CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-21298
https://notcve.org/view.php?id=CVE-2023-21298
30 Oct 2023 — In Slice, there is a possible disclosure of installed applications due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En Slice, existe una posible divulgación de aplicaciones instaladas debido a la divulgación de información del canal lateral. Esto podría conducir a una escalada local de privilegios sin necesidad de permisos de ejecución adicionales. • https://source.android.com/docs/security/bulletin/android-14 • CWE-203: Observable Discrepancy •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-21297
https://notcve.org/view.php?id=CVE-2023-21297
30 Oct 2023 — In SEPolicy, there is a possible way to access the factory MAC address due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. En SEPolicy, existe una forma posible de acceder a la dirección MAC de fábrica debido a una omisión de permisos. Esto podría conducir a la divulgación de información local con privilegios de ejecución del System necesarios. • https://source.android.com/docs/security/bulletin/android-14 • CWE-287: Improper Authentication •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-21296
https://notcve.org/view.php?id=CVE-2023-21296
30 Oct 2023 — In Permission, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. En Permission, existe una forma posible de determinar si una aplicación está instalada, sin permisos de consulta, debido a la divulgación de información del canal lateral. Esto podría conducir a una escalada local de p... • https://source.android.com/docs/security/bulletin/android-14 • CWE-203: Observable Discrepancy •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-21295
https://notcve.org/view.php?id=CVE-2023-21295
30 Oct 2023 — In SliceManagerService, there is a possible way to check if a content provider is installed due to a missing null check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. En SliceManagerService, existe una forma posible de verificar si un proveedor de contenido está instalado debido a que falta una verificación nula. Esto podría dar lugar a la divulgación de información local sin necesidad de privilegios de ejecuc... • https://source.android.com/docs/security/bulletin/android-14 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-21294
https://notcve.org/view.php?id=CVE-2023-21294
30 Oct 2023 — In Slice, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. En Slice, existe una posible divulgación de paquetes instalados debido a una falta de verificación de permisos. Esto podría dar lugar a la divulgación de información local sin necesidad de privilegios de ejecución adicionales. • https://source.android.com/docs/security/bulletin/android-14 • CWE-862: Missing Authorization •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-21293
https://notcve.org/view.php?id=CVE-2023-21293
30 Oct 2023 — In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En PackageManagerNative, existe una forma posible de determinar si una aplicación está instalada, sin permisos de consulta, debido a la divulgación de información del canal lateral. Esto podría conducir a... • https://source.android.com/docs/security/bulletin/android-14 • CWE-203: Observable Discrepancy •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-20264
https://notcve.org/view.php?id=CVE-2022-20264
30 Oct 2023 — In Usage Stats Service, there is a possible way to determine whether an app is installed, without query permissions due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. En el Servicio de Estadísticas de Uso, existe una manera posible de determinar si una aplicación está instalada, sin permisos de consulta debido a la divulgación de información del canal lateral. Esto podría... • https://source.android.com/docs/security/bulletin/android-14 • CWE-203: Observable Discrepancy •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-39810
https://notcve.org/view.php?id=CVE-2021-39810
30 Oct 2023 — In NFC, there is a possible way to setup a default contactless payment app without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En NFC, existe una forma posible de configurar una aplicación de pago sin contacto predeterminada sin el consentimiento del usuario debido a que falta una verificación de permiso. Esto podría conducir a una escalada local de privilegio... • https://source.android.com/docs/security/bulletin/android-14 • CWE-862: Missing Authorization •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-44128 – LGInstallService - Deletion of arbitrary files with system privilege
https://notcve.org/view.php?id=CVE-2023-44128
27 Sep 2023 — he vulnerability is to delete arbitrary files in LGInstallService ("com.lge.lginstallservies") app. The app contains the exported "com.lge.lginstallservies.InstallService" service that exposes an AIDL interface. All its "installPackage*" methods are finally calling the "installPackageVerify()" method that performs signature validation after the delete file method. An attacker can control conditions so this security check is never performed and an attacker-controlled file is deleted. La vulnerabilidad consis... • https://lgsecurity.lge.com/bulletins/mobile#updateDetails • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2021-26277 – Security Advisory | PendingIntent hijacking vulnerability in Framework Services
https://notcve.org/view.php?id=CVE-2021-26277
17 Feb 2023 — The framework service handles pendingIntent incorrectly, allowing a malicious application with certain privileges to perform privileged actions. • https://www.vivo.com/en/support/security-advisory-detail?id=8 • CWE-94: Improper Control of Generation of Code ('Code Injection') •