440 results · Clear filters · Feed
-
Medium 4.3
In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This co…
-
Medium 5.5
In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion. This could…
-
Medium 5.5
In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource…
-
Medium 5.5
In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to …
-
Medium 4.3
In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic e…
-
Medium 6.5
In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. …
-
Medium 4.0
In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to …
-
Medium 4.3
In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote …
-
Medium 5.3
In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to re…
-
Medium 4.0
In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local informatio…
-
Medium 4.0
In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This coul…
-
Medium 5.3
In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. This could lead to…
-
Medium 4.3
In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remot…
-
Medium 4.0
In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic err…
-
Medium 4.3
In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to…
-
Medium 4.3
In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote informa…
-
Medium 4.3
In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. This could lead…
-
Medium 6.5
In NrmmMsgCodec::DecodeUPUTransparentContext of cn_NrmmDecoder.cpp, there is a possible out-of-bounds read due to memor…
-
Medium 4.0
In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a…
-
Medium 5.5
In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper i…
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo…
-
Medium 5.5
In applySimpleFieldMaxSize of DataRowHandler.java, there is a possible way to insert a large contact name due to improp…
-
Medium 6.8
In onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null …
-
Medium 5.9
In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a…
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a permanent denial of service due…
-
Medium 5.5
In updateState of GraphicsDriverEnableAngleAsSystemDriverController.java, there is a possible persistent dos issue due …
-
Medium 5.5
In getPreferredSize of LauncherProcessImageListener.kt, there is a possible denial of service due to resource exhaustio…
-
Medium 5.5
In verifySignature of ApkChecksums.java, there is a possible way to cause a crash due to resource exhaustion. This coul…
-
Medium 5.5
In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause the system to crash due to an int…
-
Medium 6.2
In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a system crash due to improper in…
-
Medium 6.2
In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tap…
-
Medium 6.8
In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/o…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo…
-
Medium 5.5
In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to impr…
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to resource e…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible UBSan failure due to an integer overflow. This…
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer…