rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-0006 DB User Password Leak in Application Log
Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in log files, potentially leading to unauthorized database access.
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: YugabyteDB
product: YugabyteDB Anywhere
default_status: unaffected
Published: 2024-07-19T14:26:14.160Z
CVE-2024-0007 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface on Panorama appliances. This enables the impersonation of another authenticated administrator.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Palo Alto Networks
product: PAN-OS
default_status: unaffected
vendor: Palo Alto Networks
product: Prisma Access
default_status: unaffected
vendor: Palo Alto Networks
product: Cloud NGFW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Palo Alto Networks thanks an external reporter for discovering and reporting this issue.
Published: 2024-02-14T17:32:08.971Z
CVE-2024-0008 PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface
Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: Palo Alto Networks
product: PAN-OS
default_status: unaffected
vendor: Palo Alto Networks
product: Prisma Access
default_status: unaffected
vendor: Palo Alto Networks
product: Cloud NGFW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Palo Alto Networks thanks Brian Yaklin for discovering and reporting this issue.
Published: 2024-02-14T17:32:17.611Z
CVE-2024-0009 PAN-OS: Improper IP Address Verification in GlobalProtect Gateway
An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a VPN connection from an unauthorized IP address.
Problem types: cwe_id: CWE-940
description: CWE-940 Improper Verification of Source of a Communication Channel
Affected products: vendor: Palo Alto Networks
product: PAN-OS
default_status: unaffected
vendor: Palo Alto Networks
product: Prisma Access
default_status: unaffected
vendor: Palo Alto Networks
product: Cloud NGFW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Palo Alto Networks thanks Matthew Fong for discovering and reporting this issue.
Published: 2024-02-14T17:32:23.171Z
CVE-2024-0010 PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Portal
A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context of a user’s browser) if a user clicks on a malicious link, allowing phishing attacks that could lead to credential theft.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Palo Alto Networks
product: PAN-OS
default_status: unaffected
vendor: Palo Alto Networks
product: Prisma Access
default_status: unaffected
vendor: Palo Alto Networks
product: Cloud NGFW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Palo Alto Networks thanks Michał Majchrowicz and Livio Victoriano from Afine Team for discovering and reporting this issue.
Published: 2024-02-14T17:32:28.818Z
CVE-2024-0011 PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication
A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context of an authenticated Captive Portal user’s browser) if a user clicks on a malicious link, allowing phishing attacks that could lead to credential theft.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Palo Alto Networks
product: PAN-OS
default_status: unaffected
vendor: Palo Alto Networks
product: Prisma Access
default_status: unaffected
vendor: Palo Alto Networks
product: Cloud NGFW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Palo Alto Networks thanks Darek Jensen and an external reporter for discovering and reporting this issue.
Published: 2024-02-14T17:32:34.809Z
CVE-2024-0014 
In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T00:08:14.746Z
CVE-2024-0015 
In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T18:33:36.716Z
CVE-2024-0016 
In multiple locations, there is a possible out of bounds read due to a missing bounds check. This could lead to paired device information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information Disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T19:33:31.029Z
CVE-2024-0017 
In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T19:33:31.218Z
CVE-2024-0018 
In convertYUV420Planar16ToY410 of ColorConverter.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T19:33:31.399Z
CVE-2024-0019 
In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due to a missing check for active recordings. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T19:33:31.592Z
CVE-2024-0020 
In onActivityResult of NotificationSoundPreference.java, there is a possible way to hear audio files belonging to a different user due to a confused deputy. This could lead to local information disclosure across users of a device with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T19:33:31.785Z
CVE-2024-0021 
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way for an app in the work profile to enable notification listener services due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T19:33:31.985Z
CVE-2024-0022 
In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationActivity of another user profile due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-05-07T21:01:28.747Z
CVE-2024-0023 
In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T19:36:25.339Z
CVE-2024-0024 
In multiple methods of UserManagerService.java, there is a possible failure to persist or enforce user restrictions due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-05-07T21:03:30.602Z
CVE-2024-0025 
In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-05-07T21:03:30.690Z
CVE-2024-0026 
In multiple functions of SnoozeHelper.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Denial of service
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-05-07T21:01:28.832Z
CVE-2024-0027 
In multiple functions of SnoozeHelper.java, there is a possible way to cause a boot loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Denial of service
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-05-07T21:01:28.935Z
CVE-2024-0028 
In Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-05T16:10:01.094Z
CVE-2024-0029 
In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T00:08:15.102Z
CVE-2024-0030 
In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T00:08:15.454Z
CVE-2024-0031 
In attp_build_read_by_type_value_cmd of att_protocol.cc , there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Remote code execution
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T00:08:15.792Z
CVE-2024-0032 
In multiple locations, there is a possible way to request access to directories that should be hidden due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T00:08:16.134Z
CVE-2024-0033 
In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T00:08:16.586Z
CVE-2024-0034 
In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T00:08:16.947Z
CVE-2024-0035 
In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T00:08:17.297Z
CVE-2024-0036 
In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T00:08:17.660Z
CVE-2024-0037 
In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T00:08:18.031Z
CVE-2024-0038 
In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T00:08:18.446Z
CVE-2024-0039 
In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Remote code execution
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T16:35:21.612Z
CVE-2024-0040 
In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T00:08:18.790Z
CVE-2024-0041 
In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local escalation of privilege that fails to remove the persistent dot with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-16T00:08:19.126Z
CVE-2024-0042 
In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. This could lead to local bypass of DRM content protection with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Unknown
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-05-07T21:01:29.018Z
CVE-2024-0043 
In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-05-07T21:03:30.780Z
CVE-2024-0044 
In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T16:35:21.760Z
CVE-2024-0045 
In smp_proc_sec_req of smp_act.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T16:35:21.876Z
CVE-2024-0046 
In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T16:35:21.955Z
CVE-2024-0047 
In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in the code. This could lead to local denial of service when policies are deserialized on reboot with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Denial of service
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T16:35:22.043Z
CVE-2024-0048 
In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of null responses. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T16:35:22.131Z
CVE-2024-0049 
In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User  interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T16:35:22.215Z
CVE-2024-0050 
In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a missing validation check. This could lead to a local non-security issue with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T16:35:22.297Z
CVE-2024-0051 
In onQueueFilled of SoftMPEG4.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T16:35:22.378Z
CVE-2024-0052 
In multiple functions of healthconnect, there is a possible leakage of exercise route data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T16:35:22.458Z