Samsung
Page 12 of 18 — Samsung CVEs from a corpus of 1709, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40762 | High | 7.5 | 2022-09-16 | A Memory Allocation with Excessive Size Value vulnerablity in the TEE_Realloc function in Samsung mTower through 0.3.0 allows a trusted application to trigger… |
CVE-2022-40761 | High | 7.5 | 2022-09-16 | The function tee_obj_free in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_Alloca… |
CVE-2022-40760 | High | 7.5 | 2022-09-16 | A Buffer Access with Incorrect Length Value vulnerablity in the TEE_MACUpdate function in Samsung mTower through 0.3.0 allows a trusted application to trigger… |
CVE-2022-40759 | High | 7.5 | 2022-09-16 | A NULL pointer dereference issue in the TEE_MACCompareFinal function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Servic… |
CVE-2022-40758 | High | 7.5 | 2022-09-16 | A Buffer Access with Incorrect Length Value vulnerablity in the TEE_CipherUpdate function in Samsung mTower through 0.3.0 allows a trusted application to trigg… |
CVE-2022-40757 | High | 7.5 | 2022-09-16 | A Buffer Access with Incorrect Length Value vulnerablity in the TEE_MACComputeFinal function in Samsung mTower through 0.3.0 allows a trusted application to tr… |
CVE-2022-39846 | Medium | 6.2 | 2022-09-09 | DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.22083_3 allows attacker to execute arbitrary code. |
CVE-2022-39845 | Medium | 5.5 | 2022-09-09 | Improper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attackers to delete arbitrary directory using di… |
CVE-2022-39844 | Medium | 5.5 | 2022-09-09 | Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrary directory using d… |
CVE-2022-36878 | Low | 3.3 | 2022-09-09 | Exposure of Sensitive Information in Find My Mobile prior to version 7.2.25.14 allows local attacker to access IMEI via log. |
CVE-2022-36877 | Low | 2.8 | 2022-09-09 | Exposure of Sensitive Information in FaqSymptomCardViewModel in Samsung Members prior to versions 4.3.00.11 in Global and 14.0.02.4 in China allows local attac… |
CVE-2022-36876 | Low | 1.8 | 2022-09-09 | Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication. |
CVE-2022-36875 | Medium | 6.6 | 2022-09-09 | Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 allows attacker to access the file withou… |
CVE-2022-36874 | Medium | 5.9 | 2022-09-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin prior to 2.2.11.22040751 allows attacker to access device IMEI and Ser… |
CVE-2022-36873 | Medium | 5.9 | 2022-09-09 | Improper restriction of broadcasting Intent in GalaxyStoreBridgePageLinker of?Waterplugin prior to version 2.2.11.22081151 leaks MAC address of the connected B… |
CVE-2022-36872 | Medium | 5.0 | 2022-09-09 | Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files… |
CVE-2022-36871 | Medium | 5.0 | 2022-09-09 | Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files… |
CVE-2022-36870 | Medium | 5.0 | 2022-09-09 | Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to… |
CVE-2022-36869 | Medium | 6.6 | 2022-09-09 | Improper access control vulnerability in ContactsDumpActivity of?Contacts Provider prior to version 12.7.59 allows attacker to access the file without permissi… |
CVE-2022-36867 | Medium | 5.9 | 2022-09-09 | Improper access control vulnerability in Editor Lite prior to version 4.0.40.14 allows attackers to access sensitive information. |
CVE-2022-36866 | Medium | 4.0 | 2022-09-09 | Improper access control vulnerability in Broadcaster in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows… |
CVE-2022-36865 | Medium | 4.0 | 2022-09-09 | Improper access control in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows attackers to access device i… |
CVE-2022-36864 | Medium | 4.0 | 2022-09-09 | Improper access control and intent redirection in Samsung Email prior to 6.1.70.20 allows attacker to access specific formatted file and execute privileged beh… |
CVE-2022-36859 | Medium | 5.7 | 2022-09-09 | Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victim's devices. |
CVE-2022-36857 | Low | 1.9 | 2022-09-09 | Improper Authorization vulnerability in Photo Editor prior to SMR Sep-2022 Release 1 allows physical attackers to read internal application data. |
CVE-2022-36851 | Low | 3.9 | 2022-09-09 | Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data of Samsung pass on a certain state of a… |
CVE-2022-40281 | High | 7.5 | 2022-09-08 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). cyassl_connect_step2 in curl/vtls/cyassl.c has a missing X509_free after SSL_get_peer… |
CVE-2022-40280 | High | 7.5 | 2022-09-08 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sql… |
CVE-2022-39830 | High | 7.5 | 2022-09-05 | sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_public_key_affine_coordinates, leading to a denial of servic… |
CVE-2022-39829 | High | 7.5 | 2022-09-05 | There is a NULL pointer dereference in aes256_encrypt in Samsung mTower through 0.3.0 due to a missing check on the return value of EVP_CIPHER_CTX_new. |
CVE-2022-39828 | High | 7.5 | 2022-09-05 | sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_private_key, leading to a denial of service. |
CVE-2022-36622 | High | 7.5 | 2022-09-01 | Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_GetObjectInfo1. |
CVE-2022-36621 | High | 7.5 | 2022-09-01 | Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_AllocateTransientObject. |
CVE-2022-38155 | High | 7.5 | 2022-08-11 | TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted application to achieve Excessive Memory Allocation via a large len value, as demonstrated by a Numa… |
CVE-2022-36840 | Medium | 4.5 | 2022-08-05 | DLL hijacking vulnerability in Samsung Update Setup prior to version 2.2.9.50 allows attackers to execute arbitrary code. |
CVE-2022-36839 | Medium | 5.9 | 2022-08-05 | SQL injection vulnerability via IAPService in Samsung Checkout prior to version 5.0.53.1 allows attackers to access IAP information. |
CVE-2022-36838 | Medium | 4.0 | 2022-08-05 | Implicit Intent hijacking vulnerability in Galaxy Wearable prior to version 2.2.50 allows attacker to get sensitive information. |
CVE-2022-36837 | Medium | 6.2 | 2022-08-05 | Intent redirection vulnerability using implicit intent in Samsung email prior to version 6.1.70.20 allows attacker to get sensitive information. |
CVE-2022-36836 | Medium | 6.2 | 2022-08-05 | Unprotected provider vulnerability in Charm by Samsung prior to version 1.2.3 allows attackers to read connection state without permission. |
CVE-2022-36835 | Low | 3.3 | 2022-08-05 | Implicit Intent hijacking vulnerability in Samsung Internet Browser prior to version 17.0.7.34 allows attackers to access arbitrary files. |
CVE-2022-36834 | Low | 3.3 | 2022-08-05 | Exposure of Sensitive Information vulnerability in Game Launcher prior to version 6.0.07 allows local attacker to access app data with user interaction. |
CVE-2022-36833 | High | 7.3 | 2022-08-05 | Improper Privilege Management vulnerability in Game Optimizing Service prior to versions 3.3.04.0 in Android 10, and 3.5.04.8 in Android 11 and above allows lo… |
CVE-2022-36832 | Medium | 4.0 | 2022-08-05 | Improper access control vulnerability in WebApp in Cameralyzer prior to versions 3.2.22, 3.3.22, 3.4.22 and 3.5.51 allows attackers to access external storage… |
CVE-2022-36831 | Medium | 6.2 | 2022-08-05 | Path traversal vulnerability in UriFileUtils of Samsung Notes prior to version 4.3.14.39 allows attacker to access some file as Samsung Notes permission. |
CVE-2022-36830 | Medium | 6.2 | 2022-08-05 | PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permissio… |
CVE-2022-36829 | Medium | 6.2 | 2022-08-05 | PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permission via… |
CVE-2022-33734 | Medium | 6.2 | 2022-08-05 | Sensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection information wi… |
CVE-2022-33733 | Medium | 6.2 | 2022-08-05 | Sensitive information exposure in onCharacteristicRead in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection information witho… |
CVE-2022-35858 | High | 7.8 | 2022-08-04 | The TEE_PopulateTransientObject and __utee_from_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overwrite, denial of ser… |
CVE-2022-33713 | High | 7.5 | 2022-07-12 | Implicit Intent hijacking vulnerability in Samsung Cloud prior to version 5.2.0 allows attacker to get sensitive information. |
CVE-2022-33712 | Medium | 5.3 | 2022-07-12 | Intent redirection vulnerability using implict intent in Camera prior to versions 12.0.01.64 ,12.0.3.23, 12.0.0.98, 12.0.6.11, 12.0.3.19 in Android S(12) allow… |
CVE-2022-33711 | Medium | 5.5 | 2022-07-12 | Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allows local attackers… |
CVE-2022-33710 | High | 7.8 | 2022-07-12 | Improper input validation vulnerability in BillingPackageInsraller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Gal… |
CVE-2022-33709 | High | 7.8 | 2022-07-12 | Improper input validation vulnerability in ApexPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy… |
CVE-2022-33708 | High | 7.8 | 2022-07-12 | Improper input validation vulnerability in AppsPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy… |
CVE-2022-33707 | Medium | 5.3 | 2022-07-12 | Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device. |
CVE-2022-33706 | Low | 2.4 | 2022-07-12 | Improper access control vulnerability in Samsung Gallery prior to version 13.1.05.8 allows physical attackers to access the pictures using S Pen air gesture. |
CVE-2022-33705 | Low | 3.3 | 2022-07-12 | Information exposure in Calendar prior to version 12.3.05.10000 allows attacker to access calendar schedule without READ_CALENDAR permission. |
CVE-2022-33691 | Medium | 6.2 | 2022-07-12 | A possible race condition vulnerability in score driver prior to SMR Jul-2022 Release 1 can allow local attackers to interleave malicious operations. |
CVE-2022-30749 | Low | 3.3 | 2022-06-07 | Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity. |
CVE-2022-30748 | Medium | 4.0 | 2022-06-07 | Unprotected dynamic receiver in Samsung Members prior to version 4.2.005 allows attacker to launch arbitrary activity. |
CVE-2022-30747 | Medium | 5.5 | 2022-06-07 | PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent. |
CVE-2022-30746 | High | 7.5 | 2022-06-07 | Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API. |
CVE-2022-30745 | Medium | 4.0 | 2022-06-07 | Improper access control vulnerability in Quick Share prior to version 13.1.2.4 allows attacker to access internal files in Quick Share. |
CVE-2022-30744 | Medium | 6.2 | 2022-06-07 | DLL hijacking vulnerability in KiesWrapper in Samsung Kies prior to version 2.6.4.22043_1 allows attacker to execute arbitrary code. |
CVE-2022-30743 | Medium | 5.3 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission. |
CVE-2022-30742 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get… |
CVE-2022-30741 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to… |
CVE-2022-30740 | Medium | 4.1 | 2022-06-07 | Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers. |
CVE-2022-30739 | Medium | 4.0 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get an user email or phone number with a normal level per… |
CVE-2022-30738 | Medium | 4.3 | 2022-06-07 | Improper check in Loader in Samsung Internet prior to 17.0.1.69 allows attackers to spoof address bar via executing script. |
CVE-2022-30737 | Medium | 4.0 | 2022-06-07 | Implicit Intent hijacking vulnerability in Samsung Account prior to version 13.2.00.6 allows attackers to get email ID. |
CVE-2022-30736 | Medium | 5.3 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission. |
CVE-2022-30735 | Medium | 5.9 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_token without permission. |
CVE-2022-30734 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without perm… |
CVE-2022-30733 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permi… |
CVE-2022-30732 | Medium | 5.5 | 2022-06-07 | Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive information via onActivityRes… |
CVE-2022-30731 | Medium | 5.1 | 2022-06-07 | Improper access control vulnerability in My Files prior to version 13.1.00.193 allows attackers to access arbitrary private files in My Files application. |
CVE-2022-30730 | Medium | 4.6 | 2022-06-07 | Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authentication. |
CVE-2022-28793 | Medium | 4.4 | 2022-05-03 | Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT during device boot… |
CVE-2022-28792 | Medium | 6.2 | 2022-05-03 | DLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows attacker to execute arbitrary code. The patch adds proper absolute p… |
CVE-2022-28791 | Medium | 6.2 | 2022-05-03 | Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4.5.41.8 allows attacker to overwrite files stored in a specific path… |
CVE-2022-28790 | Medium | 4.0 | 2022-05-03 | Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. The patch adds proper caller signature check l… |
CVE-2022-28789 | Medium | 6.2 | 2022-05-03 | Unprotected activities in Voice Note prior to version 21.3.51.11 allows attackers to record voice without user interaction. The patch adds proper permission fo… |
CVE-2022-28779 | Medium | 5.3 | 2022-04-11 | Uncontrolled search path element vulnerability in Samsung Android USB Driver windows installer program prior to version 1.7.50 allows attacker to execute arbit… |
CVE-2022-28778 | Medium | 4.4 | 2022-04-11 | Improper access control vulnerability in Samsung Security Supporter prior to version 1.2.40.0 allows attacker to set the arbitrary folder as Secret Folder with… |
CVE-2022-28777 | Medium | 4.3 | 2022-04-11 | Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALL_PHONE permissio… |
CVE-2022-28776 | Medium | 5.9 | 2022-04-11 | Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications from Galaxy Store without user interact… |
CVE-2022-28775 | Medium | 5.1 | 2022-04-11 | Improper access control vulnerability in Samsung Flow prior to version 4.8.06.5 allows attacker to write the file without Samsung Flow permission. |
CVE-2022-28544 | Medium | 6.2 | 2022-04-11 | Path traversal vulnerability in unzip method of InstallAgentCommonHelper in Galaxy store prior to version 4.5.40.5 allows attacker to access the file of Galaxy… |
CVE-2022-28543 | Medium | 4.0 | 2022-04-11 | Path traversal vulnerability in Samsung Flow prior to version 4.8.07.4 allows local attackers to read arbitrary files as Samsung Flow permission. |
CVE-2022-28542 | Medium | 6.8 | 2022-04-11 | Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access privileged content providers as Galaxy Stor… |
CVE-2022-28541 | Medium | 5.9 | 2022-04-11 | Uncontrolled search path element vulnerability in Samsung Update prior to version 3.0.77.0 allows attackers to execute arbitrary code as Samsung Update permiss… |
CVE-2022-27843 | Medium | 6.2 | 2022-04-11 | DLL hijacking vulnerability in Kies prior to version 2.6.4.22014_2 allows attacker to execute abitrary code. |
CVE-2022-27842 | Medium | 6.2 | 2022-04-11 | DLL hijacking vulnerability in Smart Switch PC prior to version 4.2.22022_4 allows attacker to execute abitrary code. |
CVE-2022-27841 | Medium | 4.3 | 2022-04-11 | Improper exception handling in Samsung Pass prior to version 3.7.07.5 allows physical attacker to view the screen that is previously running without authentica… |
CVE-2022-27840 | Medium | 4.4 | 2022-04-11 | Improper access control vulnerability in SamsungRecovery prior to version 8.1.43.0 allows local attckers to delete arbitrary files as SamsungRecovery permissio… |
CVE-2022-27839 | Low | 3.3 | 2022-04-11 | Improper authentication vulnerability in SecretMode in Samsung Internet prior to version 16.2.1 allows attackers to access bookmark tab without proper credenti… |
CVE-2022-27838 | High | 7.7 | 2022-04-11 | Improper access control vulnerability in FactoryCamera prior to version 2.1.96 allows attacker to access the file with system privilege. |
CVE-2022-27837 | Medium | 4.4 | 2022-04-11 | A vulnerability using PendingIntent in Accessibility prior to version 12.5.3.2 in Android R(11.0) and 13.0.1.1 in Android S(12.0) allows attacker to access the… |