Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-39811 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-28T17:38:58.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying permissions for access to resources, it allows an attacker to view pages that are not allowed, and modify the system configuration, bypassing all controls (without checking for user identity). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-39812 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-28T19:20:42.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An unauthenticated user can upload files to an arbitrary path. An attacker can change the uploadDir parameter in a POST request (not possible using the GUI) to an arbitrary directory. Because the application does not check in which directory a file will be uploaded, an attacker can perform a variety of attacks that can result in unauthorized access to the server. Additional Analyst Notes: - CVE Program Container: - CI
of attacks that can result in unauthorized access to the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-39813 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-28T19:19:36.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: Italtel NetMatch-S CI 5.2.0-20211008 allows Multiple Reflected/Stored XSS issues under NMSCIWebGui/j_security_check via the j_username parameter, or NMSCIWebGui/actloglineview.jsp via the name or actLine parameter. An attacker leveraging this vulnerability could inject arbitrary JavaScript. The payload would then be triggered every time an authenticated user browses the page containing it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-39814 State: PUBLISHED Published: 2022-09-13T20:36:57 Last Updated: 2024-08-03T12:07:42.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NOKIA 1350 OMS R14.2, an Open Redirect vulnerability occurs is the login page via next HTTP GET parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-39815 State: PUBLISHED Published: 2022-09-13T20:36:50 Last Updated: 2024-08-03T12:07:42.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. This vulnerability allow unauthenticated users to execute commands on the operating system. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-39816 State: PUBLISHED Published: 2022-09-13T20:36:45 Last Updated: 2024-08-03T12:07:42.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials (cleartext administrator password) occur in the edit configuration page. Exploitation requires an authenticated attacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-39817 State: PUBLISHED Published: 2022-09-13T20:36:39 Last Updated: 2024-08-03T12:07:42.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NOKIA 1350 OMS R14.2, multiple SQL Injection vulnerabilities occurs. Exploitation requires an authenticated attacker. Through the injection of arbitrary SQL statements, a potential authenticated attacker can modify query syntax and perform unauthorized (and unexpected) operations against the remote database. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-39818 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-03T12:07:42.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NOKIA NFM-T R19.9, an OS Command Injection vulnerability occurs in /cgi-bin/R19.9/log.pl of the VM Manager WebUI via the cmd HTTP GET parameter. This allows authenticated users to execute commands, with root privileges, on the operating system. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-39819 State: PUBLISHED Published: 2022-09-13T20:36:33 Last Updated: 2024-08-03T12:07:42.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. This allows authenticated users to execute commands on the operating system. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-39820 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-03T12:07:42.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xml.DRC and /DEPOT/KECustom_199/OTNE_DRC/RestUploadManager.xml. A remote user, authenticated to the operating system, with access privileges to the directory /root or /DEPOT, is able to read cleartext credentials to access the web portal NFM-T and control all the PPS Network elements. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-tea
rk elements. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-39821 State: PUBLISHED Published: 2022-09-13T20:36:27 Last Updated: 2024-08-03T12:07:42.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs. The web application stores critical information, such as cleartext user credentials, in world-readable files in the filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-39822 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-09-09T19:55:55.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter. An authenticated attacker is required for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-39823 State: PUBLISHED Published: 2022-10-20T00:00:00.000Z Last Updated: 2025-05-08T18:56:58.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Softing OPC UA C++ SDK 5.66 through 6.x before 6.10. An OPC/UA browse request exceeding the server limit on continuation points may cause a use-after-free error Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.softing.com - https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-8.html
CVE ID: CVE-2022-39824 State: PUBLISHED Published: 2022-09-05T02:54:02 Last Updated: 2024-08-03T12:07:42.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FCncdn/Appsmith-Js-Injection-POC - https://github.com/appsmithorg/appsmith/releases
CVE ID: CVE-2022-39828 State: PUBLISHED Published: 2022-09-05T03:43:31 Last Updated: 2024-08-03T12:07:42.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_private_key, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.openssl.org/docs/manmaster/man3/EC_KEY_set_private_key.html - https://github.com/Samsung/mTower/issues/76 - https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tools/fwinfogen.c#L193
CVE ID: CVE-2022-39829 State: PUBLISHED Published: 2022-09-05T03:43:20 Last Updated: 2024-08-03T12:07:43.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a NULL pointer dereference in aes256_encrypt in Samsung mTower through 0.3.0 due to a missing check on the return value of EVP_CIPHER_CTX_new. Additional Analyst Notes: - CVE Program Container: References: - https://www.openssl.org/docs/manmaster/man3/EVP_CIPHER_CTX_new.html - https://github.com/Samsung/mTower/issues/75 - https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tools/ecdsa_keygen.c#L135
CVE ID: CVE-2022-39830 State: PUBLISHED Published: 2022-09-05T03:43:12 Last Updated: 2024-08-03T12:07:42.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_public_key_affine_coordinates, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.openssl.org/docs/manmaster/man3/EC_KEY_set_public_key_affine_coordinates.html - https://github.com/Samsung/mTower/issues/77 - https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tools/fwinfogen.c#L194
CVE ID: CVE-2022-39831 State: PUBLISHED Published: 2022-09-05T04:12:37 Last Updated: 2024-08-03T12:07:42.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function read_bytes_internal in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact. This issue is different from CVE-2018-20230. Additional Analyst Notes: - CVE Program Container: References: - https://savannah.gnu.org/bugs/?62977 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VQKWIVW5WJ5ZQNNQFRKTRKD7J3L
s://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VQKWIVW5WJ5ZQNNQFRKTRKD7J3LRLUYW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OECANCPD4WSSBJLSC3EE472M5DXRTIS4/
CVE ID: CVE-2022-39832 State: PUBLISHED Published: 2022-09-05T04:12:30 Last Updated: 2024-08-03T12:07:42.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function read_string in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://savannah.gnu.org/bugs/index.php?63000 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VQKWIVW5WJ5ZQNNQFRKTRKD7J3LRLUYW/ - https://lists.fedoraproject.org/arc
ckage-announce%40lists.fedoraproject.org/message/VQKWIVW5WJ5ZQNNQFRKTRKD7J3LRLUYW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OECANCPD4WSSBJLSC3EE472M5DXRTIS4/
CVE ID: CVE-2022-39833 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T20:24:08.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.filecloud.com/supportdocs/fcdoc/latest/server/security-advisories/2022-security-advisories/advisory-2022-10-01-unauthorized-access-and-potential-remote-code-execution - https://gist.github.com/DylanGrl/4b4e0d53bb7626b2ab3f834ec5a2b23c
CVE ID: CVE-2022-39834 State: PUBLISHED Published: 2022-11-17T00:00:00.000Z Last Updated: 2025-04-29T20:30:25.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2. A low-privilege user can store JavaScript in order to exploit a higher-privilege user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.keyfactor.com/s/detail/a6x1Q000000CwCoQAK
CVE ID: CVE-2022-39835 State: PUBLISHED Published: 2022-09-27T18:21:13.000Z Last Updated: 2025-05-21T15:24:58.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://dev.gajim.org/gajim/gajim/-/tags - https://dev.gajim.org/gajim/gajim/-/blob/master/ChangeLog
CVE ID: CVE-2022-39836 State: PUBLISHED Published: 2022-10-24T00:00:00.000Z Last Updated: 2025-05-07T14:22:21.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2022/Sep/24 - https://sec-consult.com/vulnerability-lab/advisory/multiple-memory-corruption-vulnerabilities-in-cove
sure/2022/Sep/24 - https://sec-consult.com/vulnerability-lab/advisory/multiple-memory-corruption-vulnerabilities-in-covesa-dlt-daemon/ - https://lists.debian.org/debian-lts-announce/2024/06/msg00021.html
CVE ID: CVE-2022-39837 State: PUBLISHED Published: 2022-10-24T00:00:00.000Z Last Updated: 2025-05-07T14:20:44.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference, Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2022/Sep/24 - https://sec-consult.com/vulnerability-lab/advisory/multiple-memory-corruption-vulnerabilities-in-covesa-dlt-daemon/
4 - https://sec-consult.com/vulnerability-lab/advisory/multiple-memory-corruption-vulnerabilities-in-covesa-dlt-daemon/ - https://lists.debian.org/debian-lts-announce/2024/06/msg00021.html
CVE ID: CVE-2022-39838 State: PUBLISHED Published: 2022-09-05T15:39:50 Last Updated: 2024-08-03T12:07:42.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: Systematic FIX Adapter (ALFAFX) 2.4.0.25 13/09/2017 allows remote file inclusion via a UNC share pathname, and also allows absolute path traversal to local pathnames. Additional Analyst Notes: - CVE Program Container: References: - http://systematicalpha.com/company - https://github.com/jet-pentest/CVE-2022-39838 - http://systematicalpha.com/trading-programs/systematic-alpha-fx-master-fund
CVE ID: CVE-2022-39839 State: PUBLISHED Published: 2022-09-05T05:06:50 Last Updated: 2024-08-03T12:07:43.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cotonti/Cotonti/issues/1661
CVE ID: CVE-2022-39840 State: PUBLISHED Published: 2022-09-05T05:06:17 Last Updated: 2024-08-03T12:07:42.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cotonti/Cotonti/issues/1660
CVE ID: CVE-2022-39842 State: PUBLISHED Published: 2022-09-05T00:00:00 Last Updated: 2024-08-03T12:07:42.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLo
. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19 - https://github.com/torvalds/linux/commit/a09d2d00af53b43c6f11e6ab3cb58443c2cac8a7 - https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html - https://www.debian.org/security/2022/dsa-5257 - https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html - https://lore.kernel.org/all/YylaC1wHHyLw22D3%40kadam/T/
CVE ID: CVE-2022-39843 State: PUBLISHED Published: 2022-09-05T06:02:03 Last Updated: 2024-08-03T12:07:42.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: 123elf Lotus 1-2-3 before 1.0.0rc3 for Linux, and Lotus 1-2-3 R3 for UNIX and other platforms through 9.8.2, allow attackers to execute arbitrary code via a crafted worksheet. This occurs because of a stack-based buffer overflow in the cell format processing routines, as demonstrated by a certain function call from process_fmt() that can be reached via a w3r_format element in a wk3 document. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/taviso/123elf/issues/103 - https://github.com/taviso
st Notes: - CVE Program Container: References: - https://github.com/taviso/123elf/issues/103 - https://github.com/taviso/123elf/releases/tag/v1.0.0rc3
CVE ID: CVE-2022-39844 State: PUBLISHED Published: 2022-09-09T14:39:57 Last Updated: 2024-08-03T12:07:42.878Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Samsung Mobile Products: Smart Switch PC Problem Types: CWE-354 Description: Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrary directory using directory junction. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE ID: CVE-2022-39845 State: PUBLISHED Published: 2022-09-09T14:39:57 Last Updated: 2024-08-03T12:07:43.038Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Samsung Mobile Products: Samsung Kies Problem Types: CWE-354 Description: Improper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attackers to delete arbitrary directory using directory junction. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE ID: CVE-2022-39846 State: PUBLISHED Published: 2022-09-09T14:39:57 Last Updated: 2024-08-03T12:07:43.014Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Samsung Mobile Products: Smart Switch PC Problem Types: CWE-427 Description: DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.22083_3 allows attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE ID: CVE-2022-39847 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:07:42.854Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-416 Description: Use after free vulnerability in set_nft_pid and signal_handler function of NFC driver prior to SMR Oct-2022 Release 1 allows attackers to perform malicious actions. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE ID: CVE-2022-39848 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:07:42.897Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-213 Description: Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE ID: CVE-2022-39849 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:07:42.909Z Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284 Description: Improper access control in knox_vpn_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE ID: CVE-2022-39850 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:07:42.825Z Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284 Description: Improper access control in mum_container_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE ID: CVE-2022-39851 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:07:42.946Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284 Description: Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bind service that require BIND_REMOTEVIEWS permission. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE ID: CVE-2022-39852 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:07:42.938Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-122 Description: A heap-based overflow vulnerability in makeContactAGIF in libagifencoder.quram.so library prior to SMR Oct-2022 Release 1 allows attacker to perform code execution. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE ID: CVE-2022-39853 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:07:42.990Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-416 Description: A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory access fault. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10