CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-31325
https://notcve.org/view.php?id=CVE-2024-31325
09 Jul 2024 — In multiple locations, there is a possible way to reveal images across users data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En varias ubicaciones, existe una forma posible de revelar imágenes entre los datos de los usuarios debido a un error lógico en el código. Esto podría conducir a una escalada local de privilegios sin necesidad de permisos de ejecución adicionales. • https://android.googlesource.com/platform/frameworks/base/+/9fcd2070f22c0c6b30ecdc914cef83b5891d5f68 • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-31324
https://notcve.org/view.php?id=CVE-2024-31324
09 Jul 2024 — In hide of WindowState.java, there is a possible way to bypass tapjacking/overlay protection by launching the activity in portrait mode first and then rotating it to landscape mode. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. En hide de WindowState.java, existe una forma posible de omitir la protección contra secuestro/superposición iniciando la actividad en modo vertical primero y luego rotándola al modo horizontal. Es... • https://android.googlesource.com/platform/frameworks/base/+/f16cc1135b414906164eb8fc55a76971b0e36c21 •
CVSS: 6.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-31322
https://notcve.org/view.php?id=CVE-2024-31322
09 Jul 2024 — In updateServicesLocked of AccessibilityManagerService.java, there is a possible way for an app to be hidden from the Setting while retaining Accessibility Service due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. En updateServicesLocked de AccessibilityManagerService.java, existe una forma posible de ocultar una aplicación de la Configuración mientras se conserva el Servicio de Acce... • https://android.googlesource.com/platform/frameworks/base/+/c1bc907a649addd5b97d489fd39afb956164a46c • CWE-269: Improper Privilege Management •
CVSS: 8.4EPSS: 0%CPEs: 4EXPL: 2CVE-2024-31319
https://notcve.org/view.php?id=CVE-2024-31319
09 Jul 2024 — In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En updateNotificationChannelFromPrivilegedListener de NotificationManagerService.java, existe una posible fuga de datos entre usuarios debido a un diputado confundido. Esto podría conducir a una escalada local de... • https://github.com/23Nero/fix-02-failure-CVE-2024-31319-CVE-2024-0039 • CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-31318
https://notcve.org/view.php?id=CVE-2024-31318
09 Jul 2024 — In CompanionDeviceManagerService.java, there is a possible way to pair a companion device without user acceptance due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En CompanionDeviceManagerService.java, existe una forma posible de emparejar un dispositivo complementario sin la aceptación del usuario debido a que falta una verificación de permiso. Esto podría conducir a una escal... • https://android.googlesource.com/platform/frameworks/base/+/b68b257d56a8600d53b4d2d06fb82aa44086a4a5 • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2024-31317
https://notcve.org/view.php?id=CVE-2024-31317
09 Jul 2024 — In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SECURE_SETTINGS due to unsafe deserialization. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. En múltiples funciones de ZygoteProcess.java, existe una manera posible de lograr la ejecución de código como cualquier aplicación a través de WRITE_SECURE_SETTINGS debido a una deserialización insegura. Esto pod... • https://github.com/fuhei/CVE-2024-31317 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-31316
https://notcve.org/view.php?id=CVE-2024-31316
09 Jul 2024 — In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En onResult de AccountManagerService.java, existe una forma posible de realizar un inicio de actividad en segundo plano arbitrario debido a una falta de coincidencia de paquetes. Esto podría conducir a una escalada local de ... • https://android.googlesource.com/platform/frameworks/base/+/3457d82f8e265ad615b38f6a2aa3c33f1e100cb9 •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-31315
https://notcve.org/view.php?id=CVE-2024-31315
09 Jul 2024 — In multiple functions of ManagedServices.java, there is a possible way to hide an app with notification access in the Device & app notifications settings due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. En múltiples funciones de ManagedServices.java, existe una forma posible de ocultar una aplicación con acceso a notificaciones en la configuración de notificaciones de dispositivos y... • https://android.googlesource.com/platform/frameworks/base/+/a9ee2793068235ff423d08cc0964870c054d1983 •
CVSS: 6.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-31314
https://notcve.org/view.php?id=CVE-2024-31314
09 Jul 2024 — In multiple functions of ShortcutService.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. En múltiples funciones de ShortcutService.java, existe una posible DOS persistente debido al agotamiento de recursos. Esto podría provocar una denegación de servicio local sin necesidad de privilegios de ejecución adicionales. • https://android.googlesource.com/platform/frameworks/base/+/c0d5f75e01308fb7d6d86639a0a6e2ff81b30be6 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-31313
https://notcve.org/view.php?id=CVE-2024-31313
09 Jul 2024 — In availableToWriteBytes of MessageQueueBase.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En availableToWriteBytes de MessageQueueBase.h, existe una posible escritura fuera de los límites debido a una verificación de límites incorrecta. Esto podría conducir a una escalada local de privilegios sin necesidad de permisos de ejecución a... • https://android.googlesource.com/platform/system/libfmq/+/79bbf4aeef4b254c52da670a972e22956c8c659d • CWE-269: Improper Privilege Management •