CVSS: 6.2EPSS: 0%CPEs: 3EXPL: 0CVE-2021-43849 – DoS vulnerability
https://notcve.org/view.php?id=CVE-2021-43849
cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app to crash. This vulnerability occurred because the activity didn't handle the case where it is requested with invalid or empty data which results in a crash. Any third party app can constantly call this activity with no permission. A 3rd party app/attacker using event listener can continually stop the app from working and make the victim unable to open it. • https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/commit/27434a240f97f69fd930088654590c8ba43569df https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/releases/tag/v5.0.1 https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/security/advisories/GHSA-7vfx-hfvm-rhr8 • CWE-617: Reachable Assertion •
CVSS: 2.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-25335
https://notcve.org/view.php?id=CVE-2021-25335
Improper lockscreen status check in cocktailbar service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows unauthenticated users to access hidden notification contents over the lockscreen in specific condition. Una comprobación inapropiada del estado de la pantalla de bloqueo en el servicio cocktailbar en dispositivos móviles Samsung anteriores a SMR Mar-2021 Release 1, permite a los usuarios no autenticados acceder a los contenidos de notificación ocultos por medio de la pantalla de bloqueo en condiciones específicas • https://security.samsungmobile.com https://security.samsungmobile.com/securityUpdate.smsb • CWE-703: Improper Check or Handling of Exceptional Conditions •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2016-6684
https://notcve.org/view.php?id=CVE-2016-6684
The kernel in Android before 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, and Android One devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30148243. El kernel en Android en versiones anteriores a 2016-10-05 en dispositivos Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player y Android One permite a atacantes obtener información sensible a través de una aplicación manipulada, vulnerabilidad también conocida como error interno 30148243. • http://source.android.com/security/bulletin/2016-10-01.html http://www.securityfocus.com/bid/93326 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2016-2492
https://notcve.org/view.php?id=CVE-2016-2492
The MediaTek power-management driver in Android before 2016-06-01 on Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 28085410. El controlador power-management MediaTek en Android en versiones anteriores a 2016-06-01 en dispositivos Android One permite a atacantes obtener privilegios a través de una aplicación manipulada, también conocido como error interno 28085410. • http://source.android.com/security/bulletin/2016-06-01.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.0EPSS: 0%CPEs: 2EXPL: 0CVE-2016-2456
https://notcve.org/view.php?id=CVE-2016-2456
The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 27275187. El controlador MediaTek Wi-Fi en Android en versiones anteriores a 2016-05-01 sobre dispositivos Android One permite a atacantes obtener privilegios a través de una aplicación manipulada, también conocido como error interno 27275187. • http://source.android.com/security/bulletin/2016-05-01.html • CWE-264: Permissions, Privileges, and Access Controls •