97,130 results · Clear filters · Feed
-
High 8.4
In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead…
-
High 7.8
In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass v…
-
High 8.4
In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to lo…
-
High 8.4
In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local e…
-
High 8.4
In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to loca…
-
High 8.4
In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local esca…
-
High 8.4
In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead t…
-
High 8.4
In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could…
-
High 7.5
In parseContentType of PduParser.java, there is a possible denial of service due to an integer overflow. This could lea…
-
High 8.4
In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused de…
-
High 8.4
In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception. T…
-
High 8.4
In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account…
-
High 8.4
In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote escal…
-
High 8.4
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation…
-
High 8.4
In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a co…
-
High 8.4
In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent action…
-
High 8.4
In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy d…
-
High 8.4
In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing pe…
-
High 8.4
In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This…
-
High 7.8
In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input valid…
-
High 8.4
In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused de…
-
High 8.4
In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in th…
-
High 8.4
In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confu…
-
High 8.4
In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic er…
-
High 8.4
In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improp…
-
High 8.4
In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper in…
-
High 8.4
In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due t…
-
High 8.4
In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to i…
-
High 8.4
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay …
-
High 8.4
In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/ov…
-
High 7.8
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerabili…
-
High 7.8
Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket
The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to …
-
High 7.1
psqlODBC does not escape a server-supplied column name in its updatable-cursor queries
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause o…
-
High 7.5
psqlODBC does not validate column numbers and row indexes in binding and descriptor functions
Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC…
-
High 7.5
psqlODBC SQL injection through SQLSpecialColumns table and schema names
SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets th…
-
High 7.5
psqlODBC ODBC escape parser stack buffer overflow
The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and …
-
High 7.5
psqlODBC large-object read overflows the application buffer
psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more byte…
-
High 7.5
psqlODBC row cache overflow when a later FETCH changes the column count
psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more col…
-
High 8.2
Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials
Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration…
-
High 8.1
Munshi Missing Authorization in Company Deletion API
Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company own…