CVE Vulnerability Catalog

In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote escalation of privilege with no additional execution privileges needed.

In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed.

In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.

In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed.

In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.

In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

The pppoe_wrapper vendor daemon from the Amlogic Android SDK on Nexbox A95X TV boxes contains a command injection vulnerability. A local attacker can send a crafted message to the world-writable AF_UNIX socket /dev/socket/pppoe_wrapper, which is passed unfiltered to system(3) and executed as root.

Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations referencing local files, but the check did not cover http_headers.<name>.files and basic_auth.username_file. A tenant allowed to write the Alertmanager configuration could point these fields at any file readable by the process, and its contents were placed in a header of an outgoing request sent to an attacker-controlled server.

In psqlODBC, for an updatable cursor over a table without OIDs that has an auto-increment int4 column, the driver uses that column to identify rows, placing its server-reported name in double quotes without doubling any double quote in the name. A column name containing a double quote therefore changes the SQL executed, including which rows a positioned UPDATE or DELETE affects.

Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative, a negative SQL_DESC_COUNT unbinds columns at negative indexes, and SQLSetPos(SQL_ADD) does not check the row number against the rowset size.

SQLSpecialColumns in psqlODBC splices the received table and schema names into its catalog query without escaping them, while other catalog functions escape them. An application passing an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the connection's privileges.

The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without bounds checking and without initialization. An escape with too many arguments overflows the stack, a reference to an unsupplied argument copies arbitrary bytes into the query, and copying a {d}, {t}, {ts}, or {escape} body writes one byte past a 128-byte stack buffer.

psqlODBC sizes its row cache from the column count of a cursor's first result but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation; a keyset reply with fewer columns than the key fields underflows the unsigned field count. This is reachable with UseDeclareFetch enabled.

psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it.

Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains hard-coded credentials that can be extracted by decompiling bundled Flutter configuration assets such as production.json. The recovered credentials allow authentication to the production MQTT broker over TCP 1883, access to topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publishing messages to those topics.