1559 results (0.010 seconds)

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

There exists a code execution vulnerability in the Car App Android Jetpack Library. In the CarAppService desrialization logic is used that allows for arbitrary java classes to be constructed. In combination with other gadgets, this can lead to arbitrary code execution. An attacker needs to have an app on a victims Android device that uses the CarAppService Class and the victim would need to install a malicious app alongside it. We recommend upgrading the library past version 1.7.0-beta02 Existe una vulnerabilidad de ejecución de código en Car App Android Jetpack Library. • https://developer.android.com/jetpack/androidx/releases/car-app#1.7.0-beta03 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-502: Deserialization of Untrusted Data •

CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0

In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. • https://source.android.com/security/bulletin/2018-07-01 • CWE-116: Improper Encoding or Escaping of Output •

CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0

In createPhonebookDialogView and createMapDialogView of BluetoothPermissionActivity.java, there is a possible permissions bypass. This could lead to local escalation of privilege due to hiding and bypassing the user's ability to disable access to contacts, with no additional execution privileges needed. User interaction is needed for exploitation. • https://source.android.com/security/bulletin/2018-07-01 • CWE-276: Incorrect Default Permissions •

CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0

In writeInplace of Parcel.cpp, there is a possible information leak across processes, using Binder, due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. • https://source.android.com/security/bulletin/2018-07-01 • CWE-908: Use of Uninitialized Resource •

CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0

In BnCameraService::onTransact of CameraService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. • https://source.android.com/security/bulletin/2018-07-01 • CWE-908: Use of Uninitialized Resource •