CVE-2023-42747

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In camera service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Dec 4, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-427487.8In telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executCVE-2023-427495.5In enginnermode service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lCVE-2023-427504.4In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with SystCVE-2023-427514.4In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with SystCVE-2023-427525.5An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which CVE-2023-427537.8An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of CVE-2023-427545.5A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a deviceCVE-2023-427555.5A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear CVE-2023-427564.7A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kerCVE-2023-427574.2Process Explorer before 17.04 allows attackers to make it functionally unavailable (a denial of service for analysis) by renaming an executaCVE-2023-42768.8The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to CVE-2023-427655.4An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the