CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Google » Android : Security Vulnerabilities (CVSS score between 4 and 4.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2021-27901 2021-03-02 2021-03-08
4.6
None Local Low Not required Partial Partial Partial
An issue was discovered on LG mobile devices with Android OS 11 software. They mishandle fingerprint recognition because local high beam mode (LHBM) does not function properly during bright illumination. The LG ID is LVE-SMP-210001 (March 2021).
2 CVE-2021-25474 755 DoS +Priv 2021-10-06 2021-10-13
4.9
None Local Low Not required None None Complete
Assuming a shell privilege is gained, an improper exception handling for multi_sim_bar_show_on_qspanel value in SystemUI prior to SMR Oct-2021 Release 1 allows an attacker to cause a permanent denial of service in user device before factory reset.
3 CVE-2021-25473 755 DoS +Priv 2021-10-06 2021-10-13
4.9
None Local Low Not required None None Complete
Assuming a shell privilege is gained, an improper exception handling for multi_sim_bar_hide_by_meadia_full value in SystemUI prior to SMR Oct-2021 Release 1 allows an attacker to cause a permanent denial of service in user device before factory reset.
4 CVE-2021-25461 120 Overflow 2021-09-09 2021-09-22
4.6
None Local Low Not required Partial Partial Partial
An improper length check in APAService prior to SMR Sep-2021 Release 1 results in stack based Buffer Overflow.
5 CVE-2021-25456 125 2021-09-09 2021-09-22
4.3
None Remote Medium Not required None Partial None
OOB read vulnerability in libswmfextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute memcpy at arbitrary address via forged wmf file.
6 CVE-2021-25455 125 2021-09-09 2021-09-23
4.3
None Remote Medium Not required Partial None None
OOB read vulnerability in libsaviextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to access arbitrary address through pointer via forged avi file.
7 CVE-2021-25454 125 2021-09-09 2021-09-22
4.3
None Remote Medium Not required None None Partial
OOB read vulnerability in libsaacextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute remote DoS via forged aac file.
8 CVE-2021-25451 287 2021-09-09 2021-09-23
4.3
None Remote Medium Not required Partial None None
A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data.
9 CVE-2021-25443 416 2021-08-05 2021-08-12
4.6
None Local Low Not required Partial Partial Partial
A use after free vulnerability in conn_gadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an attacker.
10 CVE-2021-25428 20 2021-07-08 2021-07-14
4.6
None Local Low Not required Partial Partial Partial
Improper validation check vulnerability in PackageManager prior to SMR July-2021 Release 1 allows untrusted applications to get dangerous level permission without user confirmation in limited circumstances.
11 CVE-2021-25414 2021-06-11 2021-10-18
4.6
None Local Low Not required Partial Partial Partial
Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to copy or overwrite arbitrary files with Samsung Contacts privilege.
12 CVE-2021-25395 362 Bypass 2021-06-11 2021-06-16
4.4
None Local Medium Not required Partial Partial Partial
A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.
13 CVE-2021-25394 362 2021-06-11 2021-06-16
4.4
None Local Medium Not required Partial Partial Partial
A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised.
14 CVE-2021-25370 Mem. Corr. 2021-03-26 2021-03-31
4.9
None Local Low Not required None None Complete
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.
15 CVE-2021-25347 2021-03-04 2021-03-12
4.6
None Local Low Not required Partial Partial Partial
Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the provider is executed.
16 CVE-2021-25336 863 2021-03-04 2021-03-11
4.3
None Remote Medium Not required Partial None None
Improper access control in NotificationManagerService in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to acquire notification access via sending a crafted malicious intent.
17 CVE-2021-25334 20 DoS 2021-03-04 2021-03-11
4.7
None Local Medium Not required None None Complete
Improper input check in wallpaper service in Samsung mobile devices prior to SMR Feb-2021 Release 1 allows untrusted application to cause permanent denial of service.
18 CVE-2021-0936 416 Mem. Corr. 2021-10-25 2021-10-26
4.6
None Local Low Not required Partial Partial Partial
In acc_read of f_accessory.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-173789633References: Upstream kernel
19 CVE-2021-0706 276 DoS 2021-10-22 2021-10-26
4.9
None Local Low Not required None None Complete
In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-193444889
20 CVE-2021-0692 269 2021-10-06 2021-10-08
4.6
None Local Low Not required Partial Partial Partial
In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-179289753
21 CVE-2021-0691 269 Exec Code +Priv 2021-10-06 2021-10-08
4.6
None Local Low Not required Partial Partial Partial
In the SELinux policy configured in system_app.te, there is a possible way for system_app to gain code execution in other processes due to an overly-permissive SELinux policy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-188554048
22 CVE-2021-0690 787 Overflow 2021-10-06 2021-10-08
4.3
None Remote Medium Not required Partial None None
In ih264d_mark_err_slice_skip of ih264d_parse_pslice.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-182152757
23 CVE-2021-0688 362 Bypass 2021-10-06 2021-10-08
4.4
None Local Medium Not required Partial Partial Partial
In lockNow of PhoneWindowManager.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-161149543
24 CVE-2021-0685 502 2021-10-06 2021-10-08
4.6
None Local Low Not required Partial Partial Partial
In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-191055353
25 CVE-2021-0684 416 2021-10-06 2021-10-08
4.6
None Local Low Not required Partial Partial Partial
In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-179839665
26 CVE-2021-0683 Exec Code 2021-10-06 2021-10-08
4.6
None Local Low Not required Partial Partial Partial
In runTraceIpcStop of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-185398942
27 CVE-2021-0654 276 2021-07-14 2021-07-20
4.3
None Remote Medium Not required Partial None None
In isRealSnapshot of TaskThumbnailView.java, there is possible data exposure due to a missing permission check. This could lead to local information disclosure from locked profiles with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168802517References: N/A
28 CVE-2021-0651 20 DoS 2021-10-22 2021-10-27
4.7
None Local Medium Not required None None Complete
In loadLabel of PackageItemInfo.java, there is a possible way to DoS a device by having a long label in an app due to incorrect input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-67013844
29 CVE-2021-0646 20 2021-08-17 2021-08-25
4.6
None Local Low Not required Partial Partial Partial
In sqlite3_str_vappendf of sqlite3.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege if the user can also inject a printf into a privileged process's SQL with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-153352319
30 CVE-2021-0642 862 2021-08-17 2021-08-24
4.3
None Remote Medium Not required Partial None None
In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permissions due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-185126149
31 CVE-2021-0640 787 2021-08-17 2021-08-24
4.6
None Local Low Not required Partial Partial Partial
In noteAtomLogged of StatsdStats.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-187957589
32 CVE-2021-0628 20 Mem. Corr. 2021-08-18 2021-08-25
4.6
None Local Low Not required Partial Partial Partial
In OMA DRM, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05722454; Issue ID: ALPS05722454.
33 CVE-2021-0627 190 Overflow Mem. Corr. 2021-08-18 2021-08-25
4.6
None Local Low Not required Partial Partial Partial
In OMA DRM, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05722434; Issue ID: ALPS05722434.
34 CVE-2021-0626 787 2021-08-18 2021-08-25
4.6
None Local Low Not required Partial Partial Partial
In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05687510; Issue ID: ALPS05687510.
35 CVE-2021-0608 610 2021-06-22 2021-06-25
4.6
None Local Low Not required Partial Partial Partial
In handleAppLaunch of AppLaunchActivity.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174870704
36 CVE-2021-0607 119 Exec Code Overflow 2021-06-22 2021-06-25
4.6
None Local Low Not required Partial Partial Partial
In iaxxx_calc_i2s_div of iaxxx-codec.c, there is a possible hardware port write with user controlled data due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-180950209
37 CVE-2021-0606 416 2021-06-22 2021-06-25
4.6
None Local Low Not required Partial Partial Partial
In drm_syncobj_handle_to_fd of drm_syncobj.c, there is a possible use after free due to incorrect refcounting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168034487
38 CVE-2021-0605 125 2021-06-22 2021-06-25
4.9
None Local Low Not required Complete None None
In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-110373476
39 CVE-2021-0603 276 2021-07-14 2021-07-16
4.4
None Local Medium Not required Partial Partial Partial
In onCreate of ContactSelectionActivity.java, there is a possible way to get access to contacts without permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-182809425
40 CVE-2021-0601 787 Exec Code 2021-07-14 2021-07-15
4.9
None Local Low Not required Complete None None
In encodeFrames of avc_enc_fuzzer.cpp, there is a possible out of bounds write due to a double free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-180643802
41 CVE-2021-0599 610 2021-07-14 2021-07-15
4.9
None Local Low Not required Complete None None
In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broadcasted intent due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-175614289
42 CVE-2021-0598 269 2021-10-06 2021-10-08
4.4
None Local Medium Not required Partial Partial Partial
In onCreate of ConfirmConnectActivity.java, there is a possible pairing of untrusted Bluetooth devices due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-180422108
43 CVE-2021-0597 862 2021-07-14 2021-07-15
4.9
None Local Low Not required Complete None None
In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-176496502
44 CVE-2021-0595 269 2021-10-06 2021-10-08
4.6
None Local Low Not required Partial Partial Partial
In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logging in. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-177457096
45 CVE-2021-0593 610 2021-08-17 2021-08-24
4.6
None Local Low Not required Partial Partial Partial
In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiver due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-179386068
46 CVE-2021-0590 276 2021-07-14 2021-07-16
4.9
None Local Low Not required Complete None None
In sendNetworkConditionsBroadcast of NetworkMonitor.java, there is a possible way for a privileged app to receive WiFi BSSID and SSID without location permissions due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-175213041
47 CVE-2021-0588 276 2021-07-14 2021-07-16
4.9
None Local Low Not required Complete None None
In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9Android ID: A-177238342
48 CVE-2021-0583 269 2021-10-11 2021-10-18
4.4
None Local Medium Not required Partial Partial Partial
In onCreate of BluetoothPairingDialog, there is a possible way to enable Bluetooth without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-182282956
49 CVE-2021-0576 787 2021-08-17 2021-08-24
4.6
None Local Low Not required Partial Partial Partial
In flv extractor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187236084
50 CVE-2021-0574 787 2021-08-17 2021-08-24
4.6
None Local Low Not required Partial Partial Partial
In asf extractor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187234876
Total number of vulnerabilities : 1007   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.