CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-0045
https://notcve.org/view.php?id=CVE-2024-0045
In smp_proc_sec_req of smp_act.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. En smp_proc_sec_req de smp_act.cc, existe una posible lectura fuera de los límites debido a una validación de entrada incorrecta. Esto podría conducir a la divulgación de información remota (próxima/adyacente) sin necesidad de privilegios de ejecución adicionales. • https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7d0f696f450241d8ba7a168ba14fa7b75032f0c9 https://source.android.com/security/bulletin/2024-03-01 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 6CVE-2024-0044
https://notcve.org/view.php?id=CVE-2024-0044
In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En createSessionInternal de PackageInstallerService.java, existe una posible ejecución como cualquier aplicación debido a una validación de entrada incorrecta. Esto podría conducir a una escalada local de privilegios sin necesidad de permisos de ejecución adicionales. • https://github.com/scs-labrat/android_autorooter https://github.com/Re13orn/CVE-2024-0044-EXP https://github.com/007CRIPTOGRAFIA/c-CVE-2024-0044 https://github.com/Kai2er/CVE-2024-0044-EXP https://github.com/nahid0x1/CVE-2024-0044 https://github.com/canyie/CVE-2024-0044 https://android.googlesource.com/platform/frameworks/base/+/65bd134b0a82c51a143b89821d5cdd00ddc31792 https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-m7fh-f3w4-r6v2 https://rtx.meta.security/exploitation& • CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) •
CVSS: -EPSS: 0%CPEs: 4EXPL: 2CVE-2024-0039
https://notcve.org/view.php?id=CVE-2024-0039
In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. En attp_build_value_cmd de att_protocol.cc, hay una posible escritura fuera de los límites debido a una verificación de los límites faltantes. Esto podría conducir a la ejecución remota de código sin necesidad de privilegios de ejecución adicionales. • https://github.com/41yn14/CVE-2024-0039-Exploit https://github.com/23Nero/fix-02-failure-CVE-2024-31319-CVE-2024-0039 https://android.googlesource.com/platform/packages/modules/Bluetooth/+/015c618a0461def93138173a53daaf27ca0630c9 https://android.googlesource.com/platform/packages/modules/Bluetooth/+/17044ccf3a2858633cad8f87926e752edfe0d8d8 https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f0f35273101518d1f3a660b151804e90d0249af3 https://source.android.com/security/bulletin/2024-03-01 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 3CVE-2024-2176
https://notcve.org/view.php?id=CVE-2024-2176
Use after free in FedCM in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Use after free en FedCM en Google Chrome anterior a 122.0.6261.111 permitía a un atacante remoto explotar potencialmente la corrupción del montón a través de una página HTML manipulada. (Severidad de seguridad de Chrome: alta) • https://github.com/r4p3c4/CVE-2024-21762-Exploit-PoC-Fortinet-SSL-VPN-Check https://github.com/d0rb/CVE-2024-21762 https://github.com/Codeb3af/Cve-2024-21762- https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html https://issues.chromium.org/issues/325936438 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYEGSHTMXIPXD5OW5CXVWQS3ZUBCBSXG • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2174
https://notcve.org/view.php?id=CVE-2024-2174
Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) La implementación inadecuada en V8 en Google Chrome anterior a 122.0.6261.111 permitió a un atacante remoto explotar potencialmente la corrupción del montón a través de una página HTML manipulada. (Severidad de seguridad de Chrome: alta) • https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html https://issues.chromium.org/issues/325866363 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYEGSHTMXIPXD5OW5CXVWQS3ZUBCBSXG • CWE-358: Improperly Implemented Security Check for Standard •