CVE-2019-2092

In isSeparateProfileChallengeAllowed of DevicePolicyManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege, with no additional permissions required. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-128599668.

• CWE-862

• https://source.android.com/security/bulletin/2019-06-01Vendor Advisory
• https://source.android.com/security/bulletin/2019-06-01Vendor Advisory

Published

Jun 7, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-20914An issue was discovered in GNU LibreDWG through 0.9.3. There…9.8
• CVE-2019-20915An issue was discovered in GNU LibreDWG through 0.9.3. Craft…8.1
• CVE-2019-20916The pip package before 19.2 for Python allows Directory Trav…7.5
• CVE-2019-20917An issue was discovered in InspIRCd 2 before 2.0.28 and 3 be…6.5
• CVE-2019-20918An issue was discovered in InspIRCd 3 before 3.1.0. The sile…6.5
• CVE-2019-20919An issue was discovered in the DBI module before 1.643 for P…4.7
• CVE-2019-20920Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable t…8.1
• CVE-2019-20921bootstrap-select before 1.13.6 allows Cross-Site Scripting (…6.1
• CVE-2019-20922Handlebars before 4.4.5 allows Regular Expression Denial of …7.5
• CVE-2019-20923A user authorized to perform database queries may trigger de…6.5
• CVE-2019-20924A user authorized to perform database queries may trigger de…6.5
• CVE-2019-20925An unauthenticated client can trigger denial of service by i…7.5