Vulnerabilidades em Google Inc.

960 resultados
Análise Vexday

Com 960 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o perfil de exploração ativa do Google Inc. está abaixo da média geral do catálogo, o que sugere menor pressão imediata de ataques em curso. Apesar da ausência de severidades críticas e de novas vulnerabilidades nos últimos 90 dias, há 16 CVEs com prova de conceito pública disponível, o que representa um vetor de risco concreto para equipes que ainda não aplicaram as correções correspondentes. A falha mais recorrente é CWE-269 (gerenciamento inadequado de privilégios), padrão que tipicamente favorece escalonamento de privilégios e movimentação lateral em ambientes comprometidos. A CVE mais perigosa atualmente rastreada é CVE-2017-0561, com EPSS de 0,30, indicando probabilidade não negligenciável de exploração e justificando atenção prioritária mesmo tratando-se de uma vulnerabilidade mais antiga.

CVE-2016-8459—Possible buffer overflow in storage subsystem. Bad parameters as part of listener responses to RPMB commands could lead to buffer overflow. EPSS 1.7%CVE-2016-8439—Possible buffer overflow in trust zone access control API. Buffer overflow may occur due to lack of buffer size checking. Product: Android. EPSS 1.7%CVE-2016-8430—An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code withinEPSS 1.7%CVE-2018-9359—In process_l2cap_cmd of l2c_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informaEPSS 1.7%CVE-2016-10283—An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code wiEPSS 1.7%CVE-2018-9361—In process_l2cap_cmd of l2c_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informaEPSS 1.7%CVE-2017-0637—A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corrEPSS 1.7%CVE-2018-9358—In gatts_process_attribute_req of gatt_sc.cc, there is a possible read of uninitialized data due to a missing bounds check. This could lead EPSS 1.7%CVE-2018-9436—In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informatioEPSS 1.7%CVE-2016-8405—An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could EPSS 1.7%CVE-2017-0641—A remote denial of service vulnerability in libvpx in Mediaserver could enable an attacker to use a specially crafted file to cause a deviceEPSS 1.7%CVE-2017-13282—In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible stack buffer overflow due to a missing bounds check. This could lead toEPSS 1.7%CVE-2018-9459—In Attachment of Attachment.java and getFilePath of EmlAttachmentProvider.java, there is a possible Elevation of Privilege due to a path traEPSS 1.7%CVE-2017-0455—An information disclosure vulnerability in the Qualcomm bootloader could help to enable a local malicious application to to execute arbitrarEPSS 1.7%CVE-2018-9448—In avct_bcb_msg_ind of avct_bcb_act.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote infoEPSS 1.7%CVE-2018-9498—In SkSampler::Fill of SkSampler.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execEPSS 1.6%CVE-2017-0403—An elevation of privilege vulnerability in the kernel performance subsystem could enable a local malicious application to execute arbitrary EPSS 1.6%CVE-2017-0810—A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, EPSS 1.6%CVE-2017-0811—A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7EPSS 1.6%CVE-2017-0404—An elevation of privilege vulnerability in the kernel sound subsystem could enable a local malicious application to execute arbitrary code wEPSS 1.6%