2023 CVEs (page 124)
Page 124 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-21390 | High | 7.8 | 2023-10-30 | In Sim, there is a possible way to evade mobile preference restrictions due to a permission bypass. This could lead to local escalation of privilege with no ad… |
CVE-2023-21389 | High | 7.8 | 2023-10-30 | In Settings, there is a possible bypass of profile owner restrictions due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2023-21388 | High | 7.8 | 2023-10-30 | In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional exec… |
CVE-2023-21387 | Medium | 4.4 | 2023-10-30 | In User Backup Manager, there is a possible way to leak a token to bypass user confirmation for backup due to log information disclosure. This could lead to lo… |
CVE-2023-21385 | Medium | 5.5 | 2023-10-30 | In Whitechapel, there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution p… |
CVE-2023-21384 | Medium | 5.5 | 2023-10-30 | In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User e… |
CVE-2023-21383 | Medium | 5.5 | 2023-10-30 | In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt. This could lead to local information disclosure… |
CVE-2023-21382 | Medium | 5.5 | 2023-10-30 | In Content Resolver, there is a possible method to access metadata about existing content providers on the device due to a missing permission check. This could… |
CVE-2023-21381 | High | 7.8 | 2023-10-30 | In Media Resource Manager, there is a possible local arbitrary code execution due to use after free. This could lead to local escalation of privilege with no a… |
CVE-2023-21380 | Medium | 6.7 | 2023-10-30 | In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution pri… |
CVE-2023-21379 | Medium | 4.4 | 2023-10-30 | In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server wit… |
CVE-2023-21378 | High | 7.8 | 2023-10-30 | In Telecomm, there is a possible way to silence the ring for calls of secondary users due to a missing permission check. This could lead to local escalation of… |
CVE-2023-21377 | Medium | 5.5 | 2023-10-30 | In SELinux Policy, there is a possible restriction bypass due to a permissions bypass. This could lead to local information disclosure with no additional execu… |
CVE-2023-21376 | Medium | 5.5 | 2023-10-30 | In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code. This could lead to local information disclosure with no additiona… |
CVE-2023-21375 | High | 7.8 | 2023-10-30 | In Sysproxy, there is a possible out of bounds write due to an integer underflow. This could lead to local escalation of privilege with no additional execution… |
CVE-2023-21374 | High | 7.8 | 2023-10-30 | In System UI, there is a possible factory reset protection bypass due to a logic error in the code. This could lead to local escalation of privilege with no ad… |
CVE-2023-21373 | High | 7.8 | 2023-10-30 | In Telephony, there is a possible way for a guest user to change the preferred SIM due to a missing permission check. This could lead to local escalation of pr… |
CVE-2023-21372 | High | 7.8 | 2023-10-30 | In libdexfile, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execut… |
CVE-2023-47090 | Medium | 6.5 | 2023-10-30 | NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for u… |
CVE-2023-36920 | Medium | 6.1 | 2023-10-30 | In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not i… |
CVE-2023-21371 | Medium | 6.7 | 2023-10-30 | In Secure Element, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution p… |
CVE-2023-21370 | Medium | 6.7 | 2023-10-30 | In the Security Element API, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System e… |
CVE-2023-21369 | Medium | 5.5 | 2023-10-30 | In Usage Access, there is a possible way to display a Settings usage access restriction toggle screen due to a permissions bypass. This could lead to local den… |
CVE-2023-21368 | Medium | 5.5 | 2023-10-30 | In Audio, there is a possible out of bounds read due to missing bounds check. This could lead to local information disclosure with no additional execution priv… |
CVE-2023-21367 | Medium | 5.5 | 2023-10-30 | In Scudo, there is a possible way to exploit certain heap OOB read/write issues due to an insecure implementation/design. This could lead to local information… |
CVE-2023-21366 | Medium | 5.5 | 2023-10-30 | In Scudo, there is a possible way for an attacker to predict heap allocation patterns due to insecure implementation/design. This could lead to local informati… |
CVE-2023-21365 | Medium | 5.5 | 2023-10-30 | In Contacts, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service in the Phone app with User execution privile… |
CVE-2023-21364 | Medium | 5.5 | 2023-10-30 | In ContactsProvider, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with Use… |
CVE-2023-21362 | Medium | 5.5 | 2023-10-30 | In Usage, there is a possible permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges need… |
CVE-2023-21361 | High | 8.8 | 2023-10-30 | In Bluetooth, there is a possibility of code-execution due to a use after free. This could lead to paired device escalation of privilege in the privileged Blue… |
CVE-2023-21360 | Medium | 6.7 | 2023-10-30 | In Bluetooth, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution… |
CVE-2023-21359 | Medium | 4.4 | 2023-10-30 | In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server wit… |
CVE-2023-21358 | High | 7.8 | 2023-10-30 | In UWB Google, there is a possible way for a malicious app to masquerade as system app com.android.uwb.resources due to improperly used crypto. This could lead… |
CVE-2023-21357 | Medium | 4.4 | 2023-10-30 | In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-21356 | High | 8.8 | 2023-10-30 | In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no addit… |
CVE-2023-21355 | High | 7.8 | 2023-10-30 | In libaudioclient, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional executi… |
CVE-2023-21354 | Medium | 5.5 | 2023-10-30 | In Package Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclo… |
CVE-2023-21353 | High | 7.5 | 2023-10-30 | In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution pri… |
CVE-2023-21352 | Medium | 5.5 | 2023-10-30 | In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution priv… |
CVE-2023-21351 | High | 7.8 | 2023-10-30 | In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with n… |
CVE-2023-21350 | Medium | 5.5 | 2023-10-30 | In Media Projection, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2023-21349 | Low | 3.3 | 2023-10-30 | In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21348 | Low | 3.3 | 2023-10-30 | In Window Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2023-21347 | High | 7.5 | 2023-10-30 | In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional executi… |
CVE-2023-21346 | Low | 3.3 | 2023-10-30 | In the Device Idle Controller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information dis… |
CVE-2023-21345 | Low | 3.3 | 2023-10-30 | In Game Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosur… |
CVE-2023-21344 | Medium | 5.5 | 2023-10-30 | In Job Scheduler, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21343 | High | 7.8 | 2023-10-30 | In ActivityStarter, there is a possible background activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no add… |
CVE-2023-21342 | High | 7.8 | 2023-10-30 | In RemoteSpeechRecognitionService of RemoteSpeechRecognitionService.java, there is a possible way to launch an activity from the background due to a logic erro… |
CVE-2023-21341 | High | 7.8 | 2023-10-30 | In Permission Manager, there is a possible way to bypass required permissions due to a missing permission check. This could lead to local escalation of privile… |
CVE-2023-21340 | Medium | 5.5 | 2023-10-30 | In Telecomm, there is a possible way to get the call state due to a missing permission check. This could lead to local information disclosure with no additiona… |
CVE-2023-21339 | High | 7.5 | 2023-10-30 | In Minikin, there is a possible way to trigger ANR by showing a malicious message due to resource exhaustion. This could lead to remote denial of service with… |
CVE-2023-21338 | Medium | 5.5 | 2023-10-30 | In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21337 | High | 7.8 | 2023-10-30 | In InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This c… |
CVE-2023-21336 | Medium | 5.5 | 2023-10-30 | In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21335 | Medium | 5.5 | 2023-10-30 | In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This coul… |
CVE-2023-21334 | Medium | 5.5 | 2023-10-30 | In App Ops Service, there is a possible disclosure of information about installed packages due to a logic error in the code. This could lead to local informati… |
CVE-2023-21333 | Medium | 5.5 | 2023-10-30 | In Text Services, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21332 | Medium | 5.5 | 2023-10-30 | In Text Services, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21331 | Medium | 5.5 | 2023-10-30 | In InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This c… |
CVE-2023-21330 | Medium | 5.5 | 2023-10-30 | In Overlay Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21329 | Medium | 5.5 | 2023-10-30 | In Activity Manager, there is a possible way to determine whether an app is installed due to a missing permission check. This could lead to local information d… |
CVE-2023-21328 | High | 7.8 | 2023-10-30 | In Package Installer, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This coul… |
CVE-2023-21327 | Medium | 5.5 | 2023-10-30 | In Permission Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2023-21326 | Medium | 5.5 | 2023-10-30 | In Package Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclo… |
CVE-2023-21325 | Medium | 5.5 | 2023-10-30 | In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This coul… |
CVE-2023-21324 | High | 7.8 | 2023-10-30 | In Package Installer, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2023-21323 | Medium | 5.5 | 2023-10-30 | In Activity Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2023-21321 | Medium | 5.5 | 2023-10-30 | In Package Manager, there is a possible cross-user settings disclosure due to a missing permission check. This could lead to local information disclosure with… |
CVE-2023-21320 | Medium | 5.5 | 2023-10-30 | In Device Policy, there is a possible way to verify if a particular admin app is registered on the device due to side channel information disclosure. This coul… |
CVE-2023-21319 | Medium | 5.5 | 2023-10-30 | In UsageStatsService, there is a possible way to read installed 3rd party apps due to side channel information disclosure. This could lead to local information… |
CVE-2023-21318 | Medium | 5.5 | 2023-10-30 | In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could… |
CVE-2023-21317 | Medium | 5.5 | 2023-10-30 | In ContentService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2023-21316 | Medium | 5.5 | 2023-10-30 | In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could… |
CVE-2023-21315 | Medium | 6.5 | 2023-10-30 | In Bluetooth, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote (proximal/adjacent) information disclosure with n… |
CVE-2023-21314 | Medium | 4.4 | 2023-10-30 | In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privi… |
CVE-2023-21313 | High | 7.8 | 2023-10-30 | In Core, there is a possible way to forward calls without user knowledge due to a missing permission check. This could lead to local escalation of privilege wi… |
CVE-2023-21312 | Medium | 5.5 | 2023-10-30 | In IntentResolver, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execu… |
CVE-2023-21311 | Medium | 5.5 | 2023-10-30 | In Settings, there is a possible way to control private DNS settings from a secondary user due to a permissions bypass. This could lead to local information di… |
CVE-2023-21310 | Medium | 6.7 | 2023-10-30 | In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution pri… |
CVE-2023-21309 | Medium | 5.5 | 2023-10-30 | In libcore, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution… |
CVE-2023-21308 | Medium | 5.5 | 2023-10-30 | In Composer, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional executio… |
CVE-2023-21307 | Medium | 5.0 | 2023-10-30 | In Bluetooth, there is a possible way for a paired Bluetooth device to access a long term identifier for an Android device due to a permissions bypass. This co… |
CVE-2023-21306 | Medium | 5.5 | 2023-10-30 | In ContentService, there is a possible way to read installed sync content providers due to side channel information disclosure. This could lead to local inform… |
CVE-2023-21305 | Medium | 5.5 | 2023-10-30 | In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could… |
CVE-2023-21304 | Medium | 5.5 | 2023-10-30 | In Content Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21303 | Medium | 5.5 | 2023-10-30 | In Content, here is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could… |
CVE-2023-21302 | Medium | 5.5 | 2023-10-30 | In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21301 | Medium | 5.5 | 2023-10-30 | In ActivityManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclos… |
CVE-2023-21300 | Medium | 5.5 | 2023-10-30 | In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2023-21299 | Medium | 5.5 | 2023-10-30 | In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21298 | High | 7.8 | 2023-10-30 | In Slice, there is a possible disclosure of installed applications due to side channel information disclosure. This could lead to local escalation of privilege… |
CVE-2023-21297 | Medium | 4.4 | 2023-10-30 | In SEPolicy, there is a possible way to access the factory MAC address due to a permissions bypass. This could lead to local information disclosure with System… |
CVE-2023-21296 | Medium | 5.5 | 2023-10-30 | In Permission, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This co… |
CVE-2023-21295 | Medium | 5.5 | 2023-10-30 | In SliceManagerService, there is a possible way to check if a content provider is installed due to a missing null check. This could lead to local information d… |
CVE-2023-21294 | Medium | 5.5 | 2023-10-30 | In Slice, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure with no addit… |
CVE-2023-21293 | Medium | 5.5 | 2023-10-30 | In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosur… |
CVE-2023-4964 | High | 8.2 | 2023-10-30 | Potential open redirect vulnerability in opentext Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.1… |
CVE-2023-44323 | Medium | 5.5 | 2023-10-30 | Adobe Acrobat for Edge version 118.0.2088.46 (and earlier) is affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulne… |
CVE-2023-5843 | Critical | 9.0 | 2023-10-30 | The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ajax_load_ads' func… |