Samsung
Page 13 of 17 — Samsung CVEs from a corpus of 1634, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25475 | Low | 3.9 | 2021-10-06 | A possible heap-based buffer overflow vulnerability in DSP kernel driver prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25471 | Low | 3.7 | 2021-10-06 | A lack of replay attack protection in Security Mode Command process prior to SMR Oct-2021 Release 1 can lead to denial of service on mobile network connection… |
CVE-2021-25470 | High | 7.9 | 2021-10-06 | An improper caller check logic of SMC call in TEEGRIS secure OS prior to SMR Oct-2021 Release 1 can be used to compromise TEE. |
CVE-2021-25469 | Medium | 6.0 | 2021-10-06 | A possible stack-based buffer overflow vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows arbitrary code execution. |
CVE-2021-25468 | Medium | 4.4 | 2021-10-06 | A possible guessing and confirming a byte memory vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows attackers to read arbitrary memory a… |
CVE-2021-25467 | Medium | 5.3 | 2021-10-06 | Assuming system privilege is gained, possible buffer overflow vulnerabilities in the Vision DSP kernel driver prior to SMR Oct-2021 Release 1 allows privilege… |
CVE-2021-25466 | Medium | 6.5 | 2021-09-09 | Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and obtain Samsung Acco… |
CVE-2021-25465 | Low | 3.3 | 2021-09-09 | An improper scheme check vulnerability in Samsung Themes prior to version 5.2.01 allows attackers to perform Man-in-the-middle attack. |
CVE-2021-25464 | Low | 3.3 | 2021-09-09 | An improper file management vulnerability in SamsungCapture prior to version 4.8.02 allows sensitive information leak. |
CVE-2021-25463 | Medium | 4.0 | 2021-09-09 | Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview. |
CVE-2021-25457 | Medium | 5.9 | 2021-09-09 | An improper input validation vulnerability in DSP driver prior to SMR Sep-2021 Release 1 allows local attackers to get a limited kernel memory information. |
CVE-2021-25452 | Medium | 5.5 | 2021-09-09 | An improper input validation vulnerability in loading graph file in DSP driver prior to SMR Sep-2021 Release 1 allows attackers to perform permanent denial of… |
CVE-2021-39373 | High | 7.8 | 2021-09-01 | Samsung Drive Manager 2.0.104 on Samsung H3 devices allows attackers to bypass intended access controls on disk management. WideCharToMultiByte, WideCharStr, a… |
CVE-2021-22684 | High | 7.5 | 2021-08-31 | Tizen RT RTOS version 3.0.GBB is vulnerable to integer wrap-around in functions_calloc and mm_zalloc. This improper memory assignment can lead to arbitrary mem… |
CVE-2021-25448 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in webview. |
CVE-2021-25447 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause local file inclusion in webview. |
CVE-2021-25446 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause arbitrary webpage loading in webview. |
CVE-2021-25445 | Medium | 5.3 | 2021-08-05 | Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access internal files in Samsung Internet. |
CVE-2021-25442 | High | 7.5 | 2021-07-08 | Improper MDM policy management vulnerability in KME module prior to KCS version 1.39 allows MDM users to bypass Knox Manage authentication. |
CVE-2021-25441 | High | 7.8 | 2021-07-08 | Improper input validation vulnerability in AR Emoji Editor prior to version 4.4.03.5 in Android Q(10.0) and above allows untrusted applications to access arbit… |
CVE-2021-25440 | High | 7.8 | 2021-07-08 | Improper access control vulnerability in FactoryCameraFB prior to version 3.4.74 allows untrusted applications to access arbitrary files with an escalated priv… |
CVE-2021-25439 | Low | 3.3 | 2021-07-08 | Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above all… |
CVE-2021-25438 | High | 7.8 | 2021-07-08 | Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above all… |
CVE-2021-25432 | Low | 3.3 | 2021-07-08 | Information exposure vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above allows… |
CVE-2021-25431 | Medium | 5.5 | 2021-07-08 | Improper access control vulnerability in Cameralyzer prior to versions 3.2.1041 in 3.2.x, 3.3.1040 in 3.3.x, and 3.4.4210 in 3.4.x allows untrusted application… |
CVE-2021-25425 | Medium | 5.3 | 2021-06-11 | Improper check vulnerability in Samsung Health prior to version 6.17 allows attacker to read internal cache data via exported component. |
CVE-2021-25424 | High | 8.8 | 2021-06-11 | Improper authentication vulnerability in Tizen bluetooth-frwk prior to Firmware update JUN-2021 Release allows bluetooth attacker to take over the user's bluet… |
CVE-2021-25423 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak Wi-Fi password conn… |
CVE-2021-25422 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak Wi-Fi password conne… |
CVE-2021-25421 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Galaxy Watch3 PlugIn prior to version 2.2.09.21033151 allows attacker with log permissions to leak Wi-Fi password conn… |
CVE-2021-25420 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak Wi-Fi password conne… |
CVE-2021-25419 | Medium | 6.5 | 2021-06-11 | Non-compliance of recommended secure coding scheme in Samsung Internet prior to version 14.0.1.62 allows attackers to display fake URL in address bar via phisi… |
CVE-2021-25418 | High | 7.8 | 2021-06-11 | Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrary activity in speci… |
CVE-2021-25416 | Medium | 6.5 | 2021-06-11 | Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to create executable kernel page outs… |
CVE-2021-25415 | Medium | 5.5 | 2021-06-11 | Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to remap EL2 memory as writable. |
CVE-2021-25411 | Medium | 4.4 | 2021-06-11 | Improper address validation vulnerability in RKP api prior to SMR JUN-2021 Release 1 allows root privileged local attackers to write read-only kernel memory. |
CVE-2021-25408 | High | 7.8 | 2021-06-11 | A possible buffer overflow vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25407 | High | 7.8 | 2021-06-11 | A possible out of bounds write vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write. |
CVE-2021-25406 | Medium | 6.5 | 2021-06-11 | Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to access connected BT device information. |
CVE-2021-25405 | Medium | 5.5 | 2021-06-11 | An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files. |
CVE-2021-25404 | Low | 3.3 | 2021-06-11 | Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log. |
CVE-2021-25403 | Low | 3.3 | 2021-06-11 | Intent redirection vulnerability in Samsung Account prior to version 10.8.0.4 in Android P(9.0) and below, and 12.2.0.9 in Android Q(10.0) and above allows att… |
CVE-2021-25402 | Low | 3.3 | 2021-06-11 | Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information. |
CVE-2021-25401 | High | 7.8 | 2021-06-11 | Intent redirection vulnerability in Samsung Health prior to version 6.16 allows attacker to execute privileged action. |
CVE-2021-25400 | High | 7.8 | 2021-06-11 | Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action. |
CVE-2021-25399 | High | 7.1 | 2021-06-11 | Improper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the file with system privilege. |
CVE-2021-25398 | Low | 3.3 | 2021-06-11 | Intent redirection vulnerability in Bixby Voice prior to version 3.1.12 allows attacker to access contacts. |
CVE-2021-25396 | Medium | 6.7 | 2021-06-11 | An improper input validation vulnerability in NPU firmware prior to SMR MAY-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25395 | Medium | 6.4 | 2021-06-11 | A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised. |
CVE-2021-25394 | Medium | 6.4 | 2021-06-11 | A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compr… |
CVE-2021-3438 | High | 7.8 | 2021-05-20 | A potential buffer overflow in the software drivers for certain HP LaserJet products and Samsung product printers could lead to an escalation of privilege. |
CVE-2020-26146 | Medium | 5.3 | 2021-05-11 | An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numb… |
CVE-2020-26145 | Medium | 6.5 | 2021-05-11 | An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragment… |
CVE-2020-26144 | Medium | 6.5 | 2021-05-11 | An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the fi… |
CVE-2021-25381 | Medium | 5.5 | 2021-04-09 | Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above allows local attacker… |
CVE-2021-25380 | Medium | 5.8 | 2021-04-09 | Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the user. |
CVE-2021-25379 | Medium | 4.0 | 2021-04-09 | Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action. |
CVE-2021-25378 | Medium | 4.3 | 2021-04-09 | Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service. |
CVE-2021-25377 | Low | 3.3 | 2021-04-09 | Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(10.0) above allows attacker to execute pr… |
CVE-2021-25376 | Low | 3.1 | 2021-04-09 | An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTLS negotiation is fa… |
CVE-2021-25375 | Medium | 6.5 | 2021-04-09 | Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another emails when users open… |
CVE-2021-25374 | High | 8.6 | 2021-04-09 | An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9… |
CVE-2021-25373 | Medium | 5.5 | 2021-04-09 | Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in Android Q(10.0) and 2… |
CVE-2021-25372 | Medium | 6.1 | 2021-03-26 | An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access. |
CVE-2021-25371 | Medium | 6.1 | 2021-03-26 | A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP. |
CVE-2021-25370 | Medium | 6.1 | 2021-03-26 | An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic. |
CVE-2021-25369 | Medium | 6.2 | 2021-03-26 | An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. |
CVE-2021-25368 | Low | 3.3 | 2021-03-25 | Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is executed. |
CVE-2021-25367 | Low | 3.7 | 2021-03-25 | Path Traversal vulnerability in Samsung Notes prior to version 4.2.00.22 allows attackers to access local files without permission. |
CVE-2021-25366 | Low | 3.2 | 2021-03-25 | Improper access control in Samsung Internet prior to version 13.2.1.70 allows physically proximate attackers to bypass the secret mode's authentication. |
CVE-2021-25355 | Medium | 5.5 | 2021-03-25 | Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hijacking the PendingI… |
CVE-2021-25354 | Low | 3.3 | 2021-03-25 | Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via malicious deeplink. |
CVE-2021-25353 | Medium | 5.5 | 2021-03-25 | Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private file directories of Galaxy Themes applicat… |
CVE-2021-25352 | Medium | 5.5 | 2021-03-25 | Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileged action by hijacking and modifying the… |
CVE-2021-25351 | Low | 3.2 | 2021-03-25 | Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attackers to log out user… |
CVE-2021-25350 | Low | 2.0 | 2021-03-25 | Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user information via log. |
CVE-2021-25349 | Medium | 5.5 | 2021-03-25 | Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission via hijacking the Pend… |
CVE-2021-25348 | Low | 2.1 | 2021-03-04 | Improper permission grant check in Samsung Internet prior to version 13.0.1.60 allows access to files in internal storage without authorized STORAGE permission. |
CVE-2021-25345 | Medium | 4.0 | 2021-03-04 | Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupported format. |
CVE-2021-25343 | Medium | 4.0 | 2021-03-04 | Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0) and above) allows… |
CVE-2021-25342 | Medium | 4.0 | 2021-03-04 | Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of service attack by hijacking the provider. |
CVE-2021-25341 | Medium | 4.0 | 2021-03-04 | Calling of non-existent provider in S Assistant prior to version 6.5.01.22 allows unauthorized actions including denial of service attack by hijacking the prov… |
CVE-2021-25339 | Medium | 4.4 | 2021-03-04 | Improper address validation in HArx in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernel, to corrupt EL2 me… |
CVE-2021-25338 | Medium | 4.4 | 2021-03-04 | Improper memory access control in RKP in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernel, to write certai… |
CVE-2021-25337 | Medium | 4.4 | 2021-03-04 | Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain l… |
CVE-2021-25335 | Low | 2.5 | 2021-03-04 | Improper lockscreen status check in cocktailbar service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows unauthenticated users to access hidden… |
CVE-2021-25333 | Low | 3.2 | 2021-03-04 | Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen via scanning spe… |
CVE-2021-25332 | Low | 3.2 | 2021-03-04 | Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to contacts information over the lockscreen in specific con… |
CVE-2021-25331 | Low | 3.2 | 2021-03-04 | Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen in specific cond… |
CVE-2021-22495 | Medium | 5.5 | 2021-01-05 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) (Exynos chipsets) software. The Mali GPU driver allows out-of-bound… |
CVE-2021-22494 | Medium | 5.5 | 2021-01-05 | An issue was discovered in the fingerprint scanner on Samsung Note20 mobile devices with Q(10.0) software. When a screen protector is used, the required image… |
CVE-2020-35693 | High | 8.8 | 2020-12-24 | On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) device to pair silently… |
CVE-2020-28343 | High | 7.8 | 2020-11-08 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 980, 9820, and 9830 chipsets) software. The NPU driver allows attackers to ex… |
CVE-2020-28341 | High | 7.8 | 2020-11-08 | An issue was discovered on Samsung mobile devices with Q(10.0) (Exynos990 chipsets) software. The S3K250AF Secure Element CC EAL 5+ chip allows attackers to ex… |
CVE-2020-7811 | Medium | 6.2 | 2020-10-12 | Samsung Update 3.0.2.0 ~ 3.0.32.0 has a vulnerability that allows privilege escalation as commands crafted by attacker are executed while the engine deserializ… |
CVE-2020-25056 | High | 7.5 | 2020-08-31 | An issue was discovered on Samsung mobile devices with Q(10.0) (Galaxy S20) software. Because HAL improperly checks versions, bootloading by the S.LSI NFC chip… |
CVE-2020-25054 | Critical | 9.1 | 2020-08-31 | An issue was discovered on Samsung mobile devices with software through 2020-04-02 (Exynos modem chipsets). There is a heap-based buffer over-read in the Shann… |
CVE-2020-25053 | Critical | 9.8 | 2020-08-31 | An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. RKP allows arbitrary code execution. The Samsung ID is SVE-2020-… |
CVE-2020-25052 | Critical | 9.8 | 2020-08-31 | An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. H-Arx allows attackers to execute arbitrary code or cause a deni… |
CVE-2020-15582 | Medium | 5.5 | 2020-07-07 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 7885 chipsets) software. The Bluetooth Low Energy (BLE) component has a buffe… |