CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-48397
https://notcve.org/view.php?id=CVE-2023-48397
08 Dec 2023 — In Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with System execution privileges needed. User interaction is not needed for exploitation. En Init de protocolcalladapter.cpp, existe una posible lectura fuera de los límites debido a una verificación de los límites faltantes. Esto podría conducir a la divulgación remota de información con privilegios de ejecución de Syistem necesarios. • https://source.android.com/security/bulletin/pixel/2023-12-01 • CWE-125: Out-of-bounds Read •
CVSS: 6.3EPSS: 31%CPEs: 28EXPL: 8CVE-2023-45866 – bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution
https://notcve.org/view.php?id=CVE-2023-45866
07 Dec 2023 — Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue. Bluetooth HID Hosts in BlueZ ... • https://github.com/pentestfunctions/BlueDucky • CWE-285: Improper Authorization CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 0%CPEs: 12EXPL: 0CVE-2023-42579
https://notcve.org/view.php?id=CVE-2023-42579
05 Dec 2023 — Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13 allows adjacent attackers to access keystroke data using Man-in-the-Middle attack. Uso inadecuado de un protocolo inseguro (es decir, HTTP) en SogouSDK of Chinese Samsung Keyboard anterior a las versiones 5.3.70.1 en Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 en Android 12 y 5.6.00.52,... • https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-45781
https://notcve.org/view.php?id=CVE-2023-45781
04 Dec 2023 — In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. En parse_gap_data de utils.cc, hay una posible lectura fuera de los límites debido a una verificación de los límites faltantes. Esto podría dar lugar a la divulgación de información local con privilegios de ejecución del usuario necesarios. • https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a218e5be5e4049eae3b321f2a535a128d65d00b6 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-45779
https://notcve.org/view.php?id=CVE-2023-45779
04 Dec 2023 — In the APEX module framework of AOSP, there is a possible malicious update to platform components due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. More details on this can be found in the referenced links. En TBD de TBD, existe una posible actualización maliciosa de los componentes de la plataforma debido a un uso incorrecto de las criptomonedas. • https://github.com/metaredteam/rtx-cve-2023-45779 •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-45777
https://notcve.org/view.php?id=CVE-2023-45777
04 Dec 2023 — In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privileges due to Parcel Mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En checkKeyIntentParceledCorrectly de AccountManagerService.java, existe una forma posible de iniciar actividades arbitrarias utilizando privilegios del sistema debido a una falta de coincidencia d... • https://github.com/michalbednarski/TheLastBundleMismatch •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45776
https://notcve.org/view.php?id=CVE-2023-45776
04 Dec 2023 — In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En CreateAudioBroadcast de broadcaster.cc, hay una posible escritura fuera de los límites debido a una verificación de los límites faltante. Esto podría conducir a una escalada local de privilegios sin necesidad de permisos de ejecución adicionales. • https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8e3b3fc918b3ea77754c6d82ab0f09cce81e145b • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45775
https://notcve.org/view.php?id=CVE-2023-45775
04 Dec 2023 — In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En CreateAudioBroadcast de broadcaster.cc, hay una posible escritura fuera de los límites debido a una verificación de los límites faltante. Esto podría conducir a una escalada local de privilegios sin necesidad de permisos de ejecución adicionales. • https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8e3b3fc918b3ea77754c6d82ab0f09cce81e145b • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-45774
https://notcve.org/view.php?id=CVE-2023-45774
04 Dec 2023 — In fixUpIncomingShortcutInfo of ShortcutService.java, there is a possible way to view another user's image due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En fixUpIncomingShortcutInfo de ShortcutService.java, existe una manera posible de ver la imagen de otro usuario debido a un diputado confundido. Esto podría conducir a una escalada local de privilegios sin necesidad de permisos de e... • https://android.googlesource.com/platform/frameworks/base/+/f229f0e55b07416badaca0e3493db5af0943c9eb •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-45773
https://notcve.org/view.php?id=CVE-2023-45773
04 Dec 2023 — In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. En múltiples funciones de btm_ble_gap.cc, existe una posible escritura fuera de los límites debido a una verificación de los límites faltante. Esto podría conducir a una escalada local de privilegios con privilegios de ejecución del usuario necesarios. • https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7b30443dac7bb9138275c909549110191bcbcae9 • CWE-787: Out-of-bounds Write •