CVE-2021-26280

HighCVSS 7.9/10Last modified Jun 17, 2026

Description

Locally installed application can bypass the permission check and perform system operations that require permission.

Metrics

CVSS 3.1 7.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:H

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
vivoPermission manager moduleVersions earlier than Android 10

References

Timeline

Published
Dec 17, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2021

CVE-2021-262815.5Some parameters of the alarm clock module are improperly stored, leaking some sensitive information.CVE-2021-262919.1Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, rCVE-2021-262939.8An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversaCVE-2021-262947.5An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (suchCVE-2021-262959.8Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over CVE-2021-262967.5In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use crCVE-2021-263036.1PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field.CVE-2021-263045.4PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the add-expense.php Item parameter.CVE-2021-263059.8An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain accesCVE-2021-263067.5An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It has unsound transmute calls within as_string() methods.CVE-2021-263075.5An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It allows __cpuid_count() calls even if the processor does not supportCVE-2021-263087.5An issue was discovered in the marc crate before 2.0.0 for Rust. A user-provided Read implementation can gain access to the old contents of
CVE-2021-26280: High severity, CVSS 7.9 | Vulnix