deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-46681
Published: 2022-08-05
Description: A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via module massive operation name field.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://www.incibe.es/en/cve-assignment-publication/coordinated-cves; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2022-1012
Published: 2022-08-05
Description: A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem.
CVSS Score: 8.2 (HIGH)
CWE: CWE-401, CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=2064604; https://lore.kernel.org/lkml/[PII_REDACTED]5233.2075-1-w%401wt.eu/T/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-1704
Published: 2022-08-05
Description: Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup.
CVSS Score: 7.6 (HIGH)
CWE: CWE-611
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01
CVE: CVE-2022-25649
Published: 2022-08-05
Description: Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://dzv365zjfbd8v.cloudfront.net/changelogs/affiliate-for-woocommerce/changelog.txt; https://patchstack.com/database/vulnerability/affiliate-for-woocommerce/wordpress-affiliate-for-woocommerce-premium-plugin-4-7-0-multiple-improper-access-control-vulnerabilities; https://dzv365zjfbd8v.cloudfront.net/changelogs/affiliate-for-woocommerce/changelog.txt
CVE: CVE-2022-2053
Published: 2022-08-05
Description: When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker (application server) as an error state and not forward requests to the worker for a while. In mod_cluster, this continues until the next STATUS request (10 seconds intervals) from the application server updates the server state. So, in the worst case, it can result in "All workers are in error state" and mod_cluster responds "503 Service Unavailable" for a while (up to 10 seconds). In mod_proxy_balancer, it does not forward requests to the worker until the "retry" timeout passes. However, luckily, mod_proxy_balancer has "forcerecovery" setting (On by default; this parameter can force the immediate recovery of all workers without considering the retry parameter of the workers if all workers of a balancer are in error state.). So, unlike mod_cluster, mod_proxy_balancer does not result in responding "503 Service Unavailable". An attacker could use this behavior to send a malicious request and trigger server errors, resulting in DoS (denial of service). This flaw was fixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment#0; https://issues.redhat.com/browse/UNDERTOW-2133; https://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment#0
CVE: CVE-2022-2095
Published: 2022-08-05
Description: An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious authenticated user to view a public project's Deploy Key's public fingerprint and name when that key has write permission. Note that GitLab never asks for nor stores the private key.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2095.json; https://gitlab.com/gitlab-org/gitlab/-/issues/365415; https://hackerone.com/reports/1600325
CVE: CVE-2022-2303
Published: 2022-08-05
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Password Credentials grant to obtain an access token without using 2FA.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2303.json; https://gitlab.com/gitlab-org/gitlab/-/issues/355028; https://hackerone.com/reports/1498133
CVE: CVE-2022-2307
Published: 2022-08-05
Description: A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted, though the APIs usable by that token are limited.
CVSS Score: 3.5 (LOW)
CWE: CWE-459
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2307.json; https://gitlab.com/gitlab-org/gitlab/-/issues/360025; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2307.json
CVE: CVE-2022-2326
Published: 2022-08-05
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible to gain access to a private project through an email invite by using other user's email address as an unverified secondary email.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2326.json; https://gitlab.com/gitlab-org/gitlab/-/issues/356665; https://hackerone.com/reports/1517554
CVE: CVE-2022-2417
Published: 2022-08-05
Description: Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the project.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2417.json; https://gitlab.com/gitlab-org/gitlab/-/issues/361179; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2417.json
CVE: CVE-2022-2456
Published: 2022-08-05
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request.
CVSS Score: 4.9 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2456.json; https://gitlab.com/gitlab-org/gitlab/-/issues/359910; https://hackerone.com/reports/1536559
CVE: CVE-2022-2459
Published: 2022-08-05
Description: An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to prevent members from being added to projects in a group, if the invite was sent before the setting was enabled.
CVSS Score: 2.7 (LOW)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2459.json; https://gitlab.com/gitlab-org/gitlab/-/issues/336169; https://hackerone.com/reports/1256967
CVE: CVE-2022-2497
Published: 2022-08-05
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A malicious developer could exfiltrate an integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.
CVSS Score: 8.5 (HIGH)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2497.json; https://gitlab.com/gitlab-org/gitlab/-/issues/362671; https://hackerone.com/reports/1557992
CVE: CVE-2022-2498
Published: 2022-08-05
Description: An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new pipelines with the person who created the tag as the pipeline creator instead of the subscription's author.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-269
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2498.json; https://gitlab.com/gitlab-org/gitlab/-/issues/243703; https://hackerone.com/reports/966824
CVE: CVE-2022-2499
Published: 2022-08-05
Description: An issue has been discovered in GitLab EE affecting all versions starting from 13.10 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab's Jira integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Jira issues.
CVSS Score: 3.5 (LOW)
CWE: CWE-639
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2499.json; https://gitlab.com/gitlab-org/gitlab/-/issues/360800; https://hackerone.com/reports/1538068
CVE: CVE-2022-2500
Published: 2022-08-05
Description: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. A stored XSS flaw in job error messages allows attackers to perform arbitrary actions on behalf of victims at client side.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2500.json; https://gitlab.com/gitlab-org/gitlab/-/issues/363725; https://hackerone.com/reports/1579645
CVE: CVE-2022-2501
Published: 2022-08-05
Description: An improper access control issue in GitLab EE affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an attacker to bypass IP allow-listing and download artifacts. This attack only bypasses IP allow-listing, proper permissions are still required.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2501.json; https://gitlab.com/gitlab-org/gitlab/-/issues/364822; https://hackerone.com/reports/1591412
CVE: CVE-2022-2512
Published: 2022-08-05
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. Membership changes are not reflected in TODO for confidential notes, allowing a former project members to read updates via TODOs.
CVSS Score: 6.5 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2512.json; https://gitlab.com/gitlab-org/gitlab/-/issues/365742; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2512.json
CVE: CVE-2022-2531
Published: 2022-08-05
Description: An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was not performing correct authentication on Grafana API under specific conditions allowing unauthenticated users to perform queries through a path traversal vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2531.json; https://gitlab.com/gitlab-org/gitlab/-/issues/364252; https://hackerone.com/reports/1566306
CVE: CVE-2022-2534
Published: 2022-08-05
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was returning contributor emails due to improper data handling in the Datadog integration.
CVSS Score: 2.2 (LOW)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2534.json; https://gitlab.com/gitlab-org/gitlab/-/issues/361654; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2534.json
CVE: CVE-2022-2539
Published: 2022-08-05
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.6 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1, allowed a project member to filter issues by contact and organization.
CVSS Score: 5.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2539.json; https://gitlab.com/gitlab-org/gitlab/-/issues/364315; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2539.json
CVE: CVE-2022-31656
Published: 2022-08-05
Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
CVSS Score: 9.8 (CRITICAL)
References: https://www.vmware.com/security/advisories/VMSA-2022-0021.html; https://www.vmware.com/security/advisories/VMSA-2022-0021.html
CVE: CVE-2022-31657
Published: 2022-08-05
Description: VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. A malicious actor with network access may be able to redirect an authenticated user to an arbitrary domain.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-601
References: https://www.vmware.com/security/advisories/VMSA-2022-0021.html; https://www.vmware.com/security/advisories/VMSA-2022-0021.html
CVE: CVE-2022-31658
Published: 2022-08-05
Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://www.vmware.com/security/advisories/VMSA-2022-0021.html; https://www.vmware.com/security/advisories/VMSA-2022-0021.html
CVE: CVE-2022-31659
Published: 2022-08-05
Description: VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.vmware.com/security/advisories/VMSA-2022-0021.html; https://www.vmware.com/security/advisories/VMSA-2022-0021.html
CVE: CVE-2022-31660
Published: 2022-08-05
Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
CVSS Score: 7.8 (HIGH)
References: https://www.vmware.com/security/advisories/VMSA-2022-0021.html; https://www.vmware.com/security/advisories/VMSA-2022-0021.html
CVE: CVE-2022-31661
Published: 2022-08-05
Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities. A malicious actor with local access can escalate privileges to 'root'.
CVSS Score: 7.8 (HIGH)
References: https://www.vmware.com/security/advisories/VMSA-2022-0021.html; https://www.vmware.com/security/advisories/VMSA-2022-0021.html
CVE: CVE-2022-31662
Published: 2022-08-05
Description: VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. A malicious actor with network access may be able to access arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.vmware.com/security/advisories/VMSA-2022-0021.html; https://www.vmware.com/security/advisories/VMSA-2022-0021.html
CVE: CVE-2022-31663
Published: 2022-08-05
Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vmware.com/security/advisories/VMSA-2022-0021.html; https://www.vmware.com/security/advisories/VMSA-2022-0021.html
CVE: CVE-2022-31664
Published: 2022-08-05
Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
CVSS Score: 7.8 (HIGH)
References: https://www.vmware.com/security/advisories/VMSA-2022-0021.html; https://www.vmware.com/security/advisories/VMSA-2022-0021.html
CVE: CVE-2022-31665
Published: 2022-08-05
Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://www.vmware.com/security/advisories/VMSA-2022-0021.html; https://www.vmware.com/security/advisories/VMSA-2022-0021.html
CVE: CVE-2022-33201
Published: 2022-08-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/official-mailerlite-sign-up-forms/wordpress-mailerlite-signup-forms-official-plugin-1-5-7-cross-site-request-forgery-csrf-vulnerability; https://wordpress.org/plugins/official-mailerlite-sign-up-forms/#developers; https://patchstack.com/database/vulnerability/official-mailerlite-sign-up-forms/wordpress-mailerlite-signup-forms-official-plugin-1-5-7-cross-site-request-forgery-csrf-vulnerability
CVE: CVE-2022-33714
Published: 2022-08-05
Description: Improper access control vulnerability in SemWifiApBroadcastReceiver prior to SMR Aug-2022 Release 1 allows attacker to reset a setting value related to mobile hotspot.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33715
Published: 2022-08-05
Description: Improper access control and path traversal vulnerability in LauncherProvider prior to SMR Aug-2022 Release 1 allow local attacker to access files of One UI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-22
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33716
Published: 2022-08-05
Description: An absence of variable initialization in ICCC TA prior to SMR Aug-2022 Release 1 allows local attacker to read uninitialized memory.
CVSS Score: 2.3 (LOW)
CWE: CWE-457, CWE-908
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33717
Published: 2022-08-05
Description: A missing input validation before memory read in SEM TA prior to SMR Aug-2022 Release 1 allows local attackers to read out of bound memory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33718
Published: 2022-08-05
Description: An improper access control vulnerability in Wi-Fi Service prior to SMR AUG-2022 Release 1 allows untrusted applications to manipulate the list of apps that can use mobile data.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-863
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33719
Published: 2022-08-05
Description: Improper input validation in baseband prior to SMR Aug-2022 Release 1 allows attackers to cause integer overflow to heap overflow.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-190
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33720
Published: 2022-08-05
Description: Improper authentication vulnerability in AppLock prior to SMR Aug-2022 Release 1 allows physical attacker to access Chrome locked by AppLock via new tap shortcut.
CVSS Score: 2.4 (LOW)
CWE: CWE-284, CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33721
Published: 2022-08-05
Description: A vulnerability using PendingIntent in DeX for PC prior to SMR Aug-2022 Release 1 allows attackers to access files with system privilege.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-94
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33722
Published: 2022-08-05
Description: Implicit Intent hijacking vulnerability in Smart View prior to SMR Aug-2022 Release 1 allows attacker to access connected device MAC address.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33723
Published: 2022-08-05
Description: A vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33724
Published: 2022-08-05
Description: Exposure of Sensitive Information in Samsung Dialer application?prior to SMR Aug-2022 Release 1 allows local attackers to access ICCID via log.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-319
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33725
Published: 2022-08-05
Description: A vulnerability using PendingIntent in Knox VPN prior to SMR Aug-2022 Release 1 allows attackers to access content providers with system privilege.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-94
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33726
Published: 2022-08-05
Description: Unprotected dynamic receiver in Samsung Galaxy Friends prior to SMR Aug-2022 Release 1 allows attacker to launch activity.
CVSS Score: 3.3 (LOW)
CWE: CWE-561
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33727
Published: 2022-08-05
Description: A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08