CVE-2021-31815

GAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to obtain sensitive information, such as a user's location history, in-person social graph, and (sometimes) COVID-19 infection status, because Rolling Proximity Identifiers and MAC addresses are written to the Android system log, and many Android devices have applications (preinstalled by the hardware manufacturer or network operator) that read system log data and send it to third parties. NOTE: a news outlet (The Markup) states that they received a vendor response indicating that fix deployment "began several weeks ago and will be complete in the coming days."

• CWE-319

• https://blog.appcensus.io/2021/04/27/why-google-should-stop-logging-contact-tracing-data/Exploit, Third Party Advisory
• https://themarkup.org/privacy/2021/04/27/google-promised-its-contact-tracing-app-was-completely-private-but-it-wasntExploit, Press/Media Coverage, Third Party Advisory
• https://blog.appcensus.io/2021/04/27/why-google-should-stop-logging-contact-tracing-data/Exploit, Third Party Advisory
• https://themarkup.org/privacy/2021/04/27/google-promised-its-contact-tracing-app-was-completely-private-but-it-wasntExploit, Press/Media Coverage, Third Party Advisory

Published

Apr 28, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3181rfc822.c in Mutt through 2.0.4 allows remote attackers to ca…6.5
• CVE-2021-31810An issue was discovered in Ruby through 2.6.7, 2.7.x through…5.8
• CVE-2021-31811In Apache PDFBox, a carefully crafted PDF file can trigger a…5.5
• CVE-2021-31812In Apache PDFBox, a carefully crafted PDF file can trigger a…5.5
• CVE-2021-31813Zoho ManageEngine Applications Manager before 15130 is vulne…5.4
• CVE-2021-31814In Stormshield 1.1.0, and 2.1.0 through 2.9.0, an attacker c…6.1
• CVE-2021-31816When configuring Octopus Server if it is configured with an …7.5
• CVE-2021-31817When configuring Octopus Server if it is configured with an …7.5
• CVE-2021-31818Affected versions of Octopus Server are prone to an authenti…4.3
• CVE-2021-31819In Halibut versions prior to 4.4.7 there is a deserialisatio…9.8
• CVE-2021-3182D-Link DCS-5220 devices have a buffer overflow. NOTE: This v…8
• CVE-2021-31820In Octopus Server after version 2018.8.2 if the Octopus Serv…7.5