rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-20222 
In read_attr_value of gatt_db.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-228078096
Problem types: description: Remote code execution
Affected products: vendor: n/a
product: Android
Published: 2022-07-13T18:22:45.000Z
CVE-2022-20223 
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-223578534
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-07-13T18:22:51.000Z
CVE-2022-20224 
In AT_SKIP_REST of bta_hf_client_at.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure in the Bluetooth stack with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-220732646
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-07-13T18:22:56.000Z
CVE-2022-20225 
In getSubscriptionProperty of SubscriptionController.java, there is a possible read of a sensitive identifier due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-213457638
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-07-13T18:23:02.000Z
CVE-2022-20226 
In finishDrawingWindow of WindowManagerService.java, there is a possible tapjacking due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-213644870
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-07-13T18:23:07.000Z
CVE-2022-20227 
In USB driver, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-216825460References: Upstream kernel
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-07-13T18:23:13.000Z
CVE-2022-20228 
In various functions of C2DmaBufAllocator.cpp, there is a possible memory corruption due to a use after free. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-213850092
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-07-13T18:23:20.000Z
CVE-2022-20229 
In bta_hf_client_handle_cind_list_item of bta_hf_client_at.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-224536184
Problem types: description: Remote code execution
Affected products: vendor: n/a
product: Android
Published: 2022-07-13T18:23:25.000Z
CVE-2022-20230 
In choosePrivateKeyAlias of KeyChain.java, there is a possible access to the user's certificate due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-221859869
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-07-13T18:23:31.000Z
CVE-2022-20231 
In smc_intc_request_fiq of arm_gic.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-211485702References: N/A
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-09-14T00:00:00.000Z
CVE-2022-20233 
In param_find_digests_internal and related functions of the Titan-M source, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-222472803References: N/A
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-06-15T13:24:47.000Z
CVE-2022-20234 
In Car Settings app, the NotificationAccessConfirmationActivity is exported. In NotificationAccessConfirmationActivity, it gets both 'mComponentName' and 'pkgTitle' from user.An unprivileged app can use a malicous mComponentName with a benign pkgTitle (e.g. Settings app) to make users enable notification access permission for the malicious app. That is, users believe they enable the notification access permission for the Settings app, but actually they enable the notification access permission for the malicious app.Once the malicious app gets the notification access permission, it can read all notifications, including users' personal information.Product: AndroidVersions: Android-12LAndroid ID: A-225189301
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-07-13T18:27:24.000Z
CVE-2022-20235 
The PowerVR GPU kernel driver maintains an "Information Page" used by its cache subsystem. This page can only be written by the GPU driver itself, but prior to DDK 1.18 however, a user-space program could write arbitrary data to the page, leading to memory corruption issues.Product: AndroidVersions: Android SoCAndroid ID: A-259967780
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2022-20236 
A drm driver have oob problem, could cause the system crash or EOPProduct: AndroidVersions: Android SoCAndroid ID: A-233124709
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-07-13T18:23:37.000Z
CVE-2022-20237 
In BuildDevIDResponse of miscdatabuilder.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-229621649References: N/A
Problem types: description: Remote code execution
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T14:58:45.000Z
CVE-2022-20238 
'remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by userspace, so userspace may map the kernel area to be writable, which is easy to be exploitedProduct: AndroidVersions: Android SoCAndroid ID: A-233154555
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-07-13T18:23:46.000Z
CVE-2022-20239 
remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by userspace, so userspace may map the kernel area to be writable, which is easy to be exploitedProduct: AndroidVersions: Android SoCAndroid ID: A-233972091
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-09T20:20:38.000Z
CVE-2022-20240 
In sOpAllowSystemRestrictionBypass of AppOpsManager.java, there is a possible leak of location information due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-231496105
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-13T00:00:00.000Z
CVE-2022-20241 
In Messaging, there is a possible way to attach a private file to an SMS message due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-217185011
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:07:00.000Z
CVE-2022-20242 
In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-231986212
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:07:16.000Z
CVE-2022-20243 
In Core Utilities, there is a possible log information disclosure. This could lead to local information disclosure of sensitive browsing data with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-190199986
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:07:32.000Z
CVE-2022-20244 
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if more than 100 bluetooth devices have been connected with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-201083240
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:07:47.000Z
CVE-2022-20245 
In WindowManager, there is a possible method to create a recording of the lock screen due to an insecure default value. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-215005011
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:07:59.000Z
CVE-2022-20246 
In WindowManager, there is a possible bypass of the restrictions for starting activities from the background due to an incorrect UID/permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230493191
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:08:14.000Z
CVE-2022-20247 
In Media, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-229858836
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:08:29.000Z
CVE-2022-20248 
In Settings, there is a possible way to connect to an open network bypassing DISALLOW_CONFIG_WIFI restriction due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227619193
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:08:44.000Z
CVE-2022-20249 
In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-226900861
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:09:01.000Z
CVE-2022-20250 
In Messaging, there is a possible way to attach files to a message without proper access checks due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-226134095
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:09:15.000Z
CVE-2022-20251 
In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-225881167
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:09:30.000Z
CVE-2022-20252 
In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224547584
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:09:46.000Z
CVE-2022-20253 
In Bluetooth, there is a possible cleanup failure due to an uncaught exception. This could lead to remote denial of service in Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224545125
Problem types: description: Denial of service
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:10:03.000Z
CVE-2022-20254 
In Wi-Fi, there is a permissions bypass. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-223377547
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:10:19.000Z
CVE-2022-20255 
In SettingsProvider, there is a possible way to read or change the default ringtone due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-222687217
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:10:35.000Z
CVE-2022-20256 
In the Audio HAL, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-222572821
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:10:51.000Z
CVE-2022-20257 
In Bluetooth, there is a possible way to pair a display only device without PIN confirmation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-222289114
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:11:04.000Z
CVE-2022-20258 
In Bluetooth, there is a possible way to bypass compiler exploit mitigations due to a configuration error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-221893030
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:11:20.000Z
CVE-2022-20259 
In Telephony, there is a possible leak of ICCID and EID due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-221431393
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:11:35.000Z
CVE-2022-20260 
In the Phone app, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-220865698
Problem types: description: Denial of service
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:11:47.000Z
CVE-2022-20261 
In LocationManager, there is a possible way to get location information due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-219835125
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:12:00.000Z
CVE-2022-20262 
In ActivityManager, there is a possible way to check another process's capabilities due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-218338453
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:12:13.000Z
CVE-2022-20263 
In ActivityManager, there is a way to read process state for other users due to a missing permission check. This could lead to local information disclosure of app usage with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-217935264
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:12:28.000Z
CVE-2022-20264 
In Usage Stats Service, there is a possible way to determine whether an app is installed, without query permissions due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2023-10-30T16:18:53.844Z
CVE-2022-20265 
In Settings, there is a possible way to bypass factory reset permissions due to a permissions bypass. This could lead to local escalation of privilege with physical access to the device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-212804898
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:12:44.000Z
CVE-2022-20266 
In Companion, there is a possible way to keep a service running with elevated importance without showing foreground service notification due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-211757348
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:12:59.000Z
CVE-2022-20267 
In bluetooth, there is a possible way to enable or disable bluetooth connection without user consent due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-211646835
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:13:15.000Z
CVE-2022-20268 
In RestrictionsManager, there is a possible way to send a broadcast that should be restricted to system apps due to a permissions bypass. This could lead to local escalation of privilege on an enterprise managed device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-210468836
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:13:30.000Z
CVE-2022-20269 
In Bluetooth, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-209062898
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:13:42.000Z
CVE-2022-20270 
In Content, there is a possible way to learn gmail account name on the device due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-209005023
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:13:58.000Z
CVE-2022-20271 
In PermissionController, there is a possible way to grant some permissions without user consent due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-207672635
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:14:11.000Z
CVE-2022-20272 
In PermissionController, there is a possible misunderstanding about the default SMS application's permission set due to misleading text. This could lead to local information disclosure with User privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-207672568
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-08-11T15:14:26.000Z