deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-2928
Published: 2022-10-07
Description: In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://kb.isc.org/docs/cve-2022-2928; https://lists.debian.org/debian-lts-announce/2022/10/msg00015.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SARIK7KZ7MGQIWDRWZFAOSQSPXY4GOU/
CVE: CVE-2022-2929
Published: 2022-10-07
Description: In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://kb.isc.org/docs/cve-2022-2929; https://lists.debian.org/debian-lts-announce/2022/10/msg00015.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SARIK7KZ7MGQIWDRWZFAOSQSPXY4GOU/
CVE: CVE-2022-3414
Published: 2022-10-07
Description: A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. Affected is an unknown function of the file /Admin/login.php of the component POST Parameter Handler. The manipulation of the argument txtusername leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-210246 is the identifier assigned to this vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-707
References: https://vuldb.com/?id.210246; https://www.jianshu.com/p/8f7b7b532c02; https://vuldb.com/?id.210246
CVE: CVE-2022-41672
Published: 2022-10-07
Description: In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.
CVSS Score: 8.1 (HIGH)
CWE: CWE-613, CWE-613
References: https://github.com/apache/airflow/pull/26635; https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y; https://github.com/apache/airflow/pull/26635
CVE: CVE-2022-3422
Published: 2022-10-07
Description: Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://github.com/tooljet/tooljet/commit/7879d8a76000c014533a97a22bc276afe3ae3e54; https://huntr.dev/bounties/02da53ab-f613-4171-8766-96b31c671551; https://github.com/tooljet/tooljet/commit/7879d8a76000c014533a97a22bc276afe3ae3e54
CVE: CVE-2022-3423
Published: 2022-10-07
Description: Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.
CVSS Score: 7.3 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/nocodb/nocodb/commit/000ecd886738b965b5997cd905825e3244f48b95; https://huntr.dev/bounties/94639d8e-8301-4432-ab80-e76e1346e631; https://github.com/nocodb/nocodb/commit/000ecd886738b965b5997cd905825e3244f48b95
CVE: CVE-2022-40824
Published: 2022-10-07
Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md; https://github.com/bcit-ci/CodeIgniter/issues/6161; https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CVE: CVE-2022-40825
Published: 2022-10-07
Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md; https://github.com/bcit-ci/CodeIgniter/issues/6161; https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CVE: CVE-2022-40826
Published: 2022-10-07
Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md; https://github.com/bcit-ci/CodeIgniter/issues/6161; https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CVE: CVE-2022-40827
Published: 2022-10-07
Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md; https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CVE: CVE-2022-40828
Published: 2022-10-07
Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md; https://github.com/bcit-ci/CodeIgniter/issues/6161; https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CVE: CVE-2022-40829
Published: 2022-10-07
Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md; https://github.com/bcit-ci/CodeIgniter/issues/6161; https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CVE: CVE-2022-40830
Published: 2022-10-07
Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md; https://github.com/bcit-ci/CodeIgniter/issues/6161; https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CVE: CVE-2022-40831
Published: 2022-10-07
Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md; https://github.com/bcit-ci/CodeIgniter/issues/6161; https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CVE: CVE-2022-40832
Published: 2022-10-07
Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md; https://github.com/bcit-ci/CodeIgniter/issues/6161; https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CVE: CVE-2022-40833
Published: 2022-10-07
Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md; https://github.com/bcit-ci/CodeIgniter/issues/6161; https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CVE: CVE-2022-40834
Published: 2022-10-07
Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md; https://github.com/bcit-ci/CodeIgniter/issues/6161; https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CVE: CVE-2022-40835
Published: 2022-10-07
Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have disputed this as not a valid vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md; https://github.com/bcit-ci/CodeIgniter/issues/6161; https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CVE: CVE-2022-40872
Published: 2022-10-07
Description: An SQL injection vulnerability issue was discovered in Sourcecodester Simple E-Learning System 1.0., in /vcs/classRoom.php?classCode=, classCode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/xtxxueyan/bug_report/blob/main/vendors/onetnom23/Simple%20E-Learning%20System/SQLi-1.md; https://github.com/xtxxueyan/bug_report/blob/main/vendors/onetnom23/Simple%20E-Learning%20System/SQLi-1.md; https://www.sourcecodester.com/php-simple-e-learning-system-source-code
CVE: CVE-2022-33896
Published: 2022-10-07
Description: A buffer underflow vulnerability exists in the way Hword of Hancom Office 2020 version 11.0.0.5357 parses XML-based office files. A specially-crafted malformed file can cause memory corruption by using memory before buffer start, which can lead to code execution. A victim would need to access a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-124
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1574; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1574
CVE: CVE-2022-36868
Published: 2022-10-07
Description: Improper restriction of broadcasting Intent in MouseNKeyHidDevice prior to SMR Oct-2022 Release 1 leaks MAC address of the connected Bluetooth device.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE: CVE-2022-39847
Published: 2022-10-07
Description: Use after free vulnerability in set_nft_pid and signal_handler function of NFC driver prior to SMR Oct-2022 Release 1 allows attackers to perform malicious actions.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE: CVE-2022-39848
Published: 2022-10-07
Description: Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-213, CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE: CVE-2022-39849
Published: 2022-10-07
Description: Improper access control in knox_vpn_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data.
CVSS Score: 3.3 (LOW)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE: CVE-2022-39850
Published: 2022-10-07
Description: Improper access control in mum_container_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data.
CVSS Score: 3.3 (LOW)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE: CVE-2022-39851
Published: 2022-10-07
Description: Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bind service that require BIND_REMOTEVIEWS permission.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE: CVE-2022-39852
Published: 2022-10-07
Description: A heap-based overflow vulnerability in makeContactAGIF in libagifencoder.quram.so library prior to SMR Oct-2022 Release 1 allows attacker to perform code execution.
CVSS Score: 8.0 (HIGH)
CWE: CWE-122, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE: CVE-2022-39853
Published: 2022-10-07
Description: A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory access fault.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE: CVE-2022-39854
Published: 2022-10-07
Description: Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE: CVE-2022-39855
Published: 2022-10-07
Description: Improper access control vulnerability in FACM application prior to SMR Oct-2022 Release 1 allows a local attacker to connect arbitrary AP and Bluetooth devices.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE: CVE-2022-39856
Published: 2022-10-07
Description: Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers to access call information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=10
CVE: CVE-2022-39857
Published: 2022-10-07
Description: Improper access control vulnerability in CameraTestActivity in FactoryCameraFB prior to version 3.5.51 allows attackers to access broadcasting Intent as system uid privilege.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39858
Published: 2022-10-07
Description: Path traversal vulnerability in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to write arbitrary file as FactoryCamera privilege.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22, CWE-22
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39859
Published: 2022-10-07
Description: Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via implicit intent.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39860
Published: 2022-10-07
Description: Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive information via implicit broadcast.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39861
Published: 2022-10-07
Description: Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without camera privilege.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39862
Published: 2022-10-07
Description: Improper authorization in Dynamic Lockscreen prior to SMR Sep-2022 Release 1 in Android R(11) and 3.3.03.66 in Android S(12) allows unauthorized use of javascript interface api.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39863
Published: 2022-10-07
Description: Intent redirection vulnerability in Samsung Account prior to version 13.5.01.3 allows attackers to access content providers without permission.
CVSS Score: 3.6 (LOW)
CWE: CWE-20
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39864
Published: 2022-10-07
Description: Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via implicit intent.
CVSS Score: 3.3 (LOW)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39865
Published: 2022-10-07
Description: Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39866
Published: 2022-10-07
Description: Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39867
Published: 2022-10-07
Description: Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via SHOW_PERSISTENT_BANNER broadcast.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39868
Published: 2022-10-07
Description: Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39869
Published: 2022-10-07
Description: Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via REMOVE_PERSISTENT_BANNER broadcast.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284, CWE-668
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39870
Published: 2022-10-07
Description: Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via PUSH_MESSAGE_RECEIVED broadcast.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284, CWE-668
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39871
Published: 2022-10-07
Description: Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcasts.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284, CWE-668
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39872
Published: 2022-10-07
Description: Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-280, CWE-755
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39873
Published: 2022-10-07
Description: Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret mode without user authentication.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39874
Published: 2022-10-07
Description: Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-779, CWE-532
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39875
Published: 2022-10-07
Description: Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39876
Published: 2022-10-07
Description: Insertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to access device IMEI.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-39877
Published: 2022-10-07
Description: Improper access control vulnerability in ProfileSharingAccount in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows attackers to identify the device.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10