Android
by Google
CVEs (8,504)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-26417 | Med | 0.26 | 4.0 | 0.00 | Aug 26, 2025 | In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction… | ||
| CVE-2025-22413 | Med | 0.26 | 4.0 | 0.00 | Aug 26, 2025 | In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||
| CVE-2025-0083 | Med | 0.26 | 4.0 | 0.00 | Aug 26, 2025 | In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||
| CVE-2025-20980 | Med | 0.26 | 4.0 | 0.00 | May 7, 2025 | Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to cause memory corruption. | ||
| CVE-2024-32923 | Med | 0.26 | 4.0 | 0.00 | Jun 13, 2024 | there is a possible cellular denial of service due to a logic error in the code. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||
| CVE-2024-20065 | Med | 0.26 | 4.0 | 0.00 | Jun 3, 2024 | In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08698617; Issue ID: MSV-1394. | ||
| CVE-2023-20838 | Med | 0.26 | 4.0 | 0.00 | Sep 4, 2023 | In imgsys, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326455; Issue ID: ALPS07326418. | ||
| CVE-2022-39914 | Med | 0.26 | 4.0 | 0.00 | Dec 8, 2022 | Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows local attacker to access connected DLNA device information. | ||
| CVE-2022-39905 | Med | 0.26 | 4.0 | 0.00 | Dec 8, 2022 | Implicit intent hijacking vulnerability in Telecom application prior to SMR Dec-2022 Release 1 allows attacker to access sensitive information via implicit intent. | ||
| CVE-2022-39903 | Med | 0.26 | 4.0 | 0.00 | Dec 8, 2022 | Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number. | ||
| CVE-2022-39898 | Med | 0.26 | 4.0 | 0.00 | Dec 8, 2022 | Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some information of usim. | ||
| CVE-2022-39896 | Med | 0.26 | 4.0 | 0.00 | Dec 8, 2022 | Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent. | ||
| CVE-2022-39895 | Med | 0.26 | 4.0 | 0.00 | Dec 8, 2022 | Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access contact group information via implicit intent. | ||
| CVE-2022-39894 | Med | 0.26 | 4.0 | 0.00 | Dec 8, 2022 | Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent. | ||
| CVE-2022-39883 | Med | 0.26 | 4.0 | 0.00 | Nov 9, 2022 | Improper authorization vulnerability in StorageManagerService prior to SMR Nov-2022 Release 1 allows local attacker to call privileged API. | ||
| CVE-2022-39856 | Med | 0.26 | 4.0 | 0.00 | Oct 7, 2022 | Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers to access call information. | ||
| CVE-2022-39851 | Med | 0.26 | 4.0 | 0.00 | Oct 7, 2022 | Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bind service that require BIND_REMOTEVIEWS permission. | ||
| CVE-2022-39848 | Med | 0.26 | 4.0 | 0.00 | Oct 7, 2022 | Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log. | ||
| CVE-2022-36856 | Med | 0.26 | 4.0 | 0.00 | Sep 9, 2022 | Improper access control vulnerability in Telecom application prior to SMR Sep-2022 Release 1 allows attacker to start emergency calls via undefined permission. | ||
| CVE-2022-36854 | Med | 0.26 | 4.0 | 0.00 | Sep 9, 2022 | Out of bound read in libapexjni.media.samsung.so prior to SMR Sep-2022 Release 1 allows attacker access unauthorized information. |
- risk 0.26cvss 4.0epss 0.00
In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction…
- risk 0.26cvss 4.0epss 0.00
In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- risk 0.26cvss 4.0epss 0.00
In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- risk 0.26cvss 4.0epss 0.00
Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to cause memory corruption.
- risk 0.26cvss 4.0epss 0.00
there is a possible cellular denial of service due to a logic error in the code. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- risk 0.26cvss 4.0epss 0.00
In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08698617; Issue ID: MSV-1394.
- risk 0.26cvss 4.0epss 0.00
In imgsys, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326455; Issue ID: ALPS07326418.
- risk 0.26cvss 4.0epss 0.00
Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows local attacker to access connected DLNA device information.
- risk 0.26cvss 4.0epss 0.00
Implicit intent hijacking vulnerability in Telecom application prior to SMR Dec-2022 Release 1 allows attacker to access sensitive information via implicit intent.
- risk 0.26cvss 4.0epss 0.00
Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number.
- risk 0.26cvss 4.0epss 0.00
Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some information of usim.
- risk 0.26cvss 4.0epss 0.00
Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent.
- risk 0.26cvss 4.0epss 0.00
Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access contact group information via implicit intent.
- risk 0.26cvss 4.0epss 0.00
Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent.
- risk 0.26cvss 4.0epss 0.00
Improper authorization vulnerability in StorageManagerService prior to SMR Nov-2022 Release 1 allows local attacker to call privileged API.
- risk 0.26cvss 4.0epss 0.00
Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers to access call information.
- risk 0.26cvss 4.0epss 0.00
Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bind service that require BIND_REMOTEVIEWS permission.
- risk 0.26cvss 4.0epss 0.00
Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log.
- risk 0.26cvss 4.0epss 0.00
Improper access control vulnerability in Telecom application prior to SMR Sep-2022 Release 1 allows attacker to start emergency calls via undefined permission.
- risk 0.26cvss 4.0epss 0.00
Out of bound read in libapexjni.media.samsung.so prior to SMR Sep-2022 Release 1 allows attacker access unauthorized information.
Page 402 of 426