deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-8724
Published: 2021-01-11
Description: K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local). The component is: K7TSMngr.exe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-863
References: http://k7antivirus.com; http://k7computing.com; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE: CVE-2018-8725
Published: 2021-01-11
Description: K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: K7TSMngr.exe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://k7antivirus.com; http://k7computing.com; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE: CVE-2018-8726
Published: 2021-01-11
Description: K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: K7TSMngr.exe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://k7antivirus.com; http://k7computing.com; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE: CVE-2018-9332
Published: 2021-01-11
Description: K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local).
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://k7antivirus.com; http://k7computing.com; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE: CVE-2018-9333
Published: 2021-01-11
Description: K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: K7TSMngr.exe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-269
References: http://k7antivirus.com; http://k7computing.com; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE: CVE-2019-3405
Published: 2021-01-11
Description: In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a specific illegal 802.11 Null Data Frame, which will cause other wireless terminals connected to disconnect from the wireless, so as to attack the router wireless by DoS. At present, the vulnerability has been effectively handled, and users can fix the vulnerability after updating the firmware version.
CVSS Score: 5.3 (MEDIUM)
References: https://security.360.cn/News/news/id/246; https://security.360.cn/News/news/id/246
CVE: CVE-2020-17534
Published: 2021-01-11
Description: There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in HTML/Java API version 1.7.1 follows theirs: To avoid local privilege escalation version 1.7.1 creates the temporary directory atomically without dealing with the temporary file: https://github.com/apache/netbeans-html4j/commit/fa70e507e5555e1adb4f6518479fc408a7abd0e6
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://lists.apache.org/thread.html/ra6119c0cdfccf051a846fa11b61364f5df9e7db93c310706a947f86a%40%3Cdev.netbeans.apache.org%3E; https://lists.apache.org/thread.html/ra6119c0cdfccf051a846fa11b61364f5df9e7db93c310706a947f86a%40%3Cdev.netbeans.apache.org%3E
CVE: CVE-2020-23960
Published: 2021-01-11
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) installing or running modules, (4) resetting the analytics, (5) pinging the mailmotor api, (6) uploading things to the media library, (7) exporting locale.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/forkcms/forkcms/pull/3123; https://www.fork-cms.com/blog/detail/fork-5.8.3-released; https://github.com/forkcms/forkcms/pull/3123
CVE: CVE-2020-24003
Published: 2021-01-11
Description: Microsoft Skype through 8.59.0.77 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to obtain unprompted microphone and camera access by loading a crafted library and thereby inheriting Skype Client's microphone and camera access.
CVSS Score: 3.3 (LOW)
References: https://www.hdwsec.fr/blog/20200608-skype/; https://www.hdwsec.fr/blog/20200608-skype/
CVE: CVE-2020-25659
Published: 2021-01-11
Description: python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-385
References: https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b; https://www.oracle.com/security-alerts/cpuapr2022.html; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2020-27275
Published: 2021-01-11
Description: Delta Electronics DOPSoft Version 4.0.8.21 and prior is vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-005-05; https://www.zerodayinitiative.com/advisories/ZDI-21-028/; https://www.zerodayinitiative.com/advisories/ZDI-21-029/
CVE: CVE-2020-27277
Published: 2021-01-11
Description: Delta Electronics DOPSoft Version 4.0.8.21 and prior has a null pointer dereference issue while processing project files, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822, CWE-476
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-005-05; https://www.zerodayinitiative.com/advisories/ZDI-21-033/; https://us-cert.cisa.gov/ics/advisories/icsa-21-005-05
CVE: CVE-2020-27281
Published: 2021-01-11
Description: A stack-based buffer overflow may exist in Delta Electronics CNCSoft ScreenEditor versions 1.01.26 and prior when processing specially crafted project files, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-005-06; https://www.zerodayinitiative.com/advisories/ZDI-21-039/; https://us-cert.cisa.gov/ics/advisories/icsa-21-005-06
CVE: CVE-2020-27287
Published: 2021-01-11
Description: Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior is vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-007-04; https://www.zerodayinitiative.com/advisories/ZDI-21-030/; https://www.zerodayinitiative.com/advisories/ZDI-21-031/
CVE: CVE-2020-27289
Published: 2021-01-11
Description: Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a null pointer dereference issue while processing project files, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822, CWE-476
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-007-04; https://www.zerodayinitiative.com/advisories/ZDI-21-040/; https://us-cert.cisa.gov/ics/advisories/icsa-21-007-04
CVE: CVE-2020-27291
Published: 2021-01-11
Description: Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior is vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-007-04; https://www.zerodayinitiative.com/advisories/ZDI-21-042/; https://us-cert.cisa.gov/ics/advisories/icsa-21-007-04
CVE: CVE-2020-27293
Published: 2021-01-11
Description: Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a type confusion issue while processing project files, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-007-04; https://www.zerodayinitiative.com/advisories/ZDI-21-045/; https://us-cert.cisa.gov/ics/advisories/icsa-21-007-04
CVE: CVE-2020-35701
Published: 2021-01-11
Description: An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://asaf.me/2020/12/15/cacti-1-2-0-to-1-2-16-sql-injection/; https://github.com/Cacti/cacti/issues/4022; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DDD22Z56THHDTXAFM447UH3BVINURIF/
CVE: CVE-2021-23253
Published: 2021-01-11
Description: Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to craft a URL with a long domain name, e.g. www.safe.opera.com.attacker.com. With the URL being left-aligned, the user will only see the front part (e.g. www.safe.opera.com…) The exact amount depends on the phone screen size but the attacker can craft a number of different domains and target different phones. Starting with version 53.1 Opera Mini displays long URLs with the top-level domain label aligned to the right of the address field which mitigates the issue.
CVSS Score: 5.3 (MEDIUM)
References: https://security.opera.com/address-bar-spoofing-in-opera-mini-opera-security-advisories/; https://security.opera.com/address-bar-spoofing-in-opera-mini-opera-security-advisories/
CVE: CVE-2020-4869
Published: 2021-01-11
Description: IBM MQ Appliance 9.2 CD and 9.2 LTS is vulnerable to a denial of service, caused by a buffer overflow. A remote attacker could send a specially crafted SNMP query to cause the appliance to reload. IBM X-Force ID: 190831.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190831; https://www.ibm.com/support/pages/node/6398791; https://exchange.xforce.ibmcloud.com/vulnerabilities/190831
CVE: CVE-2020-13559
Published: 2021-01-11
Description: A denial-of-service vulnerability exists in the traffic-logging functionality of FreyrSCADA IEC-60879-5-104 Server Simulator 21.04.028. A specially crafted packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1024, CWE-697
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1174; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1174
CVE: CVE-2020-24025
Published: 2021-01-11
Description: Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://github.com/sass/node-sass/pull/567#issuecomment-656609236; https://github.com/sass/node-sass/pull/567#issuecomment-656609236
CVE: CVE-2020-26298
Published: 2021-01-11
Description: Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://github.com/advisories/GHSA-q3wr-qw3g-3p4h; https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md#version-351-security; https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793
CVE: CVE-2020-23631
Published: 2021-01-11
Description: Cross-site request forgery (CSRF) in admin/global/manage.php in WDJA CMS 1.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via the tongji parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://github.com/shadoweb/wdja/issues/11; https://www.cnblogs.com/wayne-tao/p/13110663.html; https://github.com/shadoweb/wdja/issues/11
CVE: CVE-2020-24027
Published: 2021-01-11
Description: In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://lists.live555.com/pipermail/live-devel/2020-July/021662.html; http://www.live555.com/liveMedia/public/changelog.txt; http://lists.live555.com/pipermail/live-devel/2020-July/021662.html
CVE: CVE-2020-27059
Published: 2021-01-11
Description: In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, 11; Android ID: A-159249069.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/pixel/2021-01-01; https://source.android.com/security/bulletin/pixel/2021-01-01
CVE: CVE-2021-0342
Published: 2021-01-11
Description: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. User interaction is not required for exploitation. Product: Android; Versions: Android kernel; Android ID: A-146554327.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2021-01-01; https://source.android.com/security/bulletin/pixel/2021-01-01
CVE: CVE-2021-21241
Published: 2021-01-11
Description: The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
CVSS Score: 7.4 (HIGH)
CWE: CWE-352
References: https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f; https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a; https://github.com/Flask-Middleware/flask-security/pull/422
CVE: CVE-2020-0471
Published: 2021-01-11
Description: In reassemble_and_dispatch of packet_fragmenter.cc, there is a possible way to inject packets into an encrypted Bluetooth connection due to improper input validation. This could lead to remote escalation of privilege between two Bluetooth devices by a proximal attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, Android-11; Android ID: A-169327567.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0301
Published: 2021-01-11
Description: In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android SoC; Android ID: A-172514667.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0303
Published: 2021-01-11
Description: In dispatchGraphTerminationMessage() of packages/services/Car/computepipe/runner/graph/StreamSetObserver.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Android ID: A-170407229.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0304
Published: 2021-01-11
Description: In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of the user's contacts with User execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-8.0, Android-8.1, Android-9; Android ID: A-162738636.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0306
Published: 2021-01-11
Description: In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which allows an app to gain the android.permission.ACTIVITY_RECOGNITION permission without user confirmation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11, Android-8.0, Android-8.1, Android-9, Android-10; Android ID: A-154505240.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0307
Published: 2021-01-11
Description: In updatePermissionSourcePackage of PermissionManagerService.java, there is a possible automatic runtime permission grant due to a confused deputy. This could lead to local escalation of privilege allowing a malicious app to silently gain access to a dangerous permission with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Android ID: A-155648771.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0308
Published: 2021-01-11
Description: In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11, Android-8.0; Android ID: A-158063095.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2021/02/msg00010.html; https://security.gentoo.org/glsa/202105-03; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0309
Published: 2021-01-11
Description: In onCreate of grantCredentialsPermissionActivity, there is a confused deputy. This could lead to local information disclosure and account access with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11, Android-8.0; Android ID: A-158480899.
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0310
Published: 2021-01-11
Description: In LazyServiceRegistrar of LazyServiceRegistrar.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Android ID: A-170212632.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0311
Published: 2021-01-11
Description: In ElementaryStreamQueue::dequeueAccessUnitH264() of ESQueue.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-9, Android-10, Android-11, Android-8.0, Android-8.1; Android ID: A-170240631.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0312
Published: 2021-01-11
Description: In WAVSource::read of WAVExtractor.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11, Android-8.0; Android ID: A-170583712.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-787
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0313
Published: 2021-01-11
Description: In isWordBreakAfter of LayoutUtils.cpp, there is a possible way to slow or crash a TextView due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-9, Android-10, Android-11, Android-8.0, Android-8.1; Android ID: A-170968514.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0315
Published: 2021-01-11
Description: In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to convince the user to grant an app access to an account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11, Android-8.0; Android ID: A-169763814.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0316
Published: 2021-01-11
Description: In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11, Android-8.0, Android-8.1, Android-9, Android-10; Android ID: A-168802990.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0317
Published: 2021-01-11
Description: In createOrUpdate of Permission.java and related code, there is possible permission escalation due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-10, Android-11, Android-8.0, Android-8.1, Android-9; Android ID: A-168319670.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01