Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-28749 State: PUBLISHED Published: 2022-06-15T20:12:51.705779Z Last Updated: 2024-09-16T22:56:06.093Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Zoom Video Communications Inc Products: On-Premise Meeting Connectors Problem Types: Improper Authorization Description: Zooms On-Premise Meeting Connector MMR before version 4.8.113.20220526 fails to properly check the permissions of a Zoom meeting attendee. As a result, a threat actor in the Zooms waiting room can join the meeting without the consent of the host. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28750 State: PUBLISHED Published: 2022-08-11T14:55:21.145404Z Last Updated: 2024-09-16T21:07:38.487Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Video Communications Inc Products: Zoom On-Premise Meeting Connector Zone Controller (ZC) Problem Types: CWE-121 Description: Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can result in memory corruption and could allow a malicious actor to crash the application. In versions older than 4.8.12.20211115, this vulnerability could also be leveraged to execute arbitrary code. Additional Analyst Notes: - CVE Pr
.8.12.20211115, this vulnerability could also be leveraged to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28751 State: PUBLISHED Published: 2022-08-17T21:06:25.616441Z Last Updated: 2024-09-16T18:33:43.457Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for MacOS Problem Types: CWE-347 Description: The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the package signature validation during the update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security
oot. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28752 State: PUBLISHED Published: 2022-08-17T21:06:50.206218Z Last Updated: 2024-09-17T03:58:48.967Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Room for Conference Room for Windows Problem Types: CWE-347 Description: Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability. A local low-privileged malicious user could exploit this vulnerability to escalate their privileges to the SYSTEM user. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28753 State: PUBLISHED Published: 2022-08-11T14:55:35.585940Z Last Updated: 2024-09-16T16:48:23.453Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: Zoom Video Communications Inc Products: Zoom On-Premise Meeting Connector MMR Problem Types: CWE-284 Description: Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability. As a result, a malicious actor can join a meeting which they are authorized to join without appearing to the other participants, can admit themselves into the meeting from the waiting room, and can become host and cause other meeting disruptions. Additional Analyst N
es into the meeting from the waiting room, and can become host and cause other meeting disruptions. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28754 State: PUBLISHED Published: 2022-08-11T14:55:06.492321Z Last Updated: 2024-09-16T18:54:17.243Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: Zoom Video Communications Inc Products: Zoom On-Premise Meeting Connector MMR Problem Types: CWE-284 Description: Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability. As a result, a malicious actor can join a meeting which they are authorized to join without appearing to the other participants, can admit themselves into the meeting from the waiting room, and can become host and cause other meeting disruptions. Additional Analyst N
CVE ID: CVE-2022-28755 State: PUBLISHED Published: 2022-08-11T14:55:46.515107Z Last Updated: 2024-09-17T02:53:24.397Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows), Zoom VDI Windows Meeting Clients Problem Types: CWE-20 Description: The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including the pot
ous link may direct the user to connect to an arbitrary network address, leading to additional attacks including the potential for remote code execution through launching executables from arbitrary paths. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28756 State: PUBLISHED Published: 2022-08-15T22:11:03.586532Z Last Updated: 2024-09-17T01:15:56.201Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for MacOS Problem Types: CWE-347 Description: The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28757 State: PUBLISHED Published: 2022-08-18T19:31:32.731316Z Last Updated: 2024-09-16T18:48:28.312Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for MacOS Problem Types: CWE-345 Description: The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28758 State: PUBLISHED Published: 2022-09-16T20:13:38.934845Z Last Updated: 2024-09-17T00:16:32.793Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Zoom Video Communications Inc Products: Zoom On-Premise Meeting Connector MMR Problem Types: CWE-284 Description: Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security
ons. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28759 State: PUBLISHED Published: 2022-10-14T14:51:20.203Z Last Updated: 2025-05-14T15:07:19.273Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Zoom Video Communications Inc Products: Zoom On-Premise Meeting Connector MMR Problem Types: CWE-284 Description: Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/t
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28760 State: PUBLISHED Published: 2022-10-14T14:51:16.896Z Last Updated: 2025-05-14T15:10:22.203Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Zoom Video Communications Inc Products: Zoom On-Premise Meeting Connector MMR Problem Types: CWE-284 Description: Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en
ns. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28761 State: PUBLISHED Published: 2022-10-14T14:51:22.410Z Last Updated: 2025-05-14T14:59:05.098Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Zoom Video Communications Inc Products: Zoom On-Premise Meeting Connector MMR Problem Types: CWE-284 Description: Zoom On-Premise Meeting Connector MMR before version 4.8.20220916.131 contains an improper access control vulnerability. As a result, a malicious actor in a meeting or webinar they are authorized to join could prevent participants from receiving audio and video causing meeting disruptions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
meeting disruptions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28762 State: PUBLISHED Published: 2022-10-14T14:51:13.795Z Last Updated: 2025-05-14T15:10:48.155Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for MacOS Problem Types: CWE-16 Description: Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration. When camera mode rendering context is enabled as part of the Zoom App Layers API by running certain Zoom Apps, a local debugging port is opened by the Zoom client. A local malicious user could use this debugging port to connect to and control the
g port is opened by the Zoom client. A local malicious user could use this debugging port to connect to and control the Zoom Apps running in the Zoom client. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28763 State: PUBLISHED Published: 2022-10-31T19:49:29.955Z Last Updated: 2025-05-02T17:53:09.804Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows), Zoom VDI Windows Meeting Clients, Zoom Rooms for Conference Room (for Android, iOS, Linux, macOS, and Windows) Problem Types: CWE-20 Description: The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.2 is susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbi
g vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including session takeovers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28764 State: PUBLISHED Published: 2022-11-14T20:17:59.455Z Last Updated: 2025-04-29T19:19:29.673Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows), Zoom VDI Windows Meeting Clients, Zoom Rooms for Conference Room (for Android, iOS, Linux, macOS, and Windows) Problem Types: CWE-200 Description: The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.6 is susceptible to a local information exposure vulnerability. A failure to clear data from a local SQL database after a meeting ends and the usage of
rmation exposure vulnerability. A failure to clear data from a local SQL database after a meeting ends and the usage of an insufficiently secure per-device key encrypting that database results in a local malicious user being able to obtain meeting information such as in-meeting chat for the previous meeting attended from that local user account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28766 State: PUBLISHED Published: 2022-11-17T22:36:56.734Z Last Updated: 2025-04-29T19:37:26.893Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for Windows (32-bit), Zoom VDI Windows Meeting Client for Windows (32-bit), Zoom Rooms for Conference Room for Windows (32-bit) Problem Types: CWE-94 Description: Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injection vulnerability. A local low-privileged user could exploit this vulnerability to run arbitrary code in the context of
ion vulnerability. A local low-privileged user could exploit this vulnerability to run arbitrary code in the context of the Zoom client. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28768 State: PUBLISHED Published: 2022-11-17T22:36:53.034Z Last Updated: 2025-04-29T19:40:00.725Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings Installer for macOS (Standard and for IT Admin) Problem Types: CWE-689 Description: The Zoom Client for Meetings Installer for macOS (Standard and for IT Admin) before version 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
ess to escalate their privileges to root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-28770 State: PUBLISHED Published: 2022-04-12T16:11:28 Last Updated: 2024-08-03T06:03:52.600Z Vendors: SAP SE Products: SAPUI5 (vbm library) Problem Types: CWE-79 Description: Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a script into the URL and execute code. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/
: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3126557
CVE ID: CVE-2022-28771 State: PUBLISHED Published: 2022-07-12T20:26:53 Last Updated: 2024-08-03T06:03:52.657Z Vendors: SAP SE Products: SAP Business One License service API Problem Types: CWE-306 Description: Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send malicious http requests over the network. On successful exploitation, an attacker can break the whole application making it inaccessible. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3157613
CVE ID: CVE-2022-28772 State: PUBLISHED Published: 2022-04-12T16:11:32 Last Updated: 2024-08-03T06:03:52.584Z Vendors: SAP SE Products: SAP NetWeaver (Internet Communication Manager), SAP Web Dispatcher Problem Types: CWE-121 Description: By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Internet Communication Manager - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, which makes these programs unavailable, leading to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap
vailable, leading to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3111311
CVE ID: CVE-2022-28773 State: PUBLISHED Published: 2022-04-12T16:11:30 Last Updated: 2024-08-03T06:03:52.639Z Vendors: SAP SE Products: SAP NetWeaver (Internet Communication Manager), SAP Web Dispatcher Problem Types: CWE-674 Description: Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3111293
CVE ID: CVE-2022-28774 State: PUBLISHED Published: 2022-05-11T14:55:29 Last Updated: 2024-08-03T06:03:52.641Z Vendors: SAP SE Products: SAP Host Agent Problem Types: CWE-863 Description: Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3158188
CVE ID: CVE-2022-28775 State: PUBLISHED Published: 2022-04-11T19:37:42 Last Updated: 2024-08-03T06:03:52.630Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Samsung Mobile Products: Samsung Flow Problem Types: CWE-284 Description: Improper access control vulnerability in Samsung Flow prior to version 4.8.06.5 allows attacker to write the file without Samsung Flow permission. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=4
CVE ID: CVE-2022-28776 State: PUBLISHED Published: 2022-04-11T19:37:43 Last Updated: 2024-08-03T06:03:52.674Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Galaxy Store Problem Types: CWE-285 Description: Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications from Galaxy Store without user interactions. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=4
CVE ID: CVE-2022-28777 State: PUBLISHED Published: 2022-04-11T19:37:44 Last Updated: 2024-08-03T06:03:52.608Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: Samsung Mobile Products: Samsung Members Problem Types: CWE-284 Description: Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALL_PHONE permission. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=4
CVE ID: CVE-2022-28778 State: PUBLISHED Published: 2022-04-11T19:37:45 Last Updated: 2024-08-03T06:03:52.605Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Samsung Mobile Products: Samsung Security Supporter Problem Types: CWE-284 Description: Improper access control vulnerability in Samsung Security Supporter prior to version 1.2.40.0 allows attacker to set the arbitrary folder as Secret Folder without Samsung Security Supporter permission Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=4
CVE ID: CVE-2022-28779 State: PUBLISHED Published: 2022-04-11T19:37:45 Last Updated: 2024-08-03T06:03:52.653Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:H) Vendors: Samsung Mobile Products: Samsung Android USB Driver windows installer Problem Types: CWE-427 Description: Uncontrolled search path element vulnerability in Samsung Android USB Driver windows installer program prior to version 1.7.50 allows attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=4
CVE ID: CVE-2022-28780 State: PUBLISHED Published: 2022-05-03T19:39:04 Last Updated: 2024-08-03T06:03:52.874Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284 Description: Improper access control vulnerability in Weather prior to SMR May-2022 Release 1 allows that attackers can access location information that set in Weather without permission. The patch adds proper protection to prevent access to location information. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE ID: CVE-2022-28781 State: PUBLISHED Published: 2022-05-03T19:39:54 Last Updated: 2024-08-03T06:03:52.619Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-20 Description: Improper input validation in Settings prior to SMR-May-2022 Release 1 allows attackers to launch arbitrary activity with system privilege. The patch adds proper validation logic to check the caller. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE ID: CVE-2022-28782 State: PUBLISHED Published: 2022-05-03T19:40:19 Last Updated: 2024-08-03T06:03:52.696Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-424 Description: Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to install package before completion of Setup wizard. The patch blocks entry point of the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5