rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-20903 
This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to the UAA, a refresh token is issued to a client on behalf of a user from that identity provider, the administrator of the UAA deactivates the identity provider from the UAA. It is expected that the UAA would reject a refresh token during a refresh token grant, but it does not (hence the vulnerability). It will continue to issue access tokens to request presenting such refresh tokens, as if the identity provider was still active. As a result, clients with refresh tokens issued through the deactivated identity provider would still have access to Cloud Foundry resources until their refresh token expires (which defaults to 30 days).
Problem types: description: Tokens for inactivated IDPs are not revoked and remain valid until expiration
Affected products: vendor: n/a
product: Cloud Foundry
Published: 2023-03-28T00:00:00.000Z
CVE-2023-20904 
In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12L Android-13Android ID: A-246300272
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20905 
In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-241387741
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20906 
In onPackageAddedInternal of PermissionManagerService.java, there is a possible way to silently grant a permission after a Target SDK update due to a permissions bypass. This could lead to local escalation of privilege after updating an app to a higher Target SDK with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-221040577
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-03-24T00:00:00.000Z
CVE-2023-20908 
In several functions of SettingsState.java, there is a possible system crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-239415861
Problem types: description: Denial of service
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20909 
In multiple functions of RunningTasks.java, there is a possible privilege escalation due to a missing privilege check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-243130512
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2023-04-19T00:00:00.000Z
CVE-2023-20910 
In add of WifiNetworkSuggestionsManager.java, there is a possible way to trigger permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.


Problem types: description: Denial of service
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2023-03-24T00:00:00.000Z
CVE-2023-20911 
In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-242537498
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-03-24T00:00:00.000Z
CVE-2023-20912 
In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-246301995
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20913 
In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246933785
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20914 
In onSetRuntimePermissionGrantStateByDeviceAdmin of AdminRestrictedPermissionsUtils.java, there is a possible way for the work profile to read SMS messages due to a permissions bypass. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-189942529
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2023-05-15T00:00:00.000Z
CVE-2023-20915 
In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246930197
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20916 
In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-229256049
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20917 
In onTargetSelected of ResolverActivity.java, there is a possible way to share a wrong file due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-242605257
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-03-24T00:00:00.000Z
CVE-2023-20918 
In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileges needed. User interaction is not needed for exploitation.


Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2023-07-12T23:18:00.205Z
CVE-2023-20919 
In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-252663068
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20920 
In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-204584366
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20921 
In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-243378132
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20922 
In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-237291548
Problem types: description: Denial of service
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20923 
In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-246933910References: N/A
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20924 
In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure. This could lead to local escalation of privilege with physical access to the device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-240428519References: N/A
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20925 
In setUclampMinLocked of PowerSessionManager.cpp, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-236674672References: N/A
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20926 
In onParentVisible of HeaderPrivacyIconsController.kt, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with physical access to a device that's been factory reset with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-253043058
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-03-24T00:00:00.000Z
CVE-2023-20927 
In permissions of AndroidManifest.xml, there is a possible way to grant signature permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-244216503
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-02-15T00:00:00.000Z
CVE-2023-20928 
In binder_vma_close of binder.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-254837884References: Upstream kernel
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-01-24T00:00:00.000Z
CVE-2023-20929 
In sendHalfSheetCancelBroadcast of HalfSheetActivity.java, there is a possible way to learn nearby BT MAC addresses due to an unrestricted broadcast intent. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-234442700
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2023-03-24T00:00:00.000Z
CVE-2023-20930 
In pushDynamicShortcut of ShortcutPackage.java, there is a possible way to get the device into a boot loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-250576066
Problem types: description: Denial of service
Affected products: vendor: n/a
product: Android
Published: 2023-05-15T00:00:00.000Z
CVE-2023-20931 
In avdt_scb_hdl_write_req of avdt_scb_act.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-242535997
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-03-24T00:00:00.000Z
CVE-2023-20932 
In onCreatePreferences of EditInfoFragment.java, there is a possible way to read contacts belonging to other users due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-248251018
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2023-02-28T00:00:00.000Z
CVE-2023-20933 
In several functions of MediaCodec.cpp, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-245860753
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-02-28T00:00:00.000Z
CVE-2023-20934 
In resolveAttributionSource of ServiceUtilities.cpp, there is a possible way to disable the microphone privacy indicator due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-258672042
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-02-28T00:00:00.000Z
CVE-2023-20935 
In deserialize of multiple files, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-256589724
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2023-04-19T00:00:00.000Z
CVE-2023-20936 
In bta_av_rc_disc_done of bta_av_act.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-226927612
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-03-24T00:00:00.000Z
CVE-2023-20937 
In several functions of the Android Linux kernel, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257443051References: Upstream kernel
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-02-28T00:00:00.000Z
CVE-2023-20938 
In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257685302References: Upstream kernel
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-02-28T00:00:00.000Z
CVE-2023-20939 
In multiple functions of looper_backed_event_loop.cpp, there is a possible way to corrupt memory due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-243362981
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-02-28T00:00:00.000Z
CVE-2023-20940 
In the Android operating system, there is a possible way to replace a boot partition due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-256237041
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-02-28T00:00:00.000Z
CVE-2023-20941 
In acc_ctrlrequest_composite of f_accessory.c, there is a possible out of bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-264029575References: Upstream kernel
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-04-19T00:00:00.000Z
CVE-2023-20942 
In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.


Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2023-07-12T23:18:19.060Z
CVE-2023-20943 
In clearApplicationUserData of ActivityManagerService.java, there is a possible way to remove system files due to a path traversal error. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-240267890
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-02-28T00:00:00.000Z
CVE-2023-20944 
In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-244154558
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-02-28T00:00:00.000Z
CVE-2023-20945 
In phNciNfc_MfCreateXchgDataHdr of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-246932269
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-02-28T00:00:00.000Z
CVE-2023-20946 
In onStart of BluetoothSwitchPreferenceController.java, there is a possible permission bypass due to a confused deputy. This could lead to remote escalation of privilege in Bluetooth settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-244423101
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-02-28T00:00:00.000Z
CVE-2023-20947 
In getGroupState of GrantPermissionsViewModel.kt, there is a possible way to keep a one-time permission granted due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-237405974
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2023-03-24T00:00:00.000Z
CVE-2023-20948 
In dropFramesUntilIframe of AAVCAssembler.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-230630526
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2023-02-28T00:00:00.000Z
CVE-2023-20949 
In s2mpg11_pmic_probe of s2mpg11-regulator.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-259323133References: N/A
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2023-02-15T00:00:00.000Z