Platform
Android
6,319 known vulnerabilities.
6,319 results · Feed
-
Unscored —
In various functions of various files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction fo…
-
Unscored —
In sdpu_build_uuid_seq of sdp_discovery.cc, there is a possible out of bounds write due to a use after free. This could…
-
Unscored —
In getFullScreenIntentDecision of NotificationInterruptStateProviderImpl.java, there is a possible activity launch whil…
-
Unscored —
In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a lo…
-
Unscored —
In multiple functions of WVDrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead t…
-
Unscored —
In multiple functions of cdm_engine.cpp, there is a possible use-after-free due to improper locking. This could lead to…
-
Unscored —
In readSampleData of NuMediaExtractor.cpp, there is a possible out of bounds write due to uninitialized data. This coul…
-
Unscored —
In multiple functions of multiple files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction …
-
Unscored —
In onResume of AppManagementFragment.java, there is a possible way to prevent users from forgetting a previously connec…
-
Unscored —
In several functions of several files, there is a possible way to access developer mode traces due to a permissions byp…
-
Unscored —
In _PMRCreate of the PowerVR kernel driver, a missing bounds check means it is possible to overwrite heap memory via Ph…
-
Unscored —
In PVRSRVBridgeSyncPrimOpCreate of the PowerVR kernel driver, a missing size check means there is a possible integer ov…
-
Medium 4.3
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_title function. This makes it possible for unauthenticated attackers to update new order title via a forged request …
-
Medium 4.3
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Status Update
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_message function. This makes it possible for unauthenticated attackers to update status order message via a forge…
-
Medium 4.3
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Message Update
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function. This makes it possible for unauthenticated attackers to update new order message via a forged requ…
-
Medium 4.3
MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Update
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. This makes it possible for unauthenticated attackers to update limit the number of product per categor…
-
Medium 4.3
Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their di…
-
Unscored —
Jiyu Kukan Toku-Toku coupon App for iOS versions 3.5.0 and earlier, and Jiyu Kukan Toku-Toku coupon App for Android ver…
-
Critical 9.8
MStore API <= 2.1.5 - Authentication Bypass
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the 'register' and 'update_user_profile' routes. This makes it possible for unauthenticated attackers to …
-
Unscored —
Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in …
-
Medium 6.5
Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This ma…
-
High 8.8
An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global o…
-
Unscored —
Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resu…
-
Medium 6.5
A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affe…
-
High 8.8
Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run att…
-
Medium 6.5
When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, …
-
Unscored —
Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-contr…
-
Medium 6.5
If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused me…
-
High 8.8
Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruptio…
-
Unscored —
Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-ex…
-
Unscored —
An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, res…
-
High 8.8
Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that …
-
Unscored —
A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscree…
-
Unscored —
When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename…
-
Critical 9.8
MStore API <= 3.9.2 - Authentication Bypass
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it p…
-
Critical 9.8
MStore API <= 3.9.0 - Authentication Bypass
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This make…
-
Critical 9.8
MStore API <= 3.9.1 - Authentication Bypass
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This …
-
High 7.8CVE-2023-21109 Public exploit
In multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error …
-
Medium 6.2CVE-2023-21118 Public exploit
In unflattenString8 of Sensor.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lea…
-
High 7.8
In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to a logic error…