CVE-2019-1994

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In refresh of DevelopmentTiles.java, there is the possibility of leaving development settings accessible due to an insecure default value. This could lead to unwanted access to development settings, with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-117770924.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1188

Affected software

Vendor	Product	Versions
Android	Android	Android-8.0 Android-8.1 Android-9

References

http://www.securityfocus.com/bid/106946Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2019-02-01Vendor Advisory
http://www.securityfocus.com/bid/106946Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2019-02-01Vendor Advisory

Timeline

Published: Feb 28, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-199407.2Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in Swisscom Centro Grande before 6.16.12 allows remote authenticat CVE-2019-199415.4Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows a remote attacker to inject its local IP address as a domain ent CVE-2019-199427.5Missing output sanitation in Swisscom Centro Grande Centro Grande before 6.16.12, Centro Business 1.0 (ADB) before 7.10.18, and Centro Busin CVE-2019-199437.5The HTTP service in quickweb.exe in Pablo Quick 'n Easy Web Server 3.3.8 allows Remote Unauthenticated Heap Memory Corruption via a large ho CVE-2019-199446.5In libIEC61850 1.4.0, BerDecoder_decodeUint32 in mms/asn1/ber_decode.c has an out-of-bounds read, related to intLen and bufPos.CVE-2019-199457.5uhttpd in OpenWrt through 18.06.5 and 19.x through 19.07.0-rc2 has an integer signedness error. This leads to out-of-bounds access to a heap CVE-2019-199466.5The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if this user is not part of the project team.CVE-2019-199474.6In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb CVE-2019-199489.8In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c.CVE-2019-199499.1In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_wri CVE-2019-19955.5In ComposeActivityEmail of ComposeActivityEmail.java, there is a possible way to silently attach files to an email due to a confused deputy.CVE-2019-199509.8In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-after-free in ThrowException and ThrowLoggedException of magick/error.c.