Samsung
Page 12 of 17 — Samsung CVEs from a corpus of 1634, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-30733 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permi… |
CVE-2022-30732 | Medium | 5.5 | 2022-06-07 | Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive information via onActivityRes… |
CVE-2022-30731 | Medium | 5.1 | 2022-06-07 | Improper access control vulnerability in My Files prior to version 13.1.00.193 allows attackers to access arbitrary private files in My Files application. |
CVE-2022-30730 | Medium | 4.6 | 2022-06-07 | Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authentication. |
CVE-2022-28793 | Medium | 4.4 | 2022-05-03 | Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT during device boot… |
CVE-2022-28792 | Medium | 6.2 | 2022-05-03 | DLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows attacker to execute arbitrary code. The patch adds proper absolute p… |
CVE-2022-28791 | Medium | 6.2 | 2022-05-03 | Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4.5.41.8 allows attacker to overwrite files stored in a specific path… |
CVE-2022-28790 | Medium | 4.0 | 2022-05-03 | Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. The patch adds proper caller signature check l… |
CVE-2022-28789 | Medium | 6.2 | 2022-05-03 | Unprotected activities in Voice Note prior to version 21.3.51.11 allows attackers to record voice without user interaction. The patch adds proper permission fo… |
CVE-2022-28779 | Medium | 5.3 | 2022-04-11 | Uncontrolled search path element vulnerability in Samsung Android USB Driver windows installer program prior to version 1.7.50 allows attacker to execute arbit… |
CVE-2022-28778 | Medium | 4.4 | 2022-04-11 | Improper access control vulnerability in Samsung Security Supporter prior to version 1.2.40.0 allows attacker to set the arbitrary folder as Secret Folder with… |
CVE-2022-28777 | Medium | 4.3 | 2022-04-11 | Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALL_PHONE permissio… |
CVE-2022-28776 | Medium | 5.9 | 2022-04-11 | Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications from Galaxy Store without user interact… |
CVE-2022-28775 | Medium | 5.1 | 2022-04-11 | Improper access control vulnerability in Samsung Flow prior to version 4.8.06.5 allows attacker to write the file without Samsung Flow permission. |
CVE-2022-28544 | Medium | 6.2 | 2022-04-11 | Path traversal vulnerability in unzip method of InstallAgentCommonHelper in Galaxy store prior to version 4.5.40.5 allows attacker to access the file of Galaxy… |
CVE-2022-28543 | Medium | 4.0 | 2022-04-11 | Path traversal vulnerability in Samsung Flow prior to version 4.8.07.4 allows local attackers to read arbitrary files as Samsung Flow permission. |
CVE-2022-28542 | Medium | 6.8 | 2022-04-11 | Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access privileged content providers as Galaxy Stor… |
CVE-2022-28541 | Medium | 5.9 | 2022-04-11 | Uncontrolled search path element vulnerability in Samsung Update prior to version 3.0.77.0 allows attackers to execute arbitrary code as Samsung Update permiss… |
CVE-2022-27843 | Medium | 6.2 | 2022-04-11 | DLL hijacking vulnerability in Kies prior to version 2.6.4.22014_2 allows attacker to execute abitrary code. |
CVE-2022-27842 | Medium | 6.2 | 2022-04-11 | DLL hijacking vulnerability in Smart Switch PC prior to version 4.2.22022_4 allows attacker to execute abitrary code. |
CVE-2022-27841 | Medium | 4.3 | 2022-04-11 | Improper exception handling in Samsung Pass prior to version 3.7.07.5 allows physical attacker to view the screen that is previously running without authentica… |
CVE-2022-27840 | Medium | 4.4 | 2022-04-11 | Improper access control vulnerability in SamsungRecovery prior to version 8.1.43.0 allows local attckers to delete arbitrary files as SamsungRecovery permissio… |
CVE-2022-27839 | Low | 3.3 | 2022-04-11 | Improper authentication vulnerability in SecretMode in Samsung Internet prior to version 16.2.1 allows attackers to access bookmark tab without proper credenti… |
CVE-2022-27838 | High | 7.7 | 2022-04-11 | Improper access control vulnerability in FactoryCamera prior to version 2.1.96 allows attacker to access the file with system privilege. |
CVE-2022-27837 | Medium | 4.4 | 2022-04-11 | A vulnerability using PendingIntent in Accessibility prior to version 12.5.3.2 in Android R(11.0) and 13.0.1.1 in Android S(12.0) allows attacker to access the… |
CVE-2022-27834 | Low | 2.9 | 2022-04-11 | Use after free vulnerability in dsp_context_unload_graph function of DSP driver prior to SMR Apr-2022 Release 1 allows attackers to perform malicious actions. |
CVE-2022-27833 | Medium | 4.4 | 2022-04-11 | Improper input validation in DSP driver prior to SMR Apr-2022 Release 1 allows out-of-bounds write by integer overflow. |
CVE-2022-25154 | High | 7.3 | 2022-04-05 | A DLL hijacking vulnerability in Samsung portable SSD T5 PC software before 1.6.9 could allow a local attacker to escalate privileges. (An attacker must alread… |
CVE-2022-25830 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25829 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25828 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25827 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25826 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of connected WiFiAp in t… |
CVE-2022-25824 | Medium | 4.0 | 2022-03-10 | Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrary URL and local fil… |
CVE-2022-25823 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in log. |
CVE-2022-25821 | Low | 3.3 | 2022-03-10 | Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB read. |
CVE-2022-25819 | Medium | 5.3 | 2022-03-10 | OOB read vulnerability in hdcp2 device node prior to SMR Mar-2022 Release 1 allow an attacker to view Kernel stack memory. |
CVE-2022-24932 | Medium | 4.2 | 2022-03-10 | Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package installation befor… |
CVE-2022-24930 | Medium | 4.4 | 2022-03-10 | An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted applications to rese… |
CVE-2022-24927 | Medium | 4.2 | 2022-02-11 | Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to execute video files without permission. |
CVE-2022-24926 | Medium | 5.7 | 2022-02-11 | Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.15-6 allows privileged attackers to trigger a XSS on a victim's devices. |
CVE-2022-24924 | Low | 2.2 | 2022-02-11 | An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system directory without a proper permission. |
CVE-2022-24923 | Medium | 4.0 | 2022-02-11 | Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to load arbitrary URL an… |
CVE-2022-24003 | Medium | 4.0 | 2022-02-11 | Exposure of Sensitive Information vulnerability in Bixby Vision prior to version 3.7.50.6 allows attackers to access internal data of Bixby Vision via unprotec… |
CVE-2022-24002 | Medium | 4.0 | 2022-02-11 | Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected activity via PreconditionActivity. |
CVE-2022-23998 | Medium | 6.2 | 2022-02-11 | Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in Android P(9) allows… |
CVE-2022-23997 | Medium | 4.0 | 2022-02-11 | Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted application… |
CVE-2022-23996 | Medium | 4.0 | 2022-02-11 | Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to enable b… |
CVE-2022-23995 | Medium | 4.0 | 2022-02-11 | Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to cha… |
CVE-2022-23994 | Low | 3.3 | 2022-02-11 | An Improper access control vulnerability in StBedtimeModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to cha… |
CVE-2022-23434 | Medium | 4.4 | 2022-02-11 | A vulnerability using PendingIntent in Bixby Vision prior to versions 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below allows attackers to execut… |
CVE-2022-23433 | Medium | 4.3 | 2022-02-11 | Improper access control vulnerability in Reminder prior to versions 12.3.01.3000 in Android S(12), 12.2.05.6000 in Android R(11) and 11.6.08.6000 in Andoid Q(1… |
CVE-2022-23432 | Medium | 6.4 | 2022-02-11 | An improper input validation in SMC_SRPMB_WSM handler of RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution. |
CVE-2022-23431 | Medium | 6.4 | 2022-02-11 | An improper boundary check in RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution. |
CVE-2022-23428 | High | 8.4 | 2022-02-11 | An improper boundary check in eden_runtime hal service prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution. |
CVE-2022-23425 | High | 8.6 | 2022-02-11 | Improper input validation in Exynos baseband prior to SMR Feb-2022 Release 1 allows attackers to send arbitrary NAS signaling messages with fake base station. |
CVE-2022-22290 | Medium | 6.5 | 2022-01-14 | Incorrect download source UI in Downloads in Samsung Internet prior to 16.0.6.23 allows attackers to perform domain spoofing via a crafted HTML page. |
CVE-2022-22289 | Medium | 5.3 | 2022-01-10 | Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information. |
CVE-2022-22288 | High | 7.5 | 2022-01-10 | Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist. |
CVE-2022-22287 | Low | 3.9 | 2022-01-10 | Abitrary file access vulnerability in Samsung Email prior to 6.1.60.16 allows attacker to read isolated data in sandbox. |
CVE-2022-22286 | Medium | 4.4 | 2022-01-10 | A vulnerability using PendingIntent in Bixby Routines prior to version 3.1.21.8 in Android R(11.0) and 2.6.30.5 in Android Q(10.0) allows attackers to execute… |
CVE-2022-22285 | Medium | 4.4 | 2022-01-10 | A vulnerability using PendingIntent in Reminder prior to version 12.2.05.0 in Android R(11.0) and 12.3.02.1000 in Android S(12.0) allows attackers to execute p… |
CVE-2022-22284 | Medium | 5.7 | 2022-01-10 | Improper authentication vulnerability in Samsung Internet prior to 16.0.2.19 allows attackers to bypass secret mode password authentication |
CVE-2022-22283 | Low | 2.8 | 2022-01-10 | Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App. |
CVE-2022-22265 | Medium | 5.0 | 2022-01-10 | An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution. |
CVE-2020-9061 | Medium | 6.5 | 2022-01-10 | Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon… |
CVE-2021-42913 | High | 7.5 | 2021-12-20 | The SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a list of SMB users and cleartext passwords by reading the HTML sou… |
CVE-2021-25527 | Low | 3.8 | 2021-12-08 | Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to access Bill Pay and Rech… |
CVE-2021-25526 | Medium | 4.0 | 2021-12-08 | Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action. |
CVE-2021-25525 | Low | 2.0 | 2021-12-08 | Improper check or handling of exception conditions vulnerability in Samsung Pay (US only) prior to version 4.0.65 allows attacker to use NFC without user recog… |
CVE-2021-25524 | Medium | 4.0 | 2021-12-08 | Insecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to get Samsung Account ID. |
CVE-2021-25523 | Medium | 4.0 | 2021-12-08 | Insecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows attacker to get Samsung Account ID. |
CVE-2021-25522 | Medium | 5.3 | 2021-12-08 | Insecure storage of sensitive information vulnerability in Smart Capture prior to version 4.8.02.10 allows attacker to access victim's captured images without… |
CVE-2021-25521 | Medium | 4.0 | 2021-12-08 | Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get current tab URL in Samsung Internet. |
CVE-2021-25520 | Medium | 5.9 | 2021-12-08 | Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to e… |
CVE-2021-42114 | Critical | 9.0 | 2021-11-16 | Modern DRAM devices (PC-DDR4, LPDDR4X) are affected by a vulnerability in their internal Target Row Refresh (TRR) mitigation against Rowhammer attacks. Novel n… |
CVE-2021-25509 | Medium | 5.9 | 2021-11-05 | A missing input validation in Samsung Flow Windows application prior to Version 4.8.5.0 allows attackers to overwrite abtraty file in the Windows known folders. |
CVE-2021-25508 | Medium | 5.3 | 2021-11-05 | Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key without limitation. |
CVE-2021-25507 | Medium | 5.7 | 2021-11-05 | Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC application connected with user device to acce… |
CVE-2021-25506 | Medium | 4.0 | 2021-11-05 | Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial of service. |
CVE-2021-25505 | Low | 3.3 | 2021-11-05 | Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked. |
CVE-2021-25504 | Medium | 4.0 | 2021-11-05 | Intent redirection vulnerability in Group Sharing prior to 10.8.03.2 allows attacker to access contact information. |
CVE-2021-25503 | Medium | 5.0 | 2021-11-05 | Improper input validation vulnerability in HDCP prior to SMR Nov-2021 Release 1 allows attackers to arbitrary code execution. |
CVE-2021-25500 | High | 7.2 | 2021-11-05 | A missing input validation in HDCP LDFW prior to SMR Nov-2021 Release 1 allows attackers to overwrite TZASC allowing TEE compromise. |
CVE-2021-25499 | High | 7.1 | 2021-10-06 | Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of Gal… |
CVE-2021-25498 | High | 7.3 | 2021-10-06 | A possible buffer overflow vulnerability in maetd_eco_cb_mode of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary… |
CVE-2021-25497 | High | 7.3 | 2021-10-06 | A possible buffer overflow vulnerability in maetd_cpy_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary c… |
CVE-2021-25496 | High | 7.3 | 2021-10-06 | A possible buffer overflow vulnerability in maetd_dec_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary c… |
CVE-2021-25495 | High | 7.3 | 2021-10-06 | A possible heap buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitrary code execution. |
CVE-2021-25494 | Medium | 4.0 | 2021-10-06 | A possible buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitrary code execution. |
CVE-2021-25493 | Medium | 4.0 | 2021-10-06 | Lack of boundary checking of a buffer in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows OOB read |
CVE-2021-25492 | High | 7.3 | 2021-10-06 | Lack of boundary checking of a buffer in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows OOB read. |
CVE-2021-25491 | Low | 2.3 | 2021-10-06 | A vulnerability in mfc driver prior to SMR Oct-2021 Release 1 allows memory corruption via NULL-pointer dereference. |
CVE-2021-25489 | Low | 3.3 | 2021-10-06 | Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to… |
CVE-2021-25488 | Medium | 5.5 | 2021-10-06 | Lack of boundary checking of a buffer in recv_data() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read. |
CVE-2021-25487 | High | 7.3 | 2021-10-06 | Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary c… |
CVE-2021-25481 | Medium | 6.4 | 2021-10-06 | An improper error handling in Exynos CP booting driver prior to SMR Oct-2021 Release 1 allows local attackers to bypass a Secure Memory Protector of Exynos CP… |
CVE-2021-25479 | High | 7.2 | 2021-10-06 | A possible heap-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25478 | High | 7.2 | 2021-10-06 | A possible stack-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25476 | Medium | 4.1 | 2021-10-06 | An information disclosure vulnerability in Widevine TA log prior to SMR Oct-2021 Release 1 allows attackers to bypass the ASLR protection mechanism in TEE. |