Google Android vulnerabilities

CVE-2023-40127 [LOW] CVE-2023-40127: In multiple locations, there is a possible way to access screenshots due to a confused deputy. This In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2020-0422 [LOW] CVE-2020-0422: In constructImportFailureNotification of NotificationImportExportListener.java, there is a possible In constructImportFailureNotification of NotificationImportExportListener.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local information disclosure of contact data with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Andr

CVE-2020-0459 [LOW] CWE-862 CVE-2020-0459: In sendConfiguredNetworkChangedBroadcast of WifiConfigManager.java, there is a possible leak of sens In sendConfiguredNetworkChangedBroadcast of WifiConfigManager.java, there is a possible leak of sensitive WiFi configuration data due to a missing permission check. This could lead to local information disclosure of WiFi network names with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:

CVE-2020-0047 [LOW] CWE-862 CVE-2020-0047: In setMasterMute of AudioService.java, there is a missing permission check. This could lead to local In setMasterMute of AudioService.java, there is a missing permission check. This could lead to local silencing of audio with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141622311

CVE-2022-20526 [LOW] CWE-787 CVE-2022-20526: In CanvasContext::draw of CanvasContext.cpp, there is a possible out of bounds write due to a missin In CanvasContext::draw of CanvasContext.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-229742774

CVE-2022-39898 [LOW] CWE-284 CVE-2022-39898: Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attack Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some information of usim.

CVE-2022-39896 [LOW] CWE-284 CVE-2022-39896: Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent.

CVE-2022-39849 [LOW] CWE-284 CVE-2022-39849: Improper access control in knox_vpn_policy service prior to SMR Oct-2022 Release 1 allows allows una Improper access control in knox_vpn_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data.

CVE-2022-39850 [LOW] CWE-284 CVE-2022-39850: Improper access control in mum_container_policy service prior to SMR Oct-2022 Release 1 allows allow Improper access control in mum_container_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data.

CVE-2022-39894 [LOW] CWE-284 CVE-2022-39894: Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-20 Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent.

CVE-2022-33725 [LOW] CWE-94 CVE-2022-33725: A vulnerability using PendingIntent in Knox VPN prior to SMR Aug-2022 Release 1 allows attackers to A vulnerability using PendingIntent in Knox VPN prior to SMR Aug-2022 Release 1 allows attackers to access content providers with system privilege.

CVE-2022-39913 [LOW] CWE-200 CVE-2022-39913: Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user profiles information.

CVE-2023-20932 [LOW] CWE-20 CVE-2023-20932: In onCreatePreferences of EditInfoFragment.java, there is a possible way to read contacts belonging In onCreatePreferences of EditInfoFragment.java, there is a possible way to read contacts belonging to other users due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Andr

CVE-2021-38591 [LOW] CVE-2021-38591: An issue was discovered on LG mobile devices with Android OS P and Q software for mt6762/mt6765/mt68 An issue was discovered on LG mobile devices with Android OS P and Q software for mt6762/mt6765/mt6883. Attackers can change some of the NvRAM content by leveraging the misconfiguration of a debug command. The LG ID is LVE-SMP-210005 (August 2021).

CVE-2022-26090 [LOW] CWE-815 CVE-2022-26090: Improper access control vulnerability in SamsungContacts prior to SMR Apr-2022 Release 1 allows that Improper access control vulnerability in SamsungContacts prior to SMR Apr-2022 Release 1 allows that attackers can access contact information without permission.

CVE-2022-22272 [LOW] CWE-285 CVE-2022-22272: Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get I Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permission

CVE-2022-30757 [LOW] CWE-285 CVE-2022-30757: Improper authorization in isemtelephony prior to SMR Jul-2022 Release 1 allows attacker to obtain CI Improper authorization in isemtelephony prior to SMR Jul-2022 Release 1 allows attacker to obtain CID without ACCESS_FINE_LOCATION permission.

CVE-2023-33879 [LOW] CWE-862 CVE-2023-33879: In music service, there is a missing permission check. This could lead to local information disclosu In music service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

CVE-2023-33880 [LOW] CWE-862 CVE-2023-33880: In music service, there is a missing permission check. This could lead to local information disclosu In music service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

CVE-2021-25515 [LOW] CWE-269 CVE-2021-25515: An improper usage of implicit intent in SemRewardManager prior to SMR Dec-2021 Release 1 allows atta An improper usage of implicit intent in SemRewardManager prior to SMR Dec-2021 Release 1 allows attackers to access BSSID.