rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-20489 
In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703460
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2022-20490 
In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703505
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2022-20491 
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703556
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-13T00:00:00.000Z
CVE-2022-20492 
In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242704043
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2022-20493 
In Condition of Condition.java, there is a possible way to grant notification access due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242846316
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2022-20494 
In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-243794204
Problem types: description: Denial of service
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2022-20495 
In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility service due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-243849844
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-13T00:00:00.000Z
CVE-2022-20496 
In setDataSource of initMediaExtractor.cpp, there is a possibility of arbitrary code execution due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-245242273
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-13T00:00:00.000Z
CVE-2022-20497 
In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifications on the lockscreen due to an incorrect state transition. This could lead to local information disclosure with physical access required and an app that runs above the lockscreen, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-246301979
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-13T00:00:00.000Z
CVE-2022-20498 
In fdt_path_offset_namelen of fdt_ro.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246465319
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-13T00:00:00.000Z
CVE-2022-20499 
In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-246539931
Problem types: description: Denial of service
Affected products: vendor: n/a
product: Android
Published: 2023-03-24T00:00:00.000Z
CVE-2022-20500 
In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246540168
Problem types: description: Denial of service
Affected products: vendor: n/a
product: Android
Published: 2022-12-13T00:00:00.000Z
CVE-2022-20501 
In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246933359
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-13T00:00:00.000Z
CVE-2022-20502 
In GetResolvedMethod of entrypoint_utils-inl.h, there is a possible use after free due to a stale cache. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-222166527
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-13T00:00:00.000Z
CVE-2022-20503 
In onCreate of WifiDppConfiguratorActivity.java, there is a possible way for a guest user to add a WiFi configuration due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224772890
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20504 
In multiple locations of DreamManagerService.java, there is a missing permission check. This could lead to local escalation of privilege and dismissal of system dialogs with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-225878553
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20505 
In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitationProduct: AndroidVersions: Android-13Android ID: A-225981754
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20506 
In onCreate of WifiDialogActivity.java, there is a missing permission check. This could lead to local escalation of privilege from a guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-226133034
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20507 
In onMulticastListUpdateNotificationReceived of UwbEventManager.java, there is a possible arbitrary code execution due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-246649179
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20508 
In onAttach of ConfigureWifiSettings.java, there is a possible way for a guest user to change WiFi settings due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-218679614
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20509 
In mapGrantorDescr of MessageQueueBase.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-244713317
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20510 
In getNearbyNotificationStreamingPolicy of DevicePolicyManagerService.java, there is a possible way to learn about the notification streaming policy of other users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235822336
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20511 
In getNearbyAppStreamingPolicy of DevicePolicyManagerService.java, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235821829
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20512 
In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-238602879
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20513 
In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-244569759
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20514 
In acquireFabricatedOverlayIterator, nextFabricatedOverlayInfos, and releaseFabricatedOverlayIterator of Idmap2Service.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-245727875
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20515 
In onPreferenceClick of AccountTypePreferenceLoader.java, there is a possible way to retrieve protected files from the Settings app due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-220733496
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20516 
In rw_t3t_act_handle_check_ndef_rsp of rw_t3t.cc, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224002331
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20517 
In getMessagesByPhoneNumber of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224769956
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20518 
In query of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224770203
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20519 
In onCreate of AddAppNetworksActivity.java, there is a possible way for a guest user to configure WiFi networks due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224772678
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20520 
In onCreate of various files, there is a possible tapjacking/overlay attack. This could lead to local escalation of privilege or denial of server with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227203202
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20521 
In sdpu_find_most_specific_service_uuid of sdp_utils.cc, there is a possible way to crash Bluetooth due to a missing null check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227203684
Problem types: description: Denial of service
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20522 
In getSlice of ProviderModelSlice.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227470877
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20523 
In IncFs_GetFilledRangesStartingFrom of incfs.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-228222508
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20524 
In compose of Vibrator.cpp, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-228523213
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20525 
In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-229742768
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20526 
In CanvasContext::draw of CanvasContext.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-229742774
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20527 
In HalCoreCallback of halcore.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure from the NFC firmware with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-229994861
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20528 
In findParam of HevcUtils.cpp there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230172711
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20529 
In multiple locations of WifiDialogActivity.java, there is a possible limited lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege in wifi settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-231583603
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20530 
In strings.xml, there is a possible permission bypass due to a misleading string. This could lead to remote information disclosure of call logs with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-231585645
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20531 
In Telecom, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2023-10-30T16:18:54.199Z
CVE-2022-20532 
In parseTrackFragmentRun() of MPEG4Extractor.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-232242894
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-03-24T00:00:00.000Z
CVE-2022-20533 
In getSlice of WifiSlice.java, there is a possible way to connect a new WiFi network from the guest mode due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-232798363
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20535 
In registerLocalOnlyHotspotSoftApCallback of WifiManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-233605242
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20536 
In registerBroadcastReceiver of RcsService.java, there is a possible way to change preferred TTY mode due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235100180
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20537 
In createDialog of WifiScanModeActivity.java, there is a possible way for a Guest user to enable location-sensitive settings due to a missing permission check. This could lead to local escalation of privilege from the Guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235601169
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-20538 
In getSmsRoleHolder of RoleService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235601770
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z