Samsung
Page 11 of 17 — Samsung CVEs from a corpus of 1634, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-39878 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via implicit intent broadc… |
CVE-2022-39877 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in ProfileSharingAccount in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and be… |
CVE-2022-39876 | Medium | 5.9 | 2022-10-07 | Insertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to access device IMEI. |
CVE-2022-39875 | Medium | 5.1 | 2022-10-07 | Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. |
CVE-2022-39874 | Medium | 4.0 | 2022-10-07 | Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. |
CVE-2022-39873 | Medium | 4.3 | 2022-10-07 | Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret mode without user auth… |
CVE-2022-39872 | Medium | 5.9 | 2022-10-07 | Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device. |
CVE-2022-39871 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39870 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39869 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39868 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implic… |
CVE-2022-39867 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39866 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via… |
CVE-2022-39865 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information vi… |
CVE-2022-39864 | Low | 3.3 | 2022-10-07 | Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via i… |
CVE-2022-39863 | Low | 3.6 | 2022-10-07 | Intent redirection vulnerability in Samsung Account prior to version 13.5.01.3 allows attackers to access content providers without permission. |
CVE-2022-39862 | Medium | 5.3 | 2022-10-07 | Improper authorization in Dynamic Lockscreen prior to SMR Sep-2022 Release 1 in Android R(11) and 3.3.03.66 in Android S(12) allows unauthorized use of javascr… |
CVE-2022-39861 | Medium | 5.9 | 2022-10-07 | Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without camera privilege. |
CVE-2022-39860 | Medium | 4.4 | 2022-10-07 | Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive information via implicit broadcast. |
CVE-2022-39859 | Medium | 4.0 | 2022-10-07 | Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via implicit intent. |
CVE-2022-39858 | High | 7.3 | 2022-10-07 | Path traversal vulnerability in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to write arbitrary file as FactoryCamera privileg… |
CVE-2022-39857 | High | 7.3 | 2022-10-07 | Improper access control vulnerability in CameraTestActivity in FactoryCameraFB prior to version 3.5.51 allows attackers to access broadcasting Intent as system… |
CVE-2022-39854 | Medium | 6.4 | 2022-10-07 | Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory. |
CVE-2022-40279 | High | 7.5 | 2022-09-29 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/src/l2_packet/l2_packet_pcap.c has a miss… |
CVE-2022-40278 | High | 7.5 | 2022-09-29 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sql… |
CVE-2022-40762 | High | 7.5 | 2022-09-16 | A Memory Allocation with Excessive Size Value vulnerablity in the TEE_Realloc function in Samsung mTower through 0.3.0 allows a trusted application to trigger… |
CVE-2022-40761 | High | 7.5 | 2022-09-16 | The function tee_obj_free in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_Alloca… |
CVE-2022-40760 | High | 7.5 | 2022-09-16 | A Buffer Access with Incorrect Length Value vulnerablity in the TEE_MACUpdate function in Samsung mTower through 0.3.0 allows a trusted application to trigger… |
CVE-2022-40759 | High | 7.5 | 2022-09-16 | A NULL pointer dereference issue in the TEE_MACCompareFinal function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Servic… |
CVE-2022-40758 | High | 7.5 | 2022-09-16 | A Buffer Access with Incorrect Length Value vulnerablity in the TEE_CipherUpdate function in Samsung mTower through 0.3.0 allows a trusted application to trigg… |
CVE-2022-40757 | High | 7.5 | 2022-09-16 | A Buffer Access with Incorrect Length Value vulnerablity in the TEE_MACComputeFinal function in Samsung mTower through 0.3.0 allows a trusted application to tr… |
CVE-2022-39846 | Medium | 6.2 | 2022-09-09 | DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.22083_3 allows attacker to execute arbitrary code. |
CVE-2022-39845 | Medium | 5.5 | 2022-09-09 | Improper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attackers to delete arbitrary directory using di… |
CVE-2022-39844 | Medium | 5.5 | 2022-09-09 | Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrary directory using d… |
CVE-2022-36878 | Low | 3.3 | 2022-09-09 | Exposure of Sensitive Information in Find My Mobile prior to version 7.2.25.14 allows local attacker to access IMEI via log. |
CVE-2022-36877 | Low | 2.8 | 2022-09-09 | Exposure of Sensitive Information in FaqSymptomCardViewModel in Samsung Members prior to versions 4.3.00.11 in Global and 14.0.02.4 in China allows local attac… |
CVE-2022-36876 | Low | 1.8 | 2022-09-09 | Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication. |
CVE-2022-36875 | Medium | 6.6 | 2022-09-09 | Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 allows attacker to access the file withou… |
CVE-2022-36874 | Medium | 5.9 | 2022-09-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin prior to 2.2.11.22040751 allows attacker to access device IMEI and Ser… |
CVE-2022-36873 | Medium | 5.9 | 2022-09-09 | Improper restriction of broadcasting Intent in GalaxyStoreBridgePageLinker of?Waterplugin prior to version 2.2.11.22081151 leaks MAC address of the connected B… |
CVE-2022-36872 | Medium | 5.0 | 2022-09-09 | Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files… |
CVE-2022-36871 | Medium | 5.0 | 2022-09-09 | Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files… |
CVE-2022-36870 | Medium | 5.0 | 2022-09-09 | Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to… |
CVE-2022-36869 | Medium | 6.6 | 2022-09-09 | Improper access control vulnerability in ContactsDumpActivity of?Contacts Provider prior to version 12.7.59 allows attacker to access the file without permissi… |
CVE-2022-36867 | Medium | 5.9 | 2022-09-09 | Improper access control vulnerability in Editor Lite prior to version 4.0.40.14 allows attackers to access sensitive information. |
CVE-2022-36866 | Medium | 4.0 | 2022-09-09 | Improper access control vulnerability in Broadcaster in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows… |
CVE-2022-36865 | Medium | 4.0 | 2022-09-09 | Improper access control in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows attackers to access device i… |
CVE-2022-36864 | Medium | 4.0 | 2022-09-09 | Improper access control and intent redirection in Samsung Email prior to 6.1.70.20 allows attacker to access specific formatted file and execute privileged beh… |
CVE-2022-36859 | Medium | 5.7 | 2022-09-09 | Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victim's devices. |
CVE-2022-36857 | Low | 1.9 | 2022-09-09 | Improper Authorization vulnerability in Photo Editor prior to SMR Sep-2022 Release 1 allows physical attackers to read internal application data. |
CVE-2022-36851 | Low | 3.9 | 2022-09-09 | Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data of Samsung pass on a certain state of a… |
CVE-2022-40281 | High | 7.5 | 2022-09-08 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). cyassl_connect_step2 in curl/vtls/cyassl.c has a missing X509_free after SSL_get_peer… |
CVE-2022-40280 | High | 7.5 | 2022-09-08 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sql… |
CVE-2022-39830 | High | 7.5 | 2022-09-05 | sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_public_key_affine_coordinates, leading to a denial of servic… |
CVE-2022-39829 | High | 7.5 | 2022-09-05 | There is a NULL pointer dereference in aes256_encrypt in Samsung mTower through 0.3.0 due to a missing check on the return value of EVP_CIPHER_CTX_new. |
CVE-2022-39828 | High | 7.5 | 2022-09-05 | sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_private_key, leading to a denial of service. |
CVE-2022-36622 | High | 7.5 | 2022-09-01 | Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_GetObjectInfo1. |
CVE-2022-36621 | High | 7.5 | 2022-09-01 | Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_AllocateTransientObject. |
CVE-2022-38155 | High | 7.5 | 2022-08-11 | TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted application to achieve Excessive Memory Allocation via a large len value, as demonstrated by a Numa… |
CVE-2022-36840 | Medium | 4.5 | 2022-08-05 | DLL hijacking vulnerability in Samsung Update Setup prior to version 2.2.9.50 allows attackers to execute arbitrary code. |
CVE-2022-36839 | Medium | 5.9 | 2022-08-05 | SQL injection vulnerability via IAPService in Samsung Checkout prior to version 5.0.53.1 allows attackers to access IAP information. |
CVE-2022-36838 | Medium | 4.0 | 2022-08-05 | Implicit Intent hijacking vulnerability in Galaxy Wearable prior to version 2.2.50 allows attacker to get sensitive information. |
CVE-2022-36837 | Medium | 6.2 | 2022-08-05 | Intent redirection vulnerability using implicit intent in Samsung email prior to version 6.1.70.20 allows attacker to get sensitive information. |
CVE-2022-36836 | Medium | 6.2 | 2022-08-05 | Unprotected provider vulnerability in Charm by Samsung prior to version 1.2.3 allows attackers to read connection state without permission. |
CVE-2022-36835 | Low | 3.3 | 2022-08-05 | Implicit Intent hijacking vulnerability in Samsung Internet Browser prior to version 17.0.7.34 allows attackers to access arbitrary files. |
CVE-2022-36834 | Low | 3.3 | 2022-08-05 | Exposure of Sensitive Information vulnerability in Game Launcher prior to version 6.0.07 allows local attacker to access app data with user interaction. |
CVE-2022-36833 | High | 7.3 | 2022-08-05 | Improper Privilege Management vulnerability in Game Optimizing Service prior to versions 3.3.04.0 in Android 10, and 3.5.04.8 in Android 11 and above allows lo… |
CVE-2022-36832 | Medium | 4.0 | 2022-08-05 | Improper access control vulnerability in WebApp in Cameralyzer prior to versions 3.2.22, 3.3.22, 3.4.22 and 3.5.51 allows attackers to access external storage… |
CVE-2022-36831 | Medium | 6.2 | 2022-08-05 | Path traversal vulnerability in UriFileUtils of Samsung Notes prior to version 4.3.14.39 allows attacker to access some file as Samsung Notes permission. |
CVE-2022-36830 | Medium | 6.2 | 2022-08-05 | PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permissio… |
CVE-2022-36829 | Medium | 6.2 | 2022-08-05 | PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permission via… |
CVE-2022-33734 | Medium | 6.2 | 2022-08-05 | Sensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection information wi… |
CVE-2022-33733 | Medium | 6.2 | 2022-08-05 | Sensitive information exposure in onCharacteristicRead in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection information witho… |
CVE-2022-35858 | High | 7.8 | 2022-08-04 | The TEE_PopulateTransientObject and __utee_from_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overwrite, denial of ser… |
CVE-2022-33713 | High | 7.5 | 2022-07-12 | Implicit Intent hijacking vulnerability in Samsung Cloud prior to version 5.2.0 allows attacker to get sensitive information. |
CVE-2022-33712 | Medium | 5.3 | 2022-07-12 | Intent redirection vulnerability using implict intent in Camera prior to versions 12.0.01.64 ,12.0.3.23, 12.0.0.98, 12.0.6.11, 12.0.3.19 in Android S(12) allow… |
CVE-2022-33711 | Medium | 5.5 | 2022-07-12 | Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allows local attackers… |
CVE-2022-33710 | High | 7.8 | 2022-07-12 | Improper input validation vulnerability in BillingPackageInsraller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Gal… |
CVE-2022-33709 | High | 7.8 | 2022-07-12 | Improper input validation vulnerability in ApexPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy… |
CVE-2022-33708 | High | 7.8 | 2022-07-12 | Improper input validation vulnerability in AppsPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy… |
CVE-2022-33707 | Medium | 5.3 | 2022-07-12 | Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device. |
CVE-2022-33706 | Low | 2.4 | 2022-07-12 | Improper access control vulnerability in Samsung Gallery prior to version 13.1.05.8 allows physical attackers to access the pictures using S Pen air gesture. |
CVE-2022-33705 | Low | 3.3 | 2022-07-12 | Information exposure in Calendar prior to version 12.3.05.10000 allows attacker to access calendar schedule without READ_CALENDAR permission. |
CVE-2022-33691 | Medium | 6.2 | 2022-07-12 | A possible race condition vulnerability in score driver prior to SMR Jul-2022 Release 1 can allow local attackers to interleave malicious operations. |
CVE-2022-30749 | Low | 3.3 | 2022-06-07 | Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity. |
CVE-2022-30748 | Medium | 4.0 | 2022-06-07 | Unprotected dynamic receiver in Samsung Members prior to version 4.2.005 allows attacker to launch arbitrary activity. |
CVE-2022-30747 | Medium | 5.5 | 2022-06-07 | PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent. |
CVE-2022-30746 | High | 7.5 | 2022-06-07 | Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API. |
CVE-2022-30745 | Medium | 4.0 | 2022-06-07 | Improper access control vulnerability in Quick Share prior to version 13.1.2.4 allows attacker to access internal files in Quick Share. |
CVE-2022-30744 | Medium | 6.2 | 2022-06-07 | DLL hijacking vulnerability in KiesWrapper in Samsung Kies prior to version 2.6.4.22043_1 allows attacker to execute arbitrary code. |
CVE-2022-30743 | Medium | 5.3 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission. |
CVE-2022-30742 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get… |
CVE-2022-30741 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to… |
CVE-2022-30740 | Medium | 4.1 | 2022-06-07 | Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers. |
CVE-2022-30739 | Medium | 4.0 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get an user email or phone number with a normal level per… |
CVE-2022-30738 | Medium | 4.3 | 2022-06-07 | Improper check in Loader in Samsung Internet prior to 17.0.1.69 allows attackers to spoof address bar via executing script. |
CVE-2022-30737 | Medium | 4.0 | 2022-06-07 | Implicit Intent hijacking vulnerability in Samsung Account prior to version 13.2.00.6 allows attackers to get email ID. |
CVE-2022-30736 | Medium | 5.3 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission. |
CVE-2022-30735 | Medium | 5.9 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_token without permission. |
CVE-2022-30734 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without perm… |