2,761 results · Feed
-
Unscored —
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local…
-
Medium 6.4
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation …
-
Unscored —
In multiple locations, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local i…
-
Unscored —
In ac_get_prot_config of plat_trusty.c, there is a possible memory corruption due to improper input validation. This co…
-
Unscored —
In mfc_alloc_enc_roi_buffer of mfc_buf.c, there is a possible out-of-bounds write due to a heap buffer overflow. This c…
-
Unscored —
In aoc_unlocked_ioctl_handle_ion_fd of aoc.c, there is a possible type confusion due to improper input validation. This…
-
Unscored —
In BitmapImageBuffer of bitmap_image_buffer.h, there is a possible out-of-bounds write due to an integer overflow. This…
-
Unscored —
In NotifySipResponse of SessionEx.cpp, there is a possible way to corrupt memory via a dangling connection pointer in t…
-
Medium 6.7
In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local esca…
-
Unscored —
In chppProcessDiscoverAllResponse of system/chre/chpp/clients/discovery.c, there is a possible Heap Buffer Overflow due…
-
Unscored —
In handleEvent of gscan.cpp, there is a possible way to trigger an out of bounds write on the heap due to a missing bou…
-
Unscored —
In createIntent of TimerAgent.java, there is a possible permission bypass due to a confused deputy. This could lead to …
-
Unscored —
In codec3p_secure of codec3p_secure, there is a possible Heap Buffer Overflow due to a missing bounds check. This could…
-
Medium 6.7
In multiple locations, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local …
-
Unscored —
In multiple functions of bitmap_image_buffer.h, there is a possible way to trigger an out of bounds write on the truste…
-
Unscored —
In smmu_config_l3tt of smmu.c, there is a possible permission bypass due to a logic error in the code. This could lead …
-
Unscored —
In cpm_mbox_power_ctrl_sswrp of cpm_mbox.c, there is a possible permission bypass due to a precondition check failure. …
-
Unscored —
In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote co…
-
Unscored —
In get_secure_boot_mode of auth.rs, there is a possible way to bypass root signature verification via fault injection d…
-
Unscored —
In authenticate of verify_image, there is a possible Signature verification logic bypass due to a logic error in the co…
-
Unscored —
In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out-of-bounds write due to a miss…
-
Unscored —
In tipc_dev_probe of tipc_virtio_dev.c, there is a possible way to corrupt memory via an off-by-one cleanup loop on pro…
-
Unscored —
In getChppAppState of chpp_init.cc, there is a possible way to trigger an out of bounds read and corrupt task control s…
-
Unscored —
In send_vdu_directive of gdmc/gsp/dev/bmsm/plat/lga/vdu.c, there is a possible Logic error due to a logic error in the …
-
Medium 6.7
In access_control_enable of multiple files, there is a possible way to release secure coprocessors from reset via uncla…
-
Unscored —
In EncodeLastScanBufferElement of data_manager.cc, there is a possible out-of-bounds write due to a logic error in the …
-
Unscored —
In GC2AvcDec of GC2AvcDec.cpp, there is a possible Logic error due to a logic error in the code. This could lead to loc…
-
Unscored —
In EuiccPort.buildUiccAccessRule of EuiccPort.java, there is a possible Confused Deputy due to a confused deputy. This …
-
Unscored —
In PresenceDecoderV1::DecodeDataElements of presence_decoder_v1.cc, there is a possible out-of-bounds write due to a mi…
-
Unscored —
In multiple locations, there is a possible way to corrupt host allocator metadata in shared memory due to memory corrup…
-
Unscored —
In createDataFlowAsync of data_flow_manager.cc, there is a possible way to trigger an out of bounds write in shared mem…
-
Unscored —
In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the cod…
-
Unscored —
In edgetpu_group_clear_responses of edgetpu_group.c, there is a possible Use After Free due to a logic error in the cod…
-
Unscored —
In CommitToBuffer of hal_override_options.bundle.cc, there is a possible way to retain stale direct memory access mappi…
-
Unscored —
In EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a logic error in the co…
-
Unscored —
In on_vkUpdateDescriptorSetWithTemplateSized2GOOGLE of vk_decoder_global_state.cpp, there is a possible way to leak hos…
-
Medium 6.4
In multiple locations, there is a possible way to modify authenticated coprocessor firmware in shared memory before loa…
-
Unscored —
In getCarrierRestrictionStatus of PhoneInterfaceManager.java, there is a possible permission bypass due to a confused d…
-
Unscored —
In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page referenc…
-
Unscored —
In smmu_detach_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c, there …