Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 release will handle this further, switching to globally enforced automatic escaping and thus reducing the attack surface in general. The latter will also improve the security of third party plugins. During a transition period, third party plugins will be able to opt into the automatic escaping. With OctoPrint 1.13.0, automatic escaping will be switched over to be enforced even for third party plugins, unless they explicitly opt-out. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-xvxq-g8hw-fx4g
CVE ID: CVE-2024-49378 State: PUBLISHED Published: 2024-10-25T12:55:30.739Z Last Updated: 2024-10-25T14:37:25.046Z Vendors: zimocode Products: smartup Problem Types: CWE-79 Description: smartUp, a web browser mouse gestures extension, has a universal cross-site scripting issue in the Edge and Firefox versions of smartUp 7.2.622.1170. The vulnerability allows another extension to execute arbitrary code in the context of the user’s tab. As of time of publication, no known patches exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-011_smartup/ - https://github.com/zimocode/smartup/blob/2144ec161697751b1a6702f1af866726ea689
b.com/advisories/GHSL-2024-011_smartup/ - https://github.com/zimocode/smartup/blob/2144ec161697751b1a6702f1af866726ea689e4e/js/background.js#L3800
CVE ID: CVE-2024-49379 State: PUBLISHED Published: 2024-11-13T17:18:47.547Z Last Updated: 2024-11-21T16:12:56.595Z Vendors: getumbrel Products: umbrel Problem Types: CWE-79 Description: Umbrel is a home server OS for self-hosting. The login functionality of Umbrel before version 1.2.2 contains a reflected cross-site scripting (XSS) vulnerability in use-auth.tsx. An attacker can specify a malicious redirect query parameter to trigger the vulnerability. If a JavaScript URL is passed to the redirect parameter the attacker provided JavaScript will be executed after the user entered their password and clicked on login. This vulnerability is fixed in 1.2.2. Additional Analyst Notes: - CISA ADP Vul
ered their password and clicked on login. This vulnerability is fixed in 1.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-164_Umbrel/ - https://github.com/getumbrel/umbrel/commit/b83e3542650880bf1439419d00bf82285a7d2b22 - https://github.com/getumbrel/umbrel/releases/tag/1.2.2
CVE ID: CVE-2024-49380 State: PUBLISHED Published: 2024-10-25T13:04:01.815Z Last Updated: 2024-10-25T14:24:31.224Z Vendors: plentico Products: plenti Problem Types: CWE-74 Description: Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-297_GHSL-2024-298_plenti/ - https://github.com/plentico/plenti/blob/01825e0dcd3505fac57a
github.com/advisories/GHSL-2024-297_GHSL-2024-298_plenti/ - https://github.com/plentico/plenti/blob/01825e0dcd3505fac57adc2edf29f772d585c008/cmd/serve.go#L205 - https://github.com/plentico/plenti/releases/tag/v0.7.2
CVE ID: CVE-2024-49381 State: PUBLISHED Published: 2024-10-25T13:06:13.307Z Last Updated: 2024-10-25T13:47:34.600Z Vendors: plentico Products: plenti Problem Types: CWE-74 Description: Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-297_GHSL-2024-298_plenti/ - https://github.com/plentico/plenti/blob/01825e0dcd3505fac57adc2edf2
com/advisories/GHSL-2024-297_GHSL-2024-298_plenti/ - https://github.com/plentico/plenti/blob/01825e0dcd3505fac57adc2edf29f772d585c008/cmd/serve.go#L205 - https://github.com/plentico/plenti/releases/tag/v0.7.2
CVE ID: CVE-2024-49382 State: PUBLISHED Published: 2024-10-15T10:32:55.845Z Last Updated: 2024-10-15T12:46:35.938Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-1327 Description: Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-7286
CVE ID: CVE-2024-49383 State: PUBLISHED Published: 2024-10-15T10:33:14.227Z Last Updated: 2024-10-15T12:46:55.089Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-1327 Description: Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-7285
CVE ID: CVE-2024-49384 State: PUBLISHED Published: 2024-10-15T10:33:52.655Z Last Updated: 2024-10-15T12:47:14.120Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-1327 Description: Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-7284
CVE ID: CVE-2024-49385 State: PUBLISHED Published: 2025-01-02T14:14:35.360Z Last Updated: 2025-01-02T14:49:09.334Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Acronis Products: Acronis True Image Problem Types: CWE-732 Description: Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 41736. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-2397
CVE ID: CVE-2024-49386 State: PUBLISHED Published: 2024-10-17T09:49:45.442Z Last Updated: 2024-10-17T15:51:09.093Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Acronis Products: Acronis Cyber Files Problem Types: CWE-359 Description: Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-5129
CVE ID: CVE-2024-49387 State: PUBLISHED Published: 2024-10-15T10:34:10.675Z Last Updated: 2024-10-15T12:47:32.586Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-319 Description: Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-7022
CVE ID: CVE-2024-49388 State: PUBLISHED Published: 2024-10-15T10:34:24.960Z Last Updated: 2024-10-15T12:47:51.115Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-639 Description: Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-5984
CVE ID: CVE-2024-49389 State: PUBLISHED Published: 2024-10-17T09:49:33.785Z Last Updated: 2024-10-17T17:04:22.178Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Cyber Files Problem Types: CWE-276 Description: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-5319
CVE ID: CVE-2024-49390 State: PUBLISHED Published: 2024-10-17T09:49:16.975Z Last Updated: 2024-10-17T14:37:50.922Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Cyber Files Problem Types: CWE-427 Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-5845
CVE ID: CVE-2024-49391 State: PUBLISHED Published: 2024-10-17T09:48:58.555Z Last Updated: 2024-10-17T14:39:08.875Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Cyber Files Problem Types: CWE-427 Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-7220
CVE ID: CVE-2024-49392 State: PUBLISHED Published: 2024-10-17T09:48:39.748Z Last Updated: 2024-10-17T14:39:54.062Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Acronis Products: Acronis Cyber Files Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability on enrollment invitation page. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-7554
CVE ID: CVE-2024-49393 State: PUBLISHED Published: 2024-11-12T01:55:40.765Z Last Updated: 2025-11-20T19:20:09.077Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-347 Description: In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat
mpromise message confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-49393 - https://bugzilla.redhat.com/show_bug.cgi?id=2325317
CVE ID: CVE-2024-49394 State: PUBLISHED Published: 2024-11-12T02:07:19.551Z Last Updated: 2025-11-21T06:57:29.402Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-347 Description: In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-49394 - https://bugzilla.redhat.com/show_bug.c
lnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-49394 - https://bugzilla.redhat.com/show_bug.cgi?id=2325330
CVE ID: CVE-2024-49395 State: PUBLISHED Published: 2024-11-12T02:08:03.548Z Last Updated: 2025-11-21T06:57:29.487Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-1230 Description: In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-49395 - https://bugzilla.redhat.com/show_bug.cgi?id=2325332
CVE ID: CVE-2024-49396 State: PUBLISHED Published: 2024-10-17T16:12:21.215Z Last Updated: 2024-10-17T17:51:54.610Z Vendors: Elvaco Products: M-Bus Metering Gateway CMe3100 Problem Types: CWE-522 Description: The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-01
CVE ID: CVE-2024-49397 State: PUBLISHED Published: 2024-10-17T16:15:14.508Z Last Updated: 2024-10-17T17:51:47.925Z Vendors: Elvaco Products: M-Bus Metering Gateway CMe3100 Problem Types: CWE-79 Description: The affected product is vulnerable to a cross-site scripting attack which may allow an attacker to bypass authentication and takeover admin accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-01
CVE ID: CVE-2024-49398 State: PUBLISHED Published: 2024-10-17T16:17:31.423Z Last Updated: 2024-10-17T17:51:38.915Z Vendors: Elvaco Products: M-Bus Metering Gateway CMe3100 Problem Types: CWE-434 Description: The affected product is vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-01
CVE ID: CVE-2024-49399 State: PUBLISHED Published: 2024-10-17T16:19:47.991Z Last Updated: 2024-10-17T16:56:24.149Z Vendors: Elvaco Products: M-Bus Metering Gateway CMe3100 Problem Types: CWE-306 Description: The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to leak information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-01
CVE ID: CVE-2024-49400 State: PUBLISHED Published: 2024-10-17T17:15:17.191Z Last Updated: 2024-11-01T18:35:40.761Z Vendors: Meta Products: Tacquito Problem Types: Permissive Regular Expression (CWE-625) Description: Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. That would have potentially allowed unauthorized commands to be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2024-4
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2024-49400
CVE ID: CVE-2024-49401 State: PUBLISHED Published: 2024-11-06T02:17:18.793Z Last Updated: 2024-11-06T11:16:40.215Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-20: Improper Input Validation Description: Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=11
CVE ID: CVE-2024-49402 State: PUBLISHED Published: 2024-11-06T02:17:19.952Z Last Updated: 2024-11-06T11:16:20.671Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-20: Improper Input Validation Description: Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profiles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=11
CVE ID: CVE-2024-49403 State: PUBLISHED Published: 2024-11-06T02:17:21.074Z Last Updated: 2024-11-06T11:15:59.978Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Voice Recorder Problem Types: CWE-284: Improper Access Control Description: Improper access control in Samsung Voice Recorder prior to version 21.5.40.37 allows physical attackers to access recording files on the lock screen. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=11
CVE ID: CVE-2024-49404 State: PUBLISHED Published: 2024-11-06T02:17:22.194Z Last Updated: 2024-11-06T11:15:34.014Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Video Player Problem Types: CWE-284: Improper Access Control Description: Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows physical attackers to access video file of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=11
CVE ID: CVE-2024-49405 State: PUBLISHED Published: 2024-11-06T02:17:23.333Z Last Updated: 2024-11-06T11:15:06.554Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Pass Problem Types: CWE-287 Improper Authentication Description: Improper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows physical attackers to access sensitive information in a specific scenario. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=11
CVE ID: CVE-2024-49406 State: PUBLISHED Published: 2024-11-06T02:17:24.461Z Last Updated: 2024-11-06T11:14:38.590Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Blockchain Keystore Problem Types: CWE-354 Improper Validation of Integrity Check Value Description: Improper validation of integrity check value in Blockchain Keystore prior to version 1.3.16 allows local attackers to modify transaction. Root privilege is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=11
CVE ID: CVE-2024-49407 State: PUBLISHED Published: 2024-11-06T02:17:25.616Z Last Updated: 2024-11-06T11:12:42.602Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Flow Problem Types: CWE-284: Improper Access Control Description: Improper access control in Samsung Flow prior to version 4.9.15.7 allows physical attackers to access data across multiple user profiles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=11
CVE ID: CVE-2024-49408 State: PUBLISHED Published: 2024-11-06T02:17:26.793Z Last Updated: 2024-11-06T15:58:22.659Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-787 Out-of-bounds Write Description: Out-of-bounds write in usb driver prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memory. System privilege is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=09
CVE ID: CVE-2024-49409 State: PUBLISHED Published: 2024-11-06T02:17:27.963Z Last Updated: 2024-11-06T15:56:36.373Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-787 Out-of-bounds Write Description: Out-of-bounds write in Battery Full Capacity node prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memory. System privilege is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=09
CVE ID: CVE-2024-49410 State: PUBLISHED Published: 2024-12-03T05:47:52.309Z Last Updated: 2024-12-03T11:31:24.049Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-787 Out-of-bounds Write Description: Out-of-bounds write in libswmfextractor.so prior to SMR Dec-2024 Release 1 allows local attackers to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
CVE ID: CVE-2024-49411 State: PUBLISHED Published: 2024-12-03T05:47:53.600Z Last Updated: 2024-12-03T11:31:00.965Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) Description: Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
CVE ID: CVE-2024-49412 State: PUBLISHED Published: 2024-12-03T05:47:54.841Z Last Updated: 2024-12-03T11:30:22.006Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-20: Improper Input Validation Description: Improper input validation in Settings prior to SMR Dec-2024 Release 1 allows local attackers to broadcast signal for discovering Bluetooth on Galaxy Watch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
CVE ID: CVE-2024-49413 State: PUBLISHED Published: 2024-12-03T05:47:56.157Z Last Updated: 2024-12-03T11:33:43.124Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-347: Improper Verification of Cryptographic Signature Description: Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
CVE ID: CVE-2024-49414 State: PUBLISHED Published: 2024-12-03T05:47:57.426Z Last Updated: 2024-12-03T11:28:54.837Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-288: Authentication Bypass Using an Alternate Path Description: Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12