Archive
February 2023
Vulnerabilities first published in this month (UTC), newest first.
2,189 results · Feed
-
Medium 5.4
Improper access control vulnerability in NfcTile prior to SMR Jan-2023 Release 1 allows to attacker to use NFC without …
-
High 7.4
Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 in Android Q(10), 3.…
-
Medium 6.2CVE-2023-21434 EPSS 13%
Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute Jav…
-
High 8.5
Improper input validation vulnerability in UwbDataTxStatusEvent prior to SMR Feb-2023 Release 1 allows attackers to lau…
-
Medium 5.7
Path traversal vulnerability in Samsung Cloud prior to version 5.3.0.32 allows attacker to access specific png file.
-
Medium 4.0
Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows local attackers to ac…
-
Medium 6.7
A Stack-based overflow vulnerability in IpcRxEmbmsSessionList in SECRIL prior to Android S(12) allows attacker to cause…
-
Low 3.3
Improper input validation in Bixby Vision prior to version 3.7.70.17 allows attacker to access data of Bixby Vision.
-
Medium 4.3
An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container re…
-
Low 2.1
Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected b…
-
Medium 4.3
Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access carde…
-
Medium 4.4
An out-of-bound read vulnerability in mapToBuffer function in libSDKRecognitionText.spensdk.samsung.so library prior to…
-
High 7.3
Use of Externally-Controlled Format String vulnerabilities in STST TA prior to SMR Jan-2023 Release 1 allows arbitrary …
-
Medium 4.2
Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without aut…
-
Medium 4.0
Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID.
-
Low 2.3
Missing Authorization vulnerability in One Hand Operation + prior to version 6.1.21 allows multi-users to access owner&…
-
Medium 5.5
Improper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R(11), 13.1.03.501 in Android S(1…
-
Medium 6.2
Improper input validation in MyFiles prior to version 12.2.09 in Android R(11), 13.1.03.501 in Android S( 12) and 14.1.…
-
High 7.8
Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install appli…
-
Medium 4.0
Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Pr…
-
Low 3.3
Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID.
-
High 7.5
Improper cryptographic implementation in Samsung Flow for Android prior to version 4.9.04 allows adjacent attackers to …
-
Medium 5.7
Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attack…
-
Medium 5.1
Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 R…
-
Medium 4.0
Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access inf…
-
Medium 4.0
Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.…
-
Low —
ReDoS based DoS vulnerability in Active Support's underscore
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process …
-
High 8.8
SQL Injection Vulnerability via ActiveRecord comments
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which auto…
-
Medium 6.1
Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect inter…
-
Unscored —
In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.
-
Low —
ReDoS based DoS vulnerability in GlobalID
A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade …
-
High 7.5
ReDoS based DoS vulnerability in Action Dispatch
A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastroph…
-
Medium 6.1
Open Redirect Vulnerability in Action Pack
An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the che…
-
Low —
ReDoS based DoS vulnerability in Action Dispatch
A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, whe…
-
High 7.5
The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affec…
-
High 7.5
The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this …
-
High 7.5
The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability …
-
High 7.5
The geofencing kernel code has a vulnerability of not verifying the length of the input data. Successful exploitation o…
-
High 7.5
The geofencing kernel code does not verify the length of the input data. Successful exploitation of this vulnerability …
-
Critical 9.1
The phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this vulnerability may a…