deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-34546
Published: 2021-06-10
Description: An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the Windows logon screen enabled, is able to drop to an administrative shell and execute arbitrary commands as SYSTEM via the "save log to file" feature. To accomplish this, the attacker can navigate to cmd.exe.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://packetstormsecurity.com/files/163097/NetSetManPro-4.7.2-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2021/Jun/17; https://www.netsetman.com
CVE: CVE-2021-34557
Published: 2021-06-10
Description: XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-120
References: http://www.openwall.com/lists/oss-security/2021/06/11/1; http://www.openwall.com/lists/oss-security/2021/07/06/2; https://github.com/QubesOS/qubes-issues/issues/6595
CVE: CVE-2021-20329
Published: 2021-06-10
Description: Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1287, CWE-20
References: https://github.com/mongodb/mongo-go-driver/releases/tag/v1.5.1; https://github.com/mongodb/mongo-go-driver/releases/tag/v1.5.1
CVE: CVE-2021-31839
Published: 2021-06-10
Description: Improper privilege management vulnerability in McAfee Agent for Windows prior to 5.7.3 allows a local user to modify event information in the MA event folder. This allows a local user to either add false events or remove events from the event logs prior to them being sent to the ePO server.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10362; https://kc.mcafee.com/corporate/index?page=content&id=SB10362
CVE: CVE-2021-31840
Published: 2021-06-10
Description: A vulnerability in the preloading mechanism of specific dynamic link libraries in McAfee Agent for Windows prior to 5.7.3 could allow an authenticated, local attacker to perform a DLL preloading attack with unsigned DLLs. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. This would result in the user gaining elevated permissions and being able to execute arbitrary code.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10362; https://kc.mcafee.com/corporate/index?page=content&id=SB10362
CVE: CVE-2020-23302
Published: 2021-06-10
Description: There is a heap-use-after-free at ecma-helpers-string.c:772 in ecma_ref_ecma_string in JerryScript 2.2.0
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/jerryscript-project/jerryscript/issues/3748; https://github.com/jerryscript-project/jerryscript/issues/3748
CVE: CVE-2020-23303
Published: 2021-06-10
Description: There is a heap-buffer-overflow at jmem-poolman.c:165 in jmem_pools_collect_empty in JerryScript 2.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/jerryscript-project/jerryscript/issues/3749; https://github.com/jerryscript-project/jerryscript/issues/3749
CVE: CVE-2020-23306
Published: 2021-06-10
Description: There is a stack-overflow at ecma-regexp-object.c:535 in ecma_regexp_match in JerryScript 2.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/jerryscript-project/jerryscript/issues/3753; https://github.com/jerryscript-project/jerryscript/issues/3753
CVE: CVE-2020-23308
Published: 2021-06-10
Description: There is an Assertion 'context_p->stack_top_uint8 == LEXER_EXPRESSION_START' at js-parser-expr.c:3565 in parser_parse_expression in JerryScript 2.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/3819; https://github.com/jerryscript-project/jerryscript/issues/3819
CVE: CVE-2020-23309
Published: 2021-06-10
Description: There is an Assertion 'context_p->stack_depth == context_p->context_stack_depth' failed at js-parser-statm.c:2756 in parser_parse_statements in JerryScript 2.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/3820; https://github.com/jerryscript-project/jerryscript/issues/3820
CVE: CVE-2020-23310
Published: 2021-06-10
Description: There is an Assertion 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at js-parser-statm.c:733 in parser_parse_function_statement in JerryScript 2.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/3821; https://github.com/jerryscript-project/jerryscript/issues/3821
CVE: CVE-2020-23311
Published: 2021-06-10
Description: There is an Assertion 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER_COMMA' failed at js-parser-expr.c:3230 in parser_parse_object_initializer in JerryScript 2.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/3822; https://github.com/jerryscript-project/jerryscript/issues/3822
CVE: CVE-2020-23312
Published: 2021-06-10
Description: There is an Assertion 'context.status_flags & PARSER_SCANNING_SUCCESSFUL' failed at js-parser.c:2185 in parser_parse_source in JerryScript 2.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/3824; https://github.com/jerryscript-project/jerryscript/issues/3824
CVE: CVE-2020-23313
Published: 2021-06-10
Description: There is an Assertion 'scope_stack_p > context_p->scope_stack_p' failed at js-scanner-util.c:2510 in scanner_literal_is_created in JerryScript 2.2.0
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/3823; https://github.com/jerryscript-project/jerryscript/issues/3823
CVE: CVE-2020-23314
Published: 2021-06-10
Description: There is an Assertion 'block_found' failed at js-parser-statm.c:2003 parser_parse_try_statement_end in JerryScript 2.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/3825; https://github.com/jerryscript-project/jerryscript/issues/3825
CVE: CVE-2020-23319
Published: 2021-06-10
Description: There is an Assertion in '(flags >> CBC_STACK_ADJUST_SHIFT) >= CBC_STACK_ADJUST_BASE || (CBC_STACK_ADJUST_BASE - (flags >> CBC_STACK_ADJUST_SHIFT)) <= context_p->stack_depth' in parser_emit_cbc_backward_branch in JerryScript 2.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/3834; https://github.com/jerryscript-project/jerryscript/issues/3834
CVE: CVE-2020-23320
Published: 2021-06-10
Description: There is an Assertion in 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' in parser_parse_function_arguments in JerryScript 2.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/3835; https://github.com/jerryscript-project/jerryscript/issues/3835
CVE: CVE-2020-23321
Published: 2021-06-10
Description: There is a heap-buffer-overflow at lit-strings.c:431 in lit_read_code_unit_from_utf8 in JerryScript 2.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/jerryscript-project/jerryscript/issues/3870; https://github.com/jerryscript-project/jerryscript/issues/3870
CVE: CVE-2020-23322
Published: 2021-06-10
Description: There is an Assertion in 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER_COMMA' in parser_parse_object_initializer in JerryScript 2.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/3869; https://github.com/jerryscript-project/jerryscript/issues/3869
CVE: CVE-2020-23323
Published: 2021-06-10
Description: There is a heap-buffer-overflow at re-parser.c in re_parse_char_escape in JerryScript 2.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/jerryscript-project/jerryscript/issues/3871; https://github.com/jerryscript-project/jerryscript/issues/3871
CVE: CVE-2021-26194
Published: 2021-06-10
Description: An issue was discovered in JerryScript 2.4.0. There is a heap-use-after-free in ecma_is_lexical_environment in the ecma-helpers.c file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/jerryscript-project/jerryscript/issues/4445; https://github.com/jerryscript-project/jerryscript/issues/4445
CVE: CVE-2021-26195
Published: 2021-06-10
Description: An issue was discovered in JerryScript 2.4.0. There is a heap-buffer-overflow in lexer_parse_number in js-lexer.c file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/jerryscript-project/jerryscript/issues/4442; https://github.com/jerryscript-project/jerryscript/issues/4442
CVE: CVE-2021-26197
Published: 2021-06-10
Description: An issue was discovered in JerryScript 2.4.0. There is a SEGV in main_print_unhandled_exception in main-utils.c file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754
References: https://github.com/jerryscript-project/jerryscript/issues/4403; https://github.com/jerryscript-project/jerryscript/issues/4403
CVE: CVE-2021-26198
Published: 2021-06-10
Description: An issue was discovered in JerryScript 2.4.0. There is a SEVG in ecma_deref_bigint in ecma-helpers.c file.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/jerryscript-project/jerryscript/issues/4402; https://github.com/jerryscript-project/jerryscript/issues/4402
CVE: CVE-2021-26199
Published: 2021-06-10
Description: An issue was discovered in JerryScript 2.4.0. There is a heap-use-after-free in ecma_bytecode_ref in ecma-helpers.c file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/jerryscript-project/jerryscript/issues/4056; https://github.com/jerryscript-project/jerryscript/issues/4056
CVE: CVE-2021-23393
Published: 2021-06-11
Description: This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://github.com/briancappello/flask-unchained/commit/71e36b28166f9ffbe0a991f51127f0984f7e6a40; https://snyk.io/vuln/SNYK-PYTHON-FLASKUNCHAINED-1293189; https://github.com/briancappello/flask-unchained/commit/71e36b28166f9ffbe0a991f51127f0984f7e6a40
CVE: CVE-2021-25682
Published: 2021-06-11
Description: It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-74
References: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1912326; https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1912326
CVE: CVE-2021-25683
Published: 2021-06-11
Description: It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1912326; https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1912326
CVE: CVE-2021-25684
Published: 2021-06-11
Description: It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1912326; http://seclists.org/fulldisclosure/2025/Jun/9; https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1912326
CVE: CVE-2021-24035
Published: 2021-06-11
Description: A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-23, CWE-22
References: https://www.whatsapp.com/security/advisories/2021/; https://www.whatsapp.com/security/advisories/2021/
CVE: CVE-2021-28801
Published: 2021-06-11
Description: An out-of-bounds read vulnerability has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read sensitive information on the system. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.2 build 20210122 on QSW-M2108-2C; versions prior to 1.0.2 build 20210122 on QSW-M2108-2S; versions prior to 1.0.2 build 20210122 on QSW-M2108R-2C.
CVSS Score: 3.1 (LOW)
CWE: CWE-125
References: https://www.qnap.com/zh-tw/security-advisory/qsa-21-23; https://www.qnap.com/zh-tw/security-advisory/qsa-21-23
CVE: CVE-2021-28805
Published: 2021-06-11
Description: Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408.
CVSS Score: 7.8 (HIGH)
CWE: CWE-540, CWE-200
References: https://www.qnap.com/zh-tw/security-advisory/qsa-21-24; https://www.qnap.com/zh-tw/security-advisory/qsa-21-24
CVE: CVE-2021-28814
Published: 2021-06-11
Description: An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the security of the software. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.qnap.com/zh-tw/security-advisory/qsa-21-25; https://www.qnap.com/zh-tw/security-advisory/qsa-21-25
CVE: CVE-2021-26828
Published: 2021-06-11
Description: OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4; http://packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.html; https://youtu.be/k1teIStQr1A
CVE: CVE-2021-26829
Published: 2021-06-11
Description: OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4; https://youtu.be/Xh6LPCiLMa8; http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4
CVE: CVE-2021-33205
Published: 2021-06-11
Description: Western Digital EdgeRover before 0.25 has an escalation of privileges vulnerability where a low privileged user could load malicious content into directories with higher privileges, because of how Node.js is used. An attacker can gain admin privileges and carry out malicious activities such as creating a fake library and stealing user credentials.
CVSS Score: 8.8 (HIGH)
References: https://www.westerndigital.com/support/productsecurity/wdc-21007-edgerover-windows-app-ver-0-25; https://www.westerndigital.com/support/productsecurity/wdc-21007-edgerover-windows-app-ver-0-25
CVE: CVE-2021-34540
Published: 2021-06-11
Description: Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ethancsyang/CveProject/tree/main/CVE-2021-34540; https://www.advantech.com/support; https://github.com/ethancsyang/CveProject/tree/main/CVE-2021-34540
CVE: CVE-2021-3013
Published: 2021-06-11
Description: ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/BurntSushi/ripgrep/blob/e48a17e1891e1ea9dd06ba0e48d5fb140ca7c0c4/CHANGELOG.md; https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md; https://github.com/BurntSushi/ripgrep/blob/e48a17e1891e1ea9dd06ba0e48d5fb140ca7c0c4/CHANGELOG.md
CVE: CVE-2021-26997
Published: 2021-06-11
Description: E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover information via error messaging which may aid in crafting more complex attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2021-26993
Published: 2021-06-11
Description: E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to cause a partial Denial of Service (DoS) to the web server.
CVSS Score: 5.3 (MEDIUM)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2021-26995
Published: 2021-06-11
Description: E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow privileged attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2021-26996
Published: 2021-06-11
Description: E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover system configuration and application information which may aid in crafting more complex attacks.
CVSS Score: 7.5 (HIGH)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2020-13688
Published: 2021-06-11
Description: Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-core-2020-009; https://www.drupal.org/sa-core-2020-009
CVE: CVE-2020-5003
Published: 2021-06-11
Description: IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192956.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192956; https://www.ibm.com/support/pages/node/6462861; https://exchange.xforce.ibmcloud.com/vulnerabilities/192956
CVE: CVE-2021-20396
Published: 2021-06-11
Description: IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 196009.
CVSS Score: 3.3 (LOW)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196009; https://www.ibm.com/support/pages/node/6462585; https://exchange.xforce.ibmcloud.com/vulnerabilities/196009
CVE: CVE-2021-25383
Published: 2021-06-11
Description: An improper input validation vulnerability in scmn_mfal_read() in libsapeextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-122, CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5
CVE: CVE-2021-25384
Published: 2021-06-11
Description: An improper input validation vulnerability in sdfffd_parse_chunk_PROP() with Sample Rate Chunk in libsdffextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5
CVE: CVE-2021-25385
Published: 2021-06-11
Description: An improper input validation vulnerability in sdfffd_parse_chunk_PROP() in libsdffextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-121, CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5
CVE: CVE-2021-25386
Published: 2021-06-11
Description: An improper input validation vulnerability in sdfffd_parse_chunk_FVER() in libsdffextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-121, CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5
CVE: CVE-2021-25387
Published: 2021-06-11
Description: An improper input validation vulnerability in sflacfd_get_frm() in libsflacextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-122, CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5
CVE: CVE-2021-25388
Published: 2021-06-11
Description: Improper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app.
CVSS Score: 7.1 (HIGH)
CWE: CWE-926, CWE-354
References: https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/
CVE: CVE-2021-25389
Published: 2021-06-11
Description: Improper running task check in S Secure prior to SMR MAY-2021 Release 1 allows attackers to use locked app without authentication.
CVSS Score: 2.3 (LOW)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5
CVE: CVE-2021-25390
Published: 2021-06-11
Description: Intent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-926
References: https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/
CVE: CVE-2021-25391
Published: 2021-06-11
Description: Intent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-926
References: https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/