Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-34571 State: PUBLISHED Published: 2024-05-08T09:39:08.677Z Last Updated: 2024-08-02T02:59:21.794Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemeGrill Products: Himalayas Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue affects Himalayas: from n/a through 1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/himalayas/wordpress-himalayas-theme-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34572 State: PUBLISHED Published: 2024-05-08T09:12:06.672Z Last Updated: 2024-08-02T02:59:21.697Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemePrix Products: Fancy Elementor Flipbox Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePrix Fancy Elementor Flipbox fancy-elementor-flipbox allows Stored XSS.This issue affects Fancy Elementor Flipbox: from n/a through 2.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/fancy-elementor-flipbox/wordpress-fancy-el
rogram Container: References: - https://patchstack.com/database/vulnerability/fancy-elementor-flipbox/wordpress-fancy-elementor-flipbox-plugin-2-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34573 State: PUBLISHED Published: 2024-05-08T09:00:31.210Z Last Updated: 2024-08-02T02:59:21.982Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Pootlepress Products: Pootle Pagebuilder – WordPress Page builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pootlepress Pootle Pagebuilder – WordPress Page builder allows Stored XSS.This issue affects Pootle Pagebuilder – WordPress Page builder: from n/a through 5.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/po
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/pootle-page-builder/wordpress-pootle-pagebuilder-plugin-5-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34574 State: PUBLISHED Published: 2024-05-08T08:58:45.312Z Last Updated: 2024-08-02T02:59:21.676Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Wpsoul Products: Table Maker Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpsoul Table Maker allows Stored XSS.This issue affects Table Maker: from n/a through 1.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/table-maker/wordpress-table-maker-plugin-1-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34575 State: PUBLISHED Published: 2024-05-17T06:03:34.050Z Last Updated: 2024-08-02T02:59:21.678Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: deTheme Products: DethemeKit For Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through 2.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/dethemekit-for-elementor/wordpress-dethemekit-for-elementor-
References: - https://patchstack.com/database/vulnerability/dethemekit-for-elementor/wordpress-dethemekit-for-elementor-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34577 State: PUBLISHED Published: 2024-08-30T06:29:32.671Z Last Updated: 2025-03-13T16:11:44.120Z Vendors: ELECOM CO.,LTD. Products: WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, and WRC-X3000GS2A-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20240827-01/ - https://jvn.jp/en/jp/JVN24885537/
CVE ID: CVE-2024-34579 State: PUBLISHED Published: 2025-01-17T00:21:36.411Z Last Updated: 2025-02-12T20:31:24.377Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Alpha5 SMART Problem Types: CWE-121 Description: Fuji Electric Alpha5 SMART is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-016-05
CVE ID: CVE-2024-34580 State: PUBLISHED Published: 2024-06-26T00:00:00 Last Updated: 2024-08-08T17:18:46.698273 Vendors: n/a Products: n/a Problem Types: n/a Description: Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection against an SSRF payload in a KeyInfo element. NOTE: the project disputes this CVE Record on the grounds that any vulnerabilities are the result of a failure to configure XML Security for C++ securely. Even when avoiding this particular issue, any use of this library would need considerable additional code and a deep understanding of the standards and protocols involved to arrive at a secure
need considerable additional code and a deep understanding of the standards and protocols involved to arrive at a secure implementation for any particular use case. We recommend against continued direct use of this library. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://santuario.apache.org/download.html - https://cloud.google.com/blog/topics/threat-intelligence/apache-library-allows-server-side-request-forgery - https://www.sonatype.com/blog/the-exploited-ivanti-connect-ssrf-vulnerability-stems-from-xmltooling-oss-library - https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2024-21893.md - https://lists.apache.org/thread/po2gocnw4gtf4
- https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2024-21893.md - https://lists.apache.org/thread/po2gocnw4gtf4boy5mmjb54g62qhbrl9 - https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/3726671873/Santuario
CVE ID: CVE-2024-34581 State: PUBLISHED Published: 2024-06-26T00:00:00 Last Updated: 2024-08-02T02:59:22.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: The W3C XML Signature Syntax and Processing (XMLDsig) specification, starting with 1.0, was originally published with a "RetrievalMethod is a URI ... that may be used to obtain key and/or certificate information" statement and no accompanying information about SSRF risks, and this may have contributed to vulnerable implementations such as those discussed in CVE-2023-36661 and CVE-2024-21893. NOTE: this was mitigated in 1.1 and 2.0 via a directly referenced Best Practices document that calls on implementers to be wary of SSRF.
itigated in 1.1 and 2.0 via a directly referenced Best Practices document that calls on implementers to be wary of SSRF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.w3.org/TR/xmldsig-core2/ - https://www.w3.org/TR/xmldsig-core1/ - https://www.w3.org/TR/2013/NOTE-xmldsig-bestpractices-20130411/ - https://www.w3.org/Signature/Drafts/WD-xmldsig-core-200003plc/ - https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2024-21893.md
CVE ID: CVE-2024-34582 State: PUBLISHED Published: 2024-05-16T14:18:30.053Z Last Updated: 2025-02-13T15:53:26.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sunhillo SureLine through 8.10.0 on RICI 5000 devices allows cgi/usrPasswd.cgi userid_change XSS within the Forgot Password feature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/silent6trinity/CVE-2024-34582
CVE ID: CVE-2024-34583 State: PUBLISHED Published: 2024-07-02T09:23:20.905Z Last Updated: 2024-08-02T02:59:21.774Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284: Improper Access Control Description: Improper access control in system property prior to SMR Jul-2024 Release 1 allows local attackers to get device identifier. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE ID: CVE-2024-34584 State: REJECTED Published: 2024-07-02T09:23:22.043Z Last Updated: 2024-07-04T09:10:04.905Z Description: No description available.
CVE ID: CVE-2024-34585 State: PUBLISHED Published: 2024-07-02T09:23:23.187Z Last Updated: 2024-08-07T15:12:59.483Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284 Improper Access Control Description: Improper access control in launchApp of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE ID: CVE-2024-34586 State: PUBLISHED Published: 2024-07-02T09:23:24.312Z Last Updated: 2024-08-02T02:59:21.777Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-280: Improper Handling of Insufficient Permissions or Privileges Description: Improper access control in KnoxCustomManagerService prior to SMR Jul-2024 Release 1 allows local attackers to configure Knox privacy policy. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE ID: CVE-2024-34587 State: PUBLISHED Published: 2024-07-02T09:23:25.396Z Last Updated: 2024-08-02T02:59:21.914Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-1288: Improper Validation of Consistency within Input Description: Improper input validation in parsing application information from RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.sams
ability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE ID: CVE-2024-34588 State: PUBLISHED Published: 2024-07-02T09:23:26.798Z Last Updated: 2024-08-02T02:59:21.653Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-1288: Improper Validation of Consistency within Input Description: Improper input validation혻in parsing RTCP SR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE ID: CVE-2024-34589 State: PUBLISHED Published: 2024-07-02T09:23:28.195Z Last Updated: 2024-08-02T02:59:22.238Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-1288: Improper Validation of Consistency within Input Description: Improper input validation in parsing RTCP RR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2024-34590 State: PUBLISHED Published: 2024-07-02T09:23:29.305Z Last Updated: 2024-08-02T02:59:21.956Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-1288: Improper Validation of Consistency within Input Description: Improper input validation혻in parsing an item type from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com
tional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE ID: CVE-2024-34591 State: PUBLISHED Published: 2024-07-02T09:23:30.429Z Last Updated: 2024-08-02T02:59:21.670Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-1288: Improper Validation of Consistency within Input Description: Improper input validation in parsing an item data from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com
CVE ID: CVE-2024-34592 State: PUBLISHED Published: 2024-07-02T09:23:31.546Z Last Updated: 2024-08-02T02:59:22.204Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-1288: Improper Validation of Consistency within Input Description: Improper input validation in parsing RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.sm
es: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE ID: CVE-2024-34593 State: PUBLISHED Published: 2024-07-02T09:23:32.660Z Last Updated: 2024-08-02T02:59:22.098Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-1288: Improper Validation of Consistency within Input Description: Improper input validation in parsing and distributing RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.co
itional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE ID: CVE-2024-34594 State: PUBLISHED Published: 2024-07-02T09:23:33.773Z Last Updated: 2024-08-02T02:59:21.833Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Description: Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local attackers to read kernel memory address. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE ID: CVE-2024-34595 State: PUBLISHED Published: 2024-07-02T09:23:35.124Z Last Updated: 2024-08-02T02:59:22.046Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284 Improper Access Control Description: Improper access control in clickAdapterItem of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE ID: CVE-2024-34596 State: PUBLISHED Published: 2024-07-02T09:23:36.232Z Last Updated: 2024-08-02T02:59:21.931Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Samsung Mobile Products: SmartThings Problem Types: CWE-287 Improper Authentication Description: Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07
CVE ID: CVE-2024-34597 State: PUBLISHED Published: 2024-07-02T09:23:37.348Z Last Updated: 2024-08-02T02:59:22.192Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Health Problem Types: CWE-20: Improper Input Validation Description: Improper input validation in Samsung Health prior to version 6.27.0.113 allows local attackers to write arbitrary document files to the sandbox of Samsung Health. User interaction is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07
CVE ID: CVE-2024-34598 State: PUBLISHED Published: 2025-09-04T10:55:34.535Z Last Updated: 2025-09-04T14:21:43.982Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Samsung Mobile Products: GoodLock Problem Types: CWE-926:혻Improper Export of Android Application Components Description: Improper export of component in GoodLock prior to version 2.2.04.95 allows local attackers to install arbitrary applications from Galaxy Store. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07
CVE ID: CVE-2024-34599 State: PUBLISHED Published: 2024-07-02T09:23:39.540Z Last Updated: 2024-08-02T02:59:22.340Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Tips Problem Types: CWE-20: Improper Input Validation Description: Improper input validation in Tips prior to version 6.2.9.4 in Android 14 allows local attacker to send broadcast with Tips&#39; privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07
CVE ID: CVE-2024-34600 State: PUBLISHED Published: 2024-07-02T09:23:40.666Z Last Updated: 2024-08-02T02:59:22.341Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: Samsung Mobile Products: Samsung Flow Problem Types: CWE-925 : Improper Verification of Intent by Broadcast Receiver Description: Improper verification of intent by broadcast receiver vulnerability in Samsung Flow prior to version 4.9.13.0 allows local attackers to copy image files to external storage. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07
CVE ID: CVE-2024-34601 State: PUBLISHED Published: 2024-07-02T09:23:41.774Z Last Updated: 2024-08-02T02:59:21.745Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Samsung Mobile Products: GalaxyStore Problem Types: CWE-925 : Improper Verification of Intent by Broadcast Receiver Description: Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launch unexported activities of GalaxyStore. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07
CVE ID: CVE-2024-34602 State: PUBLISHED Published: 2024-07-08T06:12:39.337Z Last Updated: 2024-08-02T02:59:21.933Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-927 : Use of Implicit Intent for Sensitive Communication Description: Use of implicit intent for sensitive communication in Samsung Messages prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. User interaction is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year
ISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE ID: CVE-2024-34603 State: PUBLISHED Published: 2024-07-08T06:12:40.540Z Last Updated: 2024-08-02T02:59:22.026Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284 Improper Access Control Description: Improper access control in Samsung Message prior to SMR Jul-2024 Release 1 allows local attackers to access location data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE ID: CVE-2024-34604 State: PUBLISHED Published: 2024-08-07T01:29:53.460Z Last Updated: 2024-08-07T15:41:36.482Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284: Improper Access Control Description: Improper access control in LedCoverService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE ID: CVE-2024-34605 State: PUBLISHED Published: 2024-08-07T01:29:54.632Z Last Updated: 2024-08-07T14:02:16.157Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284: Improper Access Control Description: Improper access control in SamsungHealthService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08