deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-38275
Published: 2022-09-09
Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/51; https://github.com/jflyfox/jfinal_cms/issues/51
CVE: CVE-2022-38276
Published: 2022-09-09
Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/51; https://github.com/jflyfox/jfinal_cms/issues/51
CVE: CVE-2022-38277
Published: 2022-09-09
Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/51; https://github.com/jflyfox/jfinal_cms/issues/51
CVE: CVE-2022-38278
Published: 2022-09-09
Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/51; https://github.com/jflyfox/jfinal_cms/issues/51
CVE: CVE-2022-38279
Published: 2022-09-09
Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/51; https://github.com/jflyfox/jfinal_cms/issues/51
CVE: CVE-2022-38280
Published: 2022-09-09
Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/51; https://github.com/jflyfox/jfinal_cms/issues/51
CVE: CVE-2022-38281
Published: 2022-09-09
Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/51; https://github.com/jflyfox/jfinal_cms/issues/51
CVE: CVE-2022-38282
Published: 2022-09-09
Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/52; https://github.com/jflyfox/jfinal_cms/issues/52
CVE: CVE-2022-38283
Published: 2022-09-09
Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/52; https://github.com/jflyfox/jfinal_cms/issues/52
CVE: CVE-2022-38284
Published: 2022-09-09
Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/52; https://github.com/jflyfox/jfinal_cms/issues/52
CVE: CVE-2022-38285
Published: 2022-09-09
Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/52; https://github.com/jflyfox/jfinal_cms/issues/52
CVE: CVE-2022-38286
Published: 2022-09-09
Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/52; https://github.com/jflyfox/jfinal_cms/issues/52
CVE: CVE-2022-26390
Published: 2022-09-09
Description: The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-311, CWE-312
References: https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx; https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01; https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx
CVE: CVE-2022-26392
Published: 2022-09-09
Description: The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information.
CVSS Score: 3.1 (LOW)
CWE: CWE-134, CWE-134
References: https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx; https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01; https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx
CVE: CVE-2022-26393
Published: 2022-09-09
Description: The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information or cause a Denial of Service (DoS) on the WBM.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-134, CWE-134
References: https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx; https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01; https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx
CVE: CVE-2022-26394
Published: 2022-09-09
Description: The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx; https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01; https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx
CVE: CVE-2022-2526
Published: 2022-09-09
Description: A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/systemd/systemd/commit/d973d94dec349fb676fdd844f6fe2ada3538f27c; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/systemd/systemd/commit/d973d94dec349fb676fdd844f6fe2ada3538f27c
CVE: CVE-2022-2905
Published: 2022-09-09
Description: An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=2121800; https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html; https://lore.kernel.org/bpf/984b37f9fdf7ac36831d2137415a4a915744c1b6[PII_REDACTED].git.daniel%40iogearbox.net/
CVE: CVE-2022-2964
Published: 2022-09-09
Description: A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=2067482; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=2067482
CVE: CVE-2022-35275
Published: 2022-09-09
Description: Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin <= 3.3.1 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woo-order-export-lite/wordpress-advanced-order-export-for-woocommerce-plugin-3-3-1-reflected-cross-site-scripting-xss-vulnerability/_s_id=cve; https://wordpress.org/plugins/woo-order-export-lite/; https://patchstack.com/database/vulnerability/woo-order-export-lite/wordpress-advanced-order-export-for-woocommerce-plugin-3-3-1-reflected-cross-site-scripting-xss-vulnerability/_s_id=cve
CVE: CVE-2022-35277
Published: 2022-09-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in GetResponse plugin <= 5.5.20 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/getresponse-integration/wordpress-getresponse-plugin-5-5-18-cross-site-request-forgery-csrf-vulnerability-leading-to-api-key-update/_s_id=cve; https://wordpress.org/plugins/getresponse-integration/; https://patchstack.com/database/vulnerability/getresponse-integration/wordpress-getresponse-plugin-5-5-18-cross-site-request-forgery-csrf-vulnerability-leading-to-api-key-update/_s_id=cve
CVE: CVE-2022-35725
Published: 2022-09-09
Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hans Matzen's wp-forecast plugin <= 7.5 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-forecast/wordpress-wp-forecast-plugin-7-5-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve; https://wordpress.org/plugins/wp-forecast/#developers; https://patchstack.com/database/vulnerability/wp-forecast/wordpress-wp-forecast-plugin-7-5-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve
CVE: CVE-2022-36280
Published: 2022-09-09
Description: An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://bugzilla.openanolis.cn/show_bug.cgi?id=2071; https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE: CVE-2022-36356
Published: 2022-09-09
Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy / Thirty8 Digital Culture Object plugin <= 4.0.1 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/culture-object/wordpress-culture-object-plugin-4-0-1-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve; https://wordpress.org/plugins/culture-object/#developers; https://patchstack.com/database/vulnerability/culture-object/wordpress-culture-object-plugin-4-0-1-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve
CVE: CVE-2022-36376
Published: 2022-09-09
Description: Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/seo-by-rank-math/wordpress-rank-math-seo-plugin-1-0-95-server-side-request-forgery-ssrf-vulnerability/_s_id=cve; https://rankmath.com/changelog/; https://patchstack.com/database/vulnerability/seo-by-rank-math/wordpress-rank-math-seo-plugin-1-0-95-server-side-request-forgery-ssrf-vulnerability/_s_id=cve
CVE: CVE-2022-36422
Published: 2022-09-09
Description: Rating increase/decrease via race condition in Lester 'GaMerZ' Chan WP-PostRatings plugin <= 1.89 at WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://patchstack.com/database/vulnerability/wp-postratings/wordpress-wp-postratings-plugin-1-89-rating-increase-decrease-via-race-condition-vulnerability/_s_id=cve; https://wordpress.org/plugins/wp-postratings/#developers; https://patchstack.com/database/vulnerability/wp-postratings/wordpress-wp-postratings-plugin-1-89-rating-increase-decrease-via-race-condition-vulnerability/_s_id=cve
CVE: CVE-2022-36423
Published: 2022-09-09
Description: OpenHarmony-v3.1.2 and prior versions have an incorrect configuration of the cJSON library, which leads a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.
CVSS Score: 7.4 (HIGH)
CWE: CWE-16, CWE-787
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md
CVE: CVE-2022-36793
Published: 2022-09-09
Description: Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin <= 3.9.6 at WordPress.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/wp-shop-original/wordpress-wp-shop-plugin-3-9-6-unauthenticated-plugin-settings-change-data-deletion-vulnerabilities/_s_id=cve; https://wordpress.org/plugins/wp-shop-original/; https://patchstack.com/database/vulnerability/wp-shop-original/wordpress-wp-shop-plugin-3-9-6-unauthenticated-plugin-settings-change-data-deletion-vulnerabilities/_s_id=cve
CVE: CVE-2022-36841
Published: 2022-09-09
Description: A heap-based overflow vulnerability in PrepareRecogLibrary_Part function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36842
Published: 2022-09-09
Description: A heap-based overflow vulnerability in prepareRecogLibrary function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36843
Published: 2022-09-09
Description: A heap-based overflow vulnerability in MHW_RECOG_LIB_INFO function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36844
Published: 2022-09-09
Description: A heap-based overflow vulnerability in HWR::EngJudgeModel::Construct() in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36845
Published: 2022-09-09
Description: A heap-based overflow vulnerability in MHW_RECOG_LIB_INFO function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36846
Published: 2022-09-09
Description: A heap-based overflow vulnerability in ConstructDictionary function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36847
Published: 2022-09-09
Description: Use after free vulnerability in mtp_send_signal function of MTP driver prior to SMR Sep-2022 Release 1 allows attackers to perform malicious actions.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36848
Published: 2022-09-09
Description: Improper Authorization vulnerability in setDualDARPolicyCmd prior to SMR Sep-2022 Release 1 allows local attackers to cause local permanent denial of service.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36849
Published: 2022-09-09
Description: Use after free vulnerability in sdp_mm_set_process_sensitive function of sdpmm driver prior to SMR Sep-2022 Release 1 allows attackers to perform malicious actions.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36850
Published: 2022-09-09
Description: Path traversal vulnerability in CallBGProvider prior to SMR Sep-2022 Release 1 allows attacker to overwrite arbitrary file with phone uid.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20, CWE-22
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36851
Published: 2022-09-09
Description: Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data of Samsung pass on a certain state of an unlocked device.
CVSS Score: 3.9 (LOW)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36852
Published: 2022-09-09
Description: Improper Authorization vulnerability in Video Editor prior to SMR Sep-2022 Release 1 allows local attacker to access internal application data.
CVSS Score: 1.9 (LOW)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36853
Published: 2022-09-09
Description: Intent redirection in Photo Editor prior to SMR Sep-2022 Release 1 allows attacker to get sensitive information.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36854
Published: 2022-09-09
Description: Out of bound read in libapexjni.media.samsung.so prior to SMR Sep-2022 Release 1 allows attacker access unauthorized information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20, CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36855
Published: 2022-09-09
Description: A use after free vulnerability in iva_ctl driver prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36856
Published: 2022-09-09
Description: Improper access control vulnerability in Telecom application prior to SMR Sep-2022 Release 1 allows attacker to start emergency calls via undefined permission.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36857
Published: 2022-09-09
Description: Improper Authorization vulnerability in Photo Editor prior to SMR Sep-2022 Release 1 allows physical attackers to read internal application data.
CVSS Score: 1.9 (LOW)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36858
Published: 2022-09-09
Description: A heap-based overflow vulnerability in GetCorrectDbLanguageTypeEsPKc() function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36859
Published: 2022-09-09
Description: Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victim&#39;s devices.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36860
Published: 2022-09-09
Description: A heap-based overflow vulnerability in LoadEnvironment function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36861
Published: 2022-09-09
Description: Custom permission misuse vulnerability in SystemUI prior to SMR Sep-2022 Release 1 allows attacker to use some protected functions with SystemUI privilege.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36862
Published: 2022-09-09
Description: A heap-based overflow vulnerability in HWR::EngineCJK::Impl::Construct() in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36863
Published: 2022-09-09
Description: A heap-based overflow vulnerability in GetCorrectDbLanguageTypeEsPKc function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CVE: CVE-2022-36864
Published: 2022-09-09
Description: Improper access control and intent redirection in Samsung Email prior to 6.1.70.20 allows attacker to access specific formatted file and execute privileged behavior.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36865
Published: 2022-09-09
Description: Improper access control in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows attackers to access device information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36866
Published: 2022-09-09
Description: Improper access control vulnerability in Broadcaster in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows attackers to identify the device.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36867
Published: 2022-09-09
Description: Improper access control vulnerability in Editor Lite prior to version 4.0.40.14 allows attackers to access sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09