Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ing Jadx, and a dynamic analasys using Frida. The attacker can iterate over all the IOT devices to see every entry and exit, on every gate and device all over the world, he can also scrape the server and create a user's DB with full names and phone number of over 2.8 million users, and to see all of the users' movement in and out of gates, even in real time. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-36783 State: PUBLISHED Published: 2022-10-25T00:50:05.722Z Last Updated: 2025-05-07T19:24:43.237Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: AlgoSec Products: FireFlow A32.0, FireFlow A32.10, FireFlow A32.20 Problem Types: Reflected Cross-Site-Scripting (RXSS) Description: AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user (victim). JavaScript code is executed on the browser of the other user. Additional Analyst Notes: - CVE Progra
ther user (victim). JavaScript code is executed on the browser of the other user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-36784 State: PUBLISHED Published: 2022-11-17T22:27:54.221Z Last Updated: 2025-04-25T20:15:24.502Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Elsight Products: Elsight Halo Problem Types: Remote Code Execution (RCE) Description: Elsight – Elsight Halo Remote Code Execution (RCE) Elsight Halo web panel allows us to perform connection validation. through the POST request : /api/v1/nics/wifi/wlan0/ping we can abuse DESTINATION parameter and leverage it to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-36785 State: PUBLISHED Published: 2022-11-17T22:27:55.842Z Last Updated: 2025-04-29T13:43:47.629Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: D-Link Products: G integrated Access Device4 Problem Types: Information Disclosure & Authorization Bypass. Description: D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass. *Information Disclosure – file contains a URL with private IP at line 15 "login.asp" A. The window.location.href = http://192.168.1.1/setupWizard.asp" http://192.168.1.1/setupWizard.asp" ; "admin" – contains default username value "login.asp" B. While accessing the web interface, the login form at *A
.asp" ; "admin" – contains default username value "login.asp" B. While accessing the web interface, the login form at *Authorization Bypass – URL by "setupWizard.asp' while it blocks direct access to – the web interface does not properly validate user identity variables values located at the client side, it is available to access it without a "login_glag" and "login_status" checking browser and to read the admin user credentials for the web interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-36786 State: PUBLISHED Published: 2022-11-17T00:00:00.000Z Last Updated: 2025-04-29T20:01:06.332Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: D-Link Products: DSL-224 Problem Types: Post-auth RCE Description: DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-36787 State: PUBLISHED Published: 2022-11-17T22:27:53.961Z Last Updated: 2025-04-25T20:19:50.215Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: webvendome Products: webvendome Problem Types: CWE-89 Description: webvendome - webvendome SQL Injection. SQL Injection in the Parameter " DocNumber" Request : Get Request : /webvendome/showfiles.aspx?jobnumber=nullDoc Number=HERE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-36788 State: PUBLISHED Published: 2023-04-20T15:29:30.431Z Last Updated: 2024-08-03T10:14:28.480Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Slic3r Products: libslic3r Problem Types: CWE-130 Description: A heap-based buffer overflow vulnerability exists in the TriangleMesh clone functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. A specially-crafted STL file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1593
CVE ID: CVE-2022-36789 State: PUBLISHED Published: 2022-11-11T15:48:52.320Z Last Updated: 2025-02-05T20:23:34.877Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC 10 Performance Kits and Intel(R) NUC 10 Performance Mini PCs Problem Types: escalation of privilege Description: Improper access control in BIOS firmware for some Intel(R) NUC 10 Performance Kits and Intel(R) NUC 10 Performance Mini PCs before version FNCML357.0053 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html
CVE ID: CVE-2022-36791 State: PUBLISHED Published: 2022-09-23T14:22:10.185Z Last Updated: 2025-02-20T20:03:37.029Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Awesome UG Products: Torro Forms (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/torro-forms/wordpress-torro-forms-plugin-1-0-16-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve - https://wordpress.org/plug
o-forms-plugin-1-0-16-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve - https://wordpress.org/plugins/torro-forms/
CVE ID: CVE-2022-36792 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:20:41.361Z Description: No description available.
CVE ID: CVE-2022-36793 State: PUBLISHED Published: 2022-09-09T14:39:55.115Z Last Updated: 2025-02-20T20:06:54.800Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: wp-shop.ru Products: WP Shop (WordPress plugin) Problem Types: CWE-264 Description: Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin <= 3.9.6 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-shop-original/wordpress-wp-shop-plugin-3-9-6-unauthenticated-plugin-settings-change-data-deletion-vulnerabilities/_s_id=cve - https://wordpress.org/plugins/wp-shop-orig
uthenticated-plugin-settings-change-data-deletion-vulnerabilities/_s_id=cve - https://wordpress.org/plugins/wp-shop-original/
CVE ID: CVE-2022-36794 State: PUBLISHED Published: 2023-02-16T20:00:01.515Z Last Updated: 2025-01-27T18:21:01.456Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) SPS firmware Problem Types: denial of service Description: Improper condition check in some Intel(R) SPS firmware before version SPS_E3_06.00.03.300.0 may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00718.html
CVE ID: CVE-2022-36795 State: PUBLISHED Published: 2022-10-19T21:18:33.075Z Last Updated: 2025-05-08T18:15:29.927Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: F5 Products: BIG-IP Problem Types: CWE-682 Description: In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, and 14.1.x before 14.1.5.1, when an LTM TCP profile with Auto Receive Window Enabled is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.f5.com/csp/article/K52494562
CVE ID: CVE-2022-36796 State: PUBLISHED Published: 2022-09-01T16:49:39.440Z Last Updated: 2025-02-20T20:09:44.530Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: CallRail, Inc. Products: CallRail Phone Call Tracking (WordPress plugin) Problem Types: CWE-352, CWE-79 Description: Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in CallRail, Inc. CallRail Phone Call Tracking plugin <= 0.4.9 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/callrail-phone-call-tracking/wordpress-callrail-phone-call-tracking-plugin-0-4-9
//patchstack.com/database/vulnerability/callrail-phone-call-tracking/wordpress-callrail-phone-call-tracking-plugin-0-4-9-cross-site-request-forgery-csrf-vulnerability-leading-to-stored-cross-site-scripting-xss - https://wordpress.org/plugins/callrail-phone-call-tracking/
CVE ID: CVE-2022-36797 State: PUBLISHED Published: 2023-02-16T20:00:24.958Z Last Updated: 2025-01-27T18:14:14.947Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Intel(R) Ethernet 500 Series Controller drivers for VMware Problem Types: denial of service Description: Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00750.html
CVE ID: CVE-2022-36798 State: PUBLISHED Published: 2022-09-23T13:40:25.646Z Last Updated: 2025-02-20T20:04:21.878Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Topdigitaltrends Products: Mega Addons For WPBakery Page Builder (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mega-addons-for-visual-composer/wordpress-mega-addons-for-wpbakery-page-builder-plugin-4-2-7-cross-site-request
rability/mega-addons-for-visual-composer/wordpress-mega-addons-for-wpbakery-page-builder-plugin-4-2-7-cross-site-request-forgery-csrf-vulnerability - https://wordpress.org/plugins/mega-addons-for-visual-composer/
CVE ID: CVE-2022-36799 State: PUBLISHED Published: 2022-08-01T01:15:12.567055Z Last Updated: 2024-10-03T18:44:09.152Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Remote Code Execution (RCE) Description: This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. In this case the security improvement was to protect against using the XStream library
in the Email Templates feature. In this case the security improvement was to protect against using the XStream library to be able to execute arbitrary code in velocity templates. The affected versions are before version 8.13.19, from version 8.14.0 before 8.20.7, and from version 8.21.0 before 8.22.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-73582
CVE ID: CVE-2022-36800 State: PUBLISHED Published: 2022-08-03T02:20:31.107199Z Last Updated: 2024-10-29T15:13:03.394Z Vendors: Atlassian Products: Jira Service Management Server, Jira Service Management Data Center Problem Types: Information Disclosure Description: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission to view groups via an Information Disclosure vulnerability in the browsegroups.action endpoint. The affected versions are before version 4.22.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JSDSERVER-11900
CVE ID: CVE-2022-36801 State: PUBLISHED Published: 2022-08-10T02:20:09.601567Z Last Updated: 2024-10-29T15:15:10.791Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Reflected Cross-Site Scripting (RXSS) Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS) vulnerability in the TeamManagement.jspa endpoint. The affected versions are before version 8.20.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-73740
CVE ID: CVE-2022-36802 State: PUBLISHED Published: 2022-10-14T03:45:14.385390Z Last Updated: 2024-10-29T15:19:34.058Z Vendors: Atlassian Products: Jira Align Problem Types: Server-Side Request Forgery Description: The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources via a Server-Side Request Forgery. This can be exploited by a remote, unauthenticated attacker with Super Admin privileges by sending a specially crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JIRAALIGN-4326
CVE ID: CVE-2022-36803 State: PUBLISHED Published: 2022-10-14T03:45:15.477564Z Last Updated: 2024-10-02T14:23:56.022Z Vendors: Atlassian Products: Jira Align Problem Types: Improper Authorization Description: The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the MasterUserEdit API to modify any users role to Super Admin. This vulnerability was reported by Jacob Shafer from Bishop Fox. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JIRAALIGN-4281
CVE ID: CVE-2022-36804 State: PUBLISHED Published: 2022-08-25T05:40:08.899Z Last Updated: 2025-10-21T23:15:36.273Z Vendors: Atlassian Products: Bitbucket Server, Bitbucket Data Center Problem Types: Remote Code Execution Description: Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by
allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/BSERV-13438 - http://packetstormsecurity.com/files/168470/Bitbucket-Git-Command-Injection.html - http://packetstormsecurity.com/files/171453/Bitbucket-7.0.0-Remote-Command-Execution.html
CVE ID: CVE-2022-36816 State: REJECTED Published: N/A Last Updated: 2023-11-15T06:42:36.631073Z Description: No description available.
CVE ID: CVE-2022-36827 State: REJECTED Published: N/A Last Updated: 2023-11-15T06:42:39.384114Z Description: No description available.
CVE ID: CVE-2022-36829 State: PUBLISHED Published: 2022-08-05T15:16:35 Last Updated: 2024-08-03T10:14:28.413Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Charm by Samsung Problem Types: CWE-927 Description: PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permission via implicit intent. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE ID: CVE-2022-36830 State: PUBLISHED Published: 2022-08-05T15:16:49 Last Updated: 2024-08-03T10:14:28.485Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Charm by Samsung Problem Types: CWE-927 Description: PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permission via implicit intent. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE ID: CVE-2022-36831 State: PUBLISHED Published: 2022-08-05T15:14:38 Last Updated: 2024-08-03T10:14:28.535Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung notes Problem Types: CWE-22 Description: Path traversal vulnerability in UriFileUtils of Samsung Notes prior to version 4.3.14.39 allows attacker to access some file as Samsung Notes permission. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE ID: CVE-2022-36832 State: PUBLISHED Published: 2022-08-05T15:18:54 Last Updated: 2024-08-03T10:14:28.427Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Cameralyzer Problem Types: CWE-284 Description: Improper access control vulnerability in WebApp in Cameralyzer prior to versions 3.2.22, 3.3.22, 3.4.22 and 3.5.51 allows attackers to access external storage as Cameralyzer privilege. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE ID: CVE-2022-36833 State: PUBLISHED Published: 2022-08-05T15:20:19 Last Updated: 2024-08-03T10:14:28.496Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Samsung Mobile Products: Game Optimizing Service Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Game Optimizing Service prior to versions 3.3.04.0 in Android 10, and 3.5.04.8 in Android 11 and above allows local attacker to execute hidden function for developer by changing package name. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE ID: CVE-2022-36834 State: PUBLISHED Published: 2022-08-05T15:18:15 Last Updated: 2024-08-03T10:14:28.557Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Samsung Mobile Products: Game Launcher Problem Types: CWE-200 Description: Exposure of Sensitive Information vulnerability in Game Launcher prior to version 6.0.07 allows local attacker to access app data with user interaction. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE ID: CVE-2022-36835 State: PUBLISHED Published: 2022-08-05T15:13:15 Last Updated: 2024-08-03T10:14:28.537Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Internet Browser Problem Types: CWE-200 Description: Implicit Intent hijacking vulnerability in Samsung Internet Browser prior to version 17.0.7.34 allows attackers to access arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE ID: CVE-2022-36836 State: PUBLISHED Published: 2022-08-05T15:17:04 Last Updated: 2024-08-03T10:14:28.486Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Charm by Samsung Problem Types: CWE-862 Description: Unprotected provider vulnerability in Charm by Samsung prior to version 1.2.3 allows attackers to read connection state without permission. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE ID: CVE-2022-36837 State: PUBLISHED Published: 2022-08-05T15:15:52 Last Updated: 2024-08-03T10:14:28.546Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung email Problem Types: CWE-285 Description: Intent redirection vulnerability using implicit intent in Samsung email prior to version 6.1.70.20 allows attacker to get sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE ID: CVE-2022-36838 State: PUBLISHED Published: 2022-08-05T15:15:38 Last Updated: 2024-08-03T10:14:28.488Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Galaxy Wearable Problem Types: CWE-285 Description: Implicit Intent hijacking vulnerability in Galaxy Wearable prior to version 2.2.50 allows attacker to get sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE ID: CVE-2022-36839 State: PUBLISHED Published: 2022-08-05T15:19:36 Last Updated: 2024-08-03T10:14:28.489Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Checkout Problem Types: CWE-89 Description: SQL injection vulnerability via IAPService in Samsung Checkout prior to version 5.0.53.1 allows attackers to access IAP information. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE ID: CVE-2022-36840 State: PUBLISHED Published: 2022-08-05T15:18:27 Last Updated: 2024-08-03T10:14:28.481Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Update Setup Problem Types: CWE-427 Description: DLL hijacking vulnerability in Samsung Update Setup prior to version 2.2.9.50 allows attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08