CVE-2024-1608

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-280

Affected software

Vendor	Product	Versions
OPPO	Usercenter Credit sdk	/
oppo	usercenter_credit_sdk	—

References

https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1759867611954552832Vendor Advisory
https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1759867611954552832Vendor Advisory

Timeline

Published: Feb 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-16098.7In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.CVE-2024-16109.8In OPPO Store APP, there's a possible escalation of privilege due to improper input validation.CVE-2024-16187.8A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This CVE-2024-16198.8Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially f CVE-2024-16217.5The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email lo CVE-2024-16227.5Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening CVE-2024-16237.8Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker CVE-2024-16249.4An OS Command Injection vulnerability affecting documentation server on 3DEXPERIENCE from Release 3DEXPERIENCE R2022x through Release 3DEXPE CVE-2024-16256.5An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized del CVE-2024-16268.1An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary repository, version 0.3.0, within the project update CVE-2024-16288.4OS command injection vulnerabilities in GE HealthCare ultrasound devices CVE-2024-16296.2Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component