CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Google » Android : Security Vulnerabilities (CVSS score between 6 and 6.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2022-30712 20 2022-06-07 2022-06-11
6.4
 None Remote Low Not required Partial Partial None
Improper validation vulnerability in KfaOptions prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities.
2 CVE-2022-27573 787 2022-04-11 2022-04-18
6.5
 None Remote Low ??? Partial Partial Partial
Improper input validation vulnerability in parser_infe and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by privileged attackers.
3 CVE-2022-26099 476 2022-04-11 2022-04-18
6.4
 None Remote Low Not required Partial None Partial
Null pointer dereference vulnerability in parser_infe function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds read by remote attackers.
4 CVE-2022-24925 20 DoS 2022-02-11 2022-02-22
6.8
 None Remote Low ??? None None Complete
Improper input validation vulnerability in SettingsProvider prior to Android S(12) allows privileged attackers to trigger a permanent denial of service attack on a victim's devices.
5 CVE-2022-23729 287 2022-03-04 2022-03-11
6.9
 None Local Medium Not required Complete Complete Complete
When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010.
6 CVE-2022-23728 2022-01-21 2022-07-11
6.6
 None Local Low Not required None Complete Complete
Attacker can reset the device with AT Command in the process of rebooting the device. The LG ID is LVE-SMP-210011.
7 CVE-2022-20155 362 2022-06-15 2022-06-24
6.9
 None Local Medium Not required Complete Complete Complete
In ipu_core_jqs_msg_transport_kernel_write_sync of ipu-core-jqs-msg-transport.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-176754369References: N/A
8 CVE-2022-20148 362 2022-06-15 2022-06-23
6.9
 None Local Medium Not required Complete Complete Complete
In TBD of TBD, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-219513976References: Upstream kernel
9 CVE-2022-20141 362 2022-06-15 2022-09-01
6.9
 None Local Medium Not required Complete Complete Complete
In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-112551163References: Upstream kernel
10 CVE-2022-20137 276 2022-06-15 2022-06-24
6.9
 None Local Medium Not required Complete Complete Complete
In onCreateContextMenu of NetworkProviderSettings.java, there is a possible way for non-owner users to change WiFi settings due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-206986392
11 CVE-2022-20126 287 2022-06-15 2022-06-24
6.9
 None Local Medium Not required Complete Complete Complete
In setScanMode of AdapterService.java, there is a possible way to enable Bluetooth discovery mode without user interaction due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-203431023
12 CVE-2022-20118 362 2022-05-10 2022-05-17
6.9
 None Local Medium Not required Complete Complete Complete
In ion_ioctl and related functions of ion.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205707793References: N/A
13 CVE-2022-20007 362 2022-05-10 2022-05-16
6.2
 None Local High Not required Complete Complete Complete
In startActivityForAttachedApplicationIfNeeded of RootWindowContainer.java, there is a possible way to overlay an app that believes it's still in the foreground, when it is not, due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-211481342
14 CVE-2022-20006 362 2022-05-10 2022-06-15
6.2
 None Local High Not required Complete Complete Complete
In several functions of KeyguardServiceWrapper.java and related files,, there is a possible way to briefly view what's under the lockscreen due to a race condition. This could lead to local escalation of privilege if a Guest user is enabled, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-151095871
15 CVE-2021-39796 1021 2022-04-12 2022-04-20
6.9
 None Local Medium Not required Complete Complete Complete
In HarmfulAppWarningActivity of HarmfulAppWarningActivity.java, there is a possible way to trick victim to install harmful app due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-205595291
16 CVE-2021-39790 863 2022-03-30 2022-04-05
6.8
 None Remote Medium Not required Partial Partial Partial
In Dialer, there is a possible way to manipulate visual voicemail settings due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-186405146
17 CVE-2021-39780 276 Bypass 2022-03-30 2022-04-05
6.8
 None Remote Medium Not required Partial Partial Partial
In Traceur, there is a possible bypass of developer settings requirements for capturing system traces due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-204992293
18 CVE-2021-39771 20 2022-03-30 2022-04-05
6.8
 None Remote Medium Not required Partial Partial Partial
In Settings, there is a possible way to misrepresent which app wants to add a wifi network due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-198661951
19 CVE-2021-39764 20 2022-03-30 2022-04-05
6.8
 None Remote Medium Not required Partial Partial Partial
In Settings, there is a possible way to display an incorrect app name due to improper input validation. This could lead to local escalation of privilege via app spoofing with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-170642995
20 CVE-2021-39713 362 2022-03-16 2022-10-18
6.9
 None Local Medium Not required Complete Complete Complete
Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel
21 CVE-2021-39691 1021 2022-06-15 2022-06-24
6.9
 None Local Medium Not required Complete Complete Complete
In WindowManager, there is a possible tapjacking attack due to an incorrect window flag when processing user input. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-157929241
22 CVE-2021-39686 362 2022-03-16 2022-07-12
6.9
 None Local Medium Not required Complete Complete Complete
In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-200688826References: Upstream kernel
23 CVE-2021-39679 362 2022-01-14 2022-01-20
6.9
 None Local Medium Not required Complete Complete Complete
In init of vendor_graphicbuffer_meta.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188745089References: N/A
24 CVE-2021-39629 362 2022-01-14 2022-01-18
6.9
 None Local Medium Not required Complete Complete Complete
In phTmlNfc_Init and phTmlNfc_CleanUp of phTmlNfc.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-197353344
25 CVE-2021-39625 +Priv 2022-01-14 2022-07-12
6.9
 None Local Medium Not required Complete Complete Complete
In showCarrierAppInstallationNotification of EuiccNotificationManager.java, there is a possible way to gain an access to MediaProvider content due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-194695347
26 CVE-2021-1039 1021 2021-12-15 2021-12-20
6.9
 None Local Medium Not required Complete Complete Complete
In NotificationAccessActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-182808318
27 CVE-2021-1036 1021 2022-01-14 2022-01-20
6.8
 None Remote Medium Not required Partial Partial Partial
In LocationSettingsActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-182812255
28 CVE-2021-0968 190 Exec Code Overflow 2021-12-15 2021-12-17
6.8
 None Remote Medium Not required Partial Partial Partial
In osi_malloc and osi_calloc of allocator.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-197868577
29 CVE-2021-0955 362 Mem. Corr. 2021-12-15 2021-12-20
6.9
 None Local Medium Not required Complete Complete Complete
In pf_write_buf of FuseDaemon.cpp, there is possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-192085766
30 CVE-2021-0954 1021 Bypass 2021-12-15 2021-12-20
6.9
 None Local Medium Not required Complete Complete Complete
In ResolverActivity, there is a possible user interaction bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-143559931
31 CVE-2021-0920 362 2021-12-15 2022-07-12
6.9
 None Local Medium Not required Complete Complete Complete
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
32 CVE-2021-0645 863 Bypass 2021-08-17 2022-07-12
6.8
 None Remote Medium Not required Partial Partial Partial
In shouldBlockFromTree of ExternalStorageProvider.java, there is a possible permissions bypass. This could lead to local escalation of privilege, allowing an app to read private app directories in external storage, which should be restricted in Android 11, with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157320644
33 CVE-2021-0636 2021-10-06 2021-10-08
6.8
 None Remote Medium Not required Partial Partial Partial
When extracting the incorrectly formatted avi file, the memory is damaged, the playback interface shows that the video cannot be played, and the log is found to be crashed. This problem may lead to hacker malicious code attacks, resulting in the loss of user rights.Product: Androidversion: Android-10Android ID: A-189392423
34 CVE-2021-0635 2021-10-06 2021-10-08
6.8
 None Remote Medium Not required Partial Partial Partial
When extracting the incorrectly formatted flv file, the memory is damaged, the playback interface shows that the video cannot be played, and the log is found to be crashed. This problem may lead to hacker malicious code attacks, resulting in the loss of user rights.Product: Androidversion:Android-10Android ID: A-189402477
35 CVE-2021-0600 20 2021-07-14 2021-07-15
6.9
 None Local Medium Not required Complete Complete Complete
In onCreate of DeviceAdminAdd.java, there is a possible way to mislead a user to activate a device admin app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-179042963
36 CVE-2021-0591 610 2021-08-17 2021-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcast receivers due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-179386960
37 CVE-2021-0586 1021 2021-07-14 2021-09-13
6.9
 None Local Medium Not required Complete Complete Complete
In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-182584940
38 CVE-2021-0557 787 Exec Code Overflow 2021-06-22 2021-06-23
6.8
 None Remote Medium Not required Partial Partial Partial
In setRange of ABuffer.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-179046129
39 CVE-2021-0508 362 2021-06-21 2021-06-22
6.9
 None Local Medium Not required Complete Complete Complete
In various functions of DrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-176444154
40 CVE-2021-0506 1021 Bypass 2021-06-21 2021-06-22
6.9
 None Local Medium Not required Complete Complete Complete
In ActivityPicker.java, there is a possible bypass of user interaction in intent resolution due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-181962311
41 CVE-2021-0482 416 Exec Code Mem. Corr. 2021-06-11 2021-06-16
6.9
 None Local Medium Not required Complete Complete Complete
In BinderDiedCallback of MediaCodec.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173791720
42 CVE-2021-0476 416 2021-06-11 2021-06-15
6.9
 None Local Medium Not required Complete Complete Complete
In FindOrCreatePeer of btif_av.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-169252501
43 CVE-2021-0434 2021-12-15 2022-07-12
6.9
 None Local Medium Not required Complete Complete Complete
In onReceive of BluetoothPermissionRequest.java, there is a possible phishing attack allowing a malicious Bluetooth device to acquire permissions based on insufficient information presented to the user in the consent dialog. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-167403112
44 CVE-2021-0401 362 Mem. Corr. 2021-02-26 2021-03-02
6.9
 None Local Medium Not required Complete Complete Complete
In vow, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05418265.
45 CVE-2021-0393 787 Exec Code Overflow 2021-03-10 2021-03-12
6.8
 None Remote Medium Not required Partial Partial Partial
In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if an attacker can supply a malicious PAC file, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-168041375
46 CVE-2021-0391 2021-03-10 2021-03-12
6.8
 None Remote Medium Not required Partial Partial Partial
In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-172841550
47 CVE-2021-0387 362 2021-03-10 2021-03-12
6.9
 None Local Medium Not required Complete Complete Complete
In FindQuotaDeviceForUuid of QuotaUtils.cpp, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-169421939
48 CVE-2021-0386 2021-03-10 2021-03-12
6.8
 None Remote Medium Not required Partial Partial Partial
In onCreate of UsbConfirmActivity, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173421110
49 CVE-2021-0367 362 Mem. Corr. 2021-02-26 2021-03-02
6.9
 None Local Medium Not required Complete Complete Complete
In vpu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05371580; Issue ID: ALPS05379085.
50 CVE-2021-0366 362 Mem. Corr. 2021-02-26 2021-03-02
6.9
 None Local Medium Not required Complete Complete Complete
In vpu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05371580; Issue ID: ALPS05379093.
Total number of vulnerabilities : 335   Page : 1 (This Page)2 3 4 5 6 7
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.