2,761 results · Feed
-
Medium 6.7
The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::we…
-
Low 2.5
A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` wh…
-
High 7.8
The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL s…
-
High 7.5
The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `Came…
-
Medium 6.1
A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensi…
-
High 7.8
An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an…
-
Medium 5.3
The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.per…
-
Medium 4.0
In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to …
-
Medium 6.2
In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local…
-
Medium 6.2
In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input vali…
-
High 7.4
In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalati…
-
High 8.4
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local es…
-
High 7.4
In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. …
-
High 7.4
In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to…
-
Medium 6.2
In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in t…
-
High 8.4
In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy.…
-
Medium 4.0
In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. Th…
-
Medium 6.2
In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local…
-
Medium 5.9
In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. Th…
-
High 8.4
In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal. This co…
-
Medium 4.0
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local informa…
-
High 8.4
In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local esc…
-
Medium 4.0
In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a mi…
-
Medium 4.0
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local…
-
Medium 6.2
In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to lo…
-
Medium 6.2
In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource…
-
Medium 5.3
In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code. T…
-
Medium 4.0
In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. …
-
High 8.4
In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check.…
-
High 8.4
In multiple locations, there is a possible permission bypass due to an uncaught exception. This could lead to local esc…
-
Medium 4.0
In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a miss…
-
Low 2.4
In handleMessage of UsbDeviceManager.java, there is a possible lock-screen bypass due to a logic error in the code. Thi…
-
Medium 4.0
In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the co…
-
High 8.4
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalat…
-
Medium 4.0
In validateImageInfo of Bitmap.cpp, there is a possible out-of-bounds read due to a precondition check failure. This co…
-
High 8.4
In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could…
-
High 8.4
In multiple functions of NfcService.java, there is a possible permission bypass due to a missing permission check. This…
-
Medium 5.3
In l2c_fcr_process_peer_cfg_req of l2c_fcr.cc, there is a possible memory safety issue due to an integer overflow. This…
-
High 8.4
In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission …
-
Medium 4.0
In isValid of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead …