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-192368508
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0983
Published: 2021-12-15
Description: In createAdminSupportIntent of DevicePolicyManagerService.java, there is a possible disclosure of information about installed device/profile owner package name due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-192245204
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2021-0984
Published: 2021-12-15
Description: In onNullBinding of ManagedServices.java, there is a possible permission bypass due to an incorrectly unbound service. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-192475653
CVSS Score: 7.8 (HIGH)
CWE: CWE-404
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0985
Published: 2021-12-15
Description: In onReceive of AlertReceiver.java, there is a possible way to dismiss system dialog due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-190403923
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0986
Published: 2021-12-15
Description: In hasGrantedPolicy of DevicePolicyManagerService.java, there is a possible information disclosure about the device owner, profile owner, or device admin due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-192247339
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0987
Published: 2021-12-15
Description: In getNeighboringCellInfo of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-190619791
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0988
Published: 2021-12-15
Description: In getLaunchedFromUid and getLaunchedFromPackage of ActivityClientController.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-191954233
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0989
Published: 2021-12-15
Description: In hasManageOngoingCallsPermission of TelecomServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-194105812
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0990
Published: 2021-12-15
Description: In getDeviceId of PhoneSubInfoController.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-185591180
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0991
Published: 2021-12-15
Description: In OnMetadataChangedListener of AdvancedBluetoothDetailsHeaderController.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-181588752
CVSS Score: 2.4 (LOW)
CWE: CWE-532
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0992
Published: 2021-12-15
Description: In onCreate of PaymentDefaultDialog.java, there is a possible way to change a default payment app without user consent due to tapjack overlay. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-180104327
CVSS Score: 3.3 (LOW)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0993
Published: 2021-12-15
Description: In getOffsetBeforeAfter of TextLine.java, there is a possible denial of service due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-193849901
CVSS Score: 6.5 (MEDIUM)
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0994
Published: 2021-12-15
Description: In requestRouteToHostAddress of ConnectivityService.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-193801134
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0995
Published: 2021-12-15
Description: In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197536547
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0996
Published: 2021-12-15
Description: In nfaHciCallback of HciEventManager.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure over NFC with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-181346545
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0997
Published: 2021-12-15
Description: In handleUpdateNetworkState of GnssNetworkConnectivityHandler.java , there is a possible APN disclosure due to log information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-191086488
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0998
Published: 2021-12-15
Description: In 'ih264e_find_bskip_params()' of ih264e_me.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-193442575
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-0999
Published: 2021-12-15
Description: In the broadcast definition in AndroidManifest.xml, there is a possible way to set the A2DP bluetooth device connection state due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-196858999
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1001
Published: 2021-12-15
Description: In PVInitVideoEncoder of mp4enc_api.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-190435883
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1002
Published: 2021-12-15
Description: In WT_Interpolate of eas_wtengine.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-194533433
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1003
Published: 2021-12-15
Description: In adjustStreamVolume of AudioService.java, there is a possible way for unprivileged app to change audio stream volume due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-189857506
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1004
Published: 2021-12-15
Description: In getConfiguredNetworks of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197749180
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1005
Published: 2021-12-15
Description: In getDeviceIdWithFeature of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-186530889
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1006
Published: 2021-12-15
Description: In several functions of DatabaseManager.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-183961974
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1007
Published: 2021-12-15
Description: In btu_hcif_process_event of btu_hcif.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-167759047
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1008
Published: 2021-12-15
Description: In addSubInfo of SubscriptionController.java, there is a possible way to force the user to make a factory reset due to a logic error in the code. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197327688
CVSS Score: 4.4 (MEDIUM)
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1009
Published: 2021-12-15
Description: In setApplicationCategoryHint of PackageManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-189858128
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1010
Published: 2021-12-15
Description: In getSigningKeySet of PackageManagerService.java, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-189857801
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1011
Published: 2021-12-15
Description: In setPackageStoppedState of PackageManagerService.java, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-188219307
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1012
Published: 2021-12-15
Description: In onResume of NotificationAccessDetails.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195412179
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1013
Published: 2021-12-15
Description: In checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission of PermissionManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-186404356
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-1014
Published: 2021-12-15
Description: In getNetworkTypeForSubscriber of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-186776740
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01