Export limit exceeded: 87159 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (87159 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-14998 | 1 Leagoo | 2 P1, P1 Firmware | 2024-11-21 | N/A |
| The Leagoo P1 Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a hidden root privilege escalation capability to achieve command execution as the root user. They have made modifications that allow a user with physical access to the device to obtain a root shell via ADB by modifying read-only system properties at runtime. Specifically, modifying the ro.debuggable and the ro.secure system properties to a certain value and then restarting the ADB daemon allows for a root shell to be obtained via ADB. | ||||
| CVE-2018-14987 | 1 Mxq Project | 2 Mxq Tv Box, Mxq Tv Box Firmware | 2024-11-21 | N/A |
| The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201_N/m201_N:4.4.2/KOT49H/20160106:user/test-keys contains the Android framework with a package name of android (versionCode=19, versionName=4.4.2-20170213) that dynamically registers a broadcast receiver app component named com.android.server.MasterClearReceiver instead of statically registering it in the AndroidManifest.xml file of the core Android package, as done in Android Open Source Project (AOSP) code for Android 4.4.2. The dynamic-registration of the MasterClearReceiver broadcast receiver app component is not protected with the android.permission.MASTER_CLEAR permission during registration, so any app co-located on the device, even those without any permissions, can programmatically initiate a factory reset of the device. A factory reset will remove all user data and apps from the device. This will result in the loss of any data that have not been backed up or synced externally. The capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves with the exception of enabled Mobile Device Management (MDM) apps), although this capability can be obtained by leveraging an unprotected app component of core Android process. | ||||
| CVE-2018-14982 | 2 Google, Lg | 15 Android, G5, G6 and 12 more | 2024-11-21 | N/A |
| Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is LVE-SMP-180004. | ||||
| CVE-2018-14981 | 2 Google, Lg | 15 Android, G5, G6 and 12 more | 2024-11-21 | N/A |
| Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. The LG ID is LVE-SMP-180005. | ||||
| CVE-2018-14980 | 1 Asus | 2 Zenfone 3 Max, Zenfone 3 Max Firmware | 2024-11-21 | N/A |
| The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains the android framework (i.e., system_server) with a package name of android (versionCode=24, versionName=7.0) that has been modified by ASUS or another entity in the supply chain. The system_server process in the core android package has an exported broadcast receiver that allows any app co-located on the device to programmatically initiate the taking of a screenshot and have the resulting screenshot be written to external storage (i.e., sdcard). The taking of a screenshot is not transparent to the user; the device has a screen animation as the screenshot is taken and there is a notification indicating that a screenshot occurred. If the attacking app also requests the EXPAND_STATUS_BAR permission, it can wake the device up using certain techniques and expand the status bar to take a screenshot of the user's notifications even if the device has an active screen lock. The notifications may contain sensitive data such as text messages used in two-factor authentication. The system_server process that provides this capability cannot be disabled, as it is part of the Android framework. The notification can be removed by a local Denial of Service (DoS) attack to reboot the device. | ||||
| CVE-2018-14977 | 1 Q-cms | 1 Qcms | 2024-11-21 | N/A |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS, as demonstrated by the name parameter, a different vulnerability than CVE-2018-8070. | ||||
| CVE-2018-14976 | 1 Q-cms | 1 Qcms | 2024-11-21 | N/A |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS. | ||||
| CVE-2018-14975 | 1 Q-cms | 1 Qcms | 2024-11-21 | N/A |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/album.php has XSS. | ||||
| CVE-2018-14974 | 1 Q-cms | 1 Qcms | 2024-11-21 | N/A |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/news.php has XSS. | ||||
| CVE-2018-14973 | 1 Q-cms | 1 Qcms | 2024-11-21 | N/A |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS. | ||||
| CVE-2018-14972 | 1 Q-cms | 1 Qcms | 2024-11-21 | N/A |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS. | ||||
| CVE-2018-14971 | 1 Q-cms | 1 Qcms | 2024-11-21 | N/A |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS. | ||||
| CVE-2018-14970 | 1 Q-cms | 1 Qcms | 2024-11-21 | N/A |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/slideshow.php has XSS. | ||||
| CVE-2018-14969 | 1 Q-cms | 1 Qcms | 2024-11-21 | N/A |
| An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/system.php has XSS. | ||||
| CVE-2018-14964 | 1 Emlsoft Project | 1 Emlsoft | 2024-11-21 | N/A |
| An issue was discovered in EMLsoft 5.4.5. XSS exists via the eml/upload/eml/?action=address&do=edit page. | ||||
| CVE-2018-14962 | 1 Zzcms | 1 Zzcms | 2024-11-21 | N/A |
| zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php. | ||||
| CVE-2018-14955 | 1 Squirrelmail | 1 Squirrelmail | 2024-11-21 | N/A |
| The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute). | ||||
| CVE-2018-14954 | 1 Squirrelmail | 1 Squirrelmail | 2024-11-21 | N/A |
| The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute. | ||||
| CVE-2018-14953 | 1 Squirrelmail | 1 Squirrelmail | 2024-11-21 | N/A |
| The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack. | ||||
| CVE-2018-14952 | 1 Squirrelmail | 1 Squirrelmail | 2024-11-21 | N/A |
| The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack. | ||||