‼ CVE-2021-0984 ‼
📖 Read
via "National Vulnerability Database".
In onNullBinding of ManagedServices.java, there is a possible permission bypass due to an incorrectly unbound service. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-192475653📖 Read
via "National Vulnerability Database".
‼ CVE-2021-1003 ‼
📖 Read
via "National Vulnerability Database".
In adjustStreamVolume of AudioService.java, there is a possible way for unprivileged app to change audio stream volume due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-189857506📖 Read
via "National Vulnerability Database".
‼ CVE-2021-0956 ‼
📖 Read
via "National Vulnerability Database".
In NfcTag::discoverTechnologies (activation) of NfcTag.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additionalSystem execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-189942532📖 Read
via "National Vulnerability Database".
‼ CVE-2021-0918 ‼
📖 Read
via "National Vulnerability Database".
In gatt_process_notification of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197536150📖 Read
via "National Vulnerability Database".
‼ CVE-2021-0955 ‼
📖 Read
via "National Vulnerability Database".
In pf_write_buf of FuseDaemon.cpp, there is possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-192085766📖 Read
via "National Vulnerability Database".
‼ CVE-2021-1043 ‼
📖 Read
via "National Vulnerability Database".
In TBD of TBD, there is a possible downgrade attack due to under utilized anti-rollback protections. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194697257References: N/A📖 Read
via "National Vulnerability Database".
‼ CVE-2021-0927 ‼
📖 Read
via "National Vulnerability Database".
In requestChannelBrowsable of TvInputManagerService.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-8.1 Android-9Android ID: A-189824175📖 Read
via "National Vulnerability Database".
‼ CVE-2021-0986 ‼
📖 Read
via "National Vulnerability Database".
In hasGrantedPolicy of DevicePolicyManagerService.java, there is a possible information disclosure about the device owner, profile owner, or device admin due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-192247339📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39657 ‼
📖 Read
via "National Vulnerability Database".
In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194696049References: Upstream kernel📖 Read
via "National Vulnerability Database".
‼ CVE-2021-1027 ‼
📖 Read
via "National Vulnerability Database".
In setTransactionState of SurfaceFlinger, there is possible arbitrary code execution in a privileged process due to improper casting. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-193033243📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45078 ‼
📖 Read
via "National Vulnerability Database".
stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-0926 ‼
📖 Read
via "National Vulnerability Database".
In onCreate of NfcImportVCardActivity.java, there is a possible way to add a contact without user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-191053931📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39655 ‼
📖 Read
via "National Vulnerability Database".
Product: AndroidVersions: Android kernelAndroid ID: A-192641593References: N/A📖 Read
via "National Vulnerability Database".
‼ CVE-2021-1012 ‼
📖 Read
via "National Vulnerability Database".
In onResume of NotificationAccessDetails.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195412179📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39648 ‼
📖 Read
via "National Vulnerability Database".
In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-160822094References: Upstream kernel📖 Read
via "National Vulnerability Database".
‼ CVE-2021-0976 ‼
📖 Read
via "National Vulnerability Database".
In toBARK of floor0.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-199680600📖 Read
via "National Vulnerability Database".
‼ CVE-2021-1015 ‼
📖 Read
via "National Vulnerability Database".
In getMeidForSlot of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-186530496📖 Read
via "National Vulnerability Database".
❌ Relentless Log4j Attacks Include State Actors, Possible Worm ❌
📖 Read
via "Threat Post".
More than 1.8 million attacks, against half of all corporate networks, have already launched to exploit Log4Shell.📖 Read
via "Threat Post".
Threat Post
Relentless Log4j Attacks Include State Actors, Possible Worm
More than 1.8 million attacks, against half of all corporate networks, have already launched to exploit Log4Shell.
🕴 Original Fix for Log4j Flaw Fails to Fully Protect Against DoS Attacks, Data Theft 🕴
📖 Read
via "Dark Reading".
Organizations should upgrade ASAP to new version of logging framework released Tuesday by the Apache Foundation, security experts say.📖 Read
via "Dark Reading".
Dark Reading
Original Fix for Log4j Flaw Fails to Fully Protect Against DoS Attacks, Data Theft
Organizations should upgrade ASAP to new version of logging framework released Tuesday by the Apache Foundation, security experts say.
🕴 Companies Must Assess Threats to AI & ML Systems in 2022: Microsoft 🕴
📖 Read
via "Dark Reading".
Most companies lack the proper tools to assess their vulnerability to threats facing their AI systems and ML pipelines, prompting Microsoft to release a risk assessment framework.📖 Read
via "Dark Reading".
Darkreading
Companies Must Assess Threats to AI & ML Systems in 2022: Microsoft
Most companies lack the proper tools to assess their vulnerability to threats facing their AI systems and ML pipelines, prompting Microsoft to release a risk assessment framework.
‼ CVE-2021-45085 ‼
📖 Read
via "National Vulnerability Database".
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that page on the Most Visited list.📖 Read
via "National Vulnerability Database".