CVSS: 9.7EPSS: 0%CPEs: 4EXPL: 0CVE-2018-9470
https://notcve.org/view.php?id=CVE-2018-9470
20 Nov 2024 — In bff_Scanner_addOutPos of Scanner.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege in an unprivileged app with no additional execution privileges needed. User interaction is needed for exploitation. • https://source.android.com/security/bulletin/2018-09-01 • CWE-787: Out-of-bounds Write •
CVSS: 8.4EPSS: 0%CPEs: 3EXPL: 0CVE-2018-9469
https://notcve.org/view.php?id=CVE-2018-9469
20 Nov 2024 — In multiple functions of ShortcutService.java, there is a possible creation of a spoofed shortcut due to a missing permission check. This could lead to local escalation of privilege in a privileged app with no additional execution privileges needed. User interaction is needed for exploitation. En varias funciones de ShortcutService.java, existe la posibilidad de crear un acceso directo falsificado debido a la falta de verificación de permisos. Esto podría provocar una escalada local de privilegios en una ap... • https://source.android.com/security/bulletin/2018-09-01 • CWE-787: Out-of-bounds Write •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 1CVE-2018-9468
https://notcve.org/view.php?id=CVE-2018-9468
20 Nov 2024 — In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass. This could lead to local information disclosure and file rewriting with no additional execution privileges needed. User interaction is not needed for exploitation. En la consulta de DownloadManager.java, existe una posible lectura/escritura de archivos arbitrarios debido a una omisión de permisos. Esto podría provocar la divulgación de información local y la reescritura de archivos sin necesidad ... • https://github.com/IOActive/AOSP-DownloadProviderHijacker •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-10382 – Arbitrary Code execution in Car App Android Jetpack Library
https://notcve.org/view.php?id=CVE-2024-10382
20 Nov 2024 — There exists a code execution vulnerability in the Car App Android Jetpack Library. In the CarAppService desrialization logic is used that allows for arbitrary java classes to be constructed. In combination with other gadgets, this can lead to arbitrary code execution. An attacker needs to have an app on a victims Android device that uses the CarAppService Class and the victim would need to install a malicious app alongside it. We recommend upgrading the library past version 1.7.0-beta02 Existe una vulnerab... • https://developer.android.com/jetpack/androidx/releases/car-app#1.7.0-beta03 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-9467
https://notcve.org/view.php?id=CVE-2018-9467
19 Nov 2024 — In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect security decisions with no additional execution privileges needed. User interaction is not needed for exploitation. • https://source.android.com/security/bulletin/2018-09-01 • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2018-9466
https://notcve.org/view.php?id=CVE-2018-9466
19 Nov 2024 — In the xmlSnprintfElementContent function of valid.c, there is a possible out of bounds write. This could lead to remote escalation of privilege in an unprivileged app with no additional execution privileges needed. User interaction is needed for exploitation. • https://source.android.com/security/bulletin/2018-09-01 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2018-9456
https://notcve.org/view.php?id=CVE-2018-9456
19 Nov 2024 — In sdpu_extract_attr_seq of sdp_utils.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. • https://source.android.com/security/bulletin/2018-09-01 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-9440
https://notcve.org/view.php?id=CVE-2018-9440
19 Nov 2024 — In parse of M3UParser.cpp there is a possible resource exhaustion due to improper input validation. This could lead to denial of service with no additional execution privileges needed. User interaction is needed for exploitation. • https://source.android.com/security/bulletin/2018-09-01 •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2018-9433
https://notcve.org/view.php?id=CVE-2018-9433
19 Nov 2024 — In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. • https://source.android.com/security/bulletin/2018-07-01 • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2018-9432
https://notcve.org/view.php?id=CVE-2018-9432
19 Nov 2024 — In createPhonebookDialogView and createMapDialogView of BluetoothPermissionActivity.java, there is a possible permissions bypass. This could lead to local escalation of privilege due to hiding and bypassing the user's ability to disable access to contacts, with no additional execution privileges needed. User interaction is needed for exploitation. • https://source.android.com/security/bulletin/2018-07-01 • CWE-276: Incorrect Default Permissions •