2022

In valid_va_secbuf_check of drm_access_control.c, there is a possible ID due to improper input validation. This could le

In sysmmu_map of sysmmu.c, there is a possible EoP due to a precondition check failure. This could lead to local escalat

In ppmp_unprotect_mfcfw_buf of drm_fw.c, there is a possible out of bounds write due to improper input validation. This

In the Pixel camera driver, there is a possible use after free due to a logic error in the code. This could lead to loca

In ufdt_do_one_fixup of ufdt_overlay.c, there is a possible out of bounds write due to an incorrect bounds check. This c

In RadioImpl::setCdmaBroadcastConfig of ril_service_legacy.cpp, there is a possible stack clash leading to memory corrup

In RadioImpl::setGsmBroadcastConfig of ril_service_legacy.cpp, there is a possible stack clash leading to memory corrupt

In OemSimAuthRequest::encode of wlandata.cpp, there is a possible out of bounds write due to a missing bounds check. Thi

In externalOnRequest of rilapplication.cpp, there is a possible out of bounds write due to a missing bounds check. This

In read_ppmpu_info of drm_fw.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead

In sec_sysmmu_info of drm_fw.c, there is a possible out of bounds read due to improper input validation. This could lead

In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission ch

In extract_metadata of dm-android-verity.c, there is a possible way to corrupt kernel memory due to a use after free. Th

Product: AndroidVersions: Android kernelAndroid ID: A-230660904References: N/A

In thermal_cooling_device_stats_update of thermal_sysfs.c, there is a possible out of bounds write due to improper input

In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local e

In _ufdt_output_strtab_to_fdt of ufdt_convert.c, there is a possible out of bounds write due to an incorrect bounds chec

In TBD of ufdt_convert, there is a possible out of bounds read due to memory corruption. This could lead to local escala

In MessageQueueBase of MessageQueueBase.h, there is a possible out of bounds read due to a missing bounds check. This co

In ufdt_get_node_by_path_len of ufdt_convert.c, there is a possible out of bounds read due to a missing bounds check. Th

In removeEventHubDevice of InputDevice.cpp, there is a possible OOB read due to a use after free. This could lead to loc

In onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check due to a tapjacking/ov

In btif_a2dp_sink_command_ready of btif_a2dp_sink.cc, there is a possible out of bounds read due to a use after free. Th

In authToken2AidlVec of KeyMintUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This

In getCurrentConfigImpl of Effect.cpp, there is a possible out of bounds write due to a missing bounds check. This could

In onOptionsItemSelected of ManageApplications.java, there is a possible bypass of profile owner restrictions due to a m

In phNxpNciHal_ioctl of phNxpNciHal.cc, there is a possible out of bounds read due to a missing bounds check. This could

In parameterToHal of Effect.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead

In getSmsRoleHolder of RoleService.java, there is a possible way to determine whether an app is installed, without query

In Telecom, there is a possible way to determine whether an app is installed, without query permissions, due to side cha

In strings.xml, there is a possible permission bypass due to a misleading string. This could lead to remote information

In HalCoreCallback of halcore.cc, there is a possible out of bounds read due to a missing bounds check. This could lead

In IncFs_GetFilledRangesStartingFrom of incfs.cpp, there is a possible out of bounds read due to a missing bounds check.

In sdpu_find_most_specific_service_uuid of sdp_utils.cc, there is a possible way to crash Bluetooth due to a missing nul

In query of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead t

In getMessagesByPhoneNumber of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection

In onPreferenceClick of AccountTypePreferenceLoader.java, there is a possible way to retrieve protected files from the S

In acquireFabricatedOverlayIterator, nextFabricatedOverlayInfos, and releaseFabricatedOverlayIterator of Idmap2Service.c

In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to a missing bounds check. This could lea

In getNearbyAppStreamingPolicy of DevicePolicyManagerService.java, there is a missing permission check. This could lead

In getNearbyNotificationStreamingPolicy of DevicePolicyManagerService.java, there is a possible way to learn about the n

In mapGrantorDescr of MessageQueueBase.h, there is a possible out of bounds write due to a missing bounds check. This co

In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. This could lea

In multiple locations of DreamManagerService.java, there is a missing permission check. This could lead to local escalat

In multiple locations of NfcService.java, there is a possible disclosure of NFC tags due to a confused deputy. This coul

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deacti

In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administra

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin

BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans

The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to