deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-12930
Published: 2022-11-09
Description: Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity.
CVSS Score: 7.8 (HIGH)
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-5001; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029
CVE: CVE-2020-12931
Published: 2022-11-09
Description: Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity.
CVSS Score: 7.8 (HIGH)
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-5001; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029
CVE: CVE-2021-26360
Published: 2022-11-09
Description: An attacker with local access to the system can make unauthorized modifications of the security configuration of the SOC registers. This could allow potential corruption of AMD secure processor’s encrypted memory contents which may lead to arbitrary code execution in ASP.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029
CVE: CVE-2021-26391
Published: 2022-11-09
Description: Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gain code execution in that TA or the OS/kernel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-347
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029
CVE: CVE-2021-26392
Published: 2022-11-09
Description: Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the OS/kernel by loading a malicious TA.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-5001; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029
CVE: CVE-2021-26393
Published: 2022-11-09
Description: Insufficient memory cleanup in the AMD Secure Processor (ASP) Trusted Execution Environment (TEE) may allow an authenticated attacker with privileges to generate a valid signed TA and potentially poison the contents of the process memory with attacker controlled data resulting in a loss of confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-5001; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029
CVE: CVE-2021-46851
Published: 2022-11-09
Description: The DRM module has a vulnerability in verifying the secure memory attributes. Successful exploitation of this vulnerability may cause abnormal video playback.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2021-46852
Published: 2022-11-09
Description: The memory management module has the logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-23824
Published: 2022-11-09
Description: IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure.
CVSS Score: 5.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/11/10/2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTQMPJC5N6XJYQ232OZFLK47HVZNRBY3/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
CVE: CVE-2022-23831
Published: 2022-11-09
Description: Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential Windows kernel crash resulting in denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1046; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1046
CVE: CVE-2022-27673
Published: 2022-11-09
Description: Insufficient access controls in the AMD Link Android app may potentially result in information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1047; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1047
CVE: CVE-2022-27674
Published: 2022-11-09
Description: Insufficient validation in the IOCTL input/output buffer in AMD μProf may allow an attacker to bypass bounds checks potentially leading to a Windows kernel crash resulting in denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1046; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1046
CVE: CVE-2022-29836
Published: 2022-11-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digital My Cloud Home; My Cloud Home Duo; and SanDisk ibi devices that could allow an attacker to abuse certain parameters to point to random locations on the file system. This could also allow the attacker to initiate the installation of custom packages at these locations. This can only be exploited once the attacker has been authenticated to the device. This issue affects: Western Digital My Cloud Home and My Cloud Home Duo versions prior to 8.11.0-113 on Linux; SanDisk ibi versions prior to 8.11.0-113 on Linux.
CVSS Score: 1.9 (LOW)
CWE: CWE-22, CWE-22
References: https://www.westerndigital.com/support/product-security/wdc-22016-my-cloud-home-ibi-firmware-version-8-11-0-113; https://www.westerndigital.com/support/product-security/wdc-22016-my-cloud-home-ibi-firmware-version-8-11-0-113
CVE: CVE-2022-31685
Published: 2022-11-09
Description: VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.vmware.com/security/advisories/VMSA-2022-0028.html; https://www.vmware.com/security/advisories/VMSA-2022-0028.html
CVE: CVE-2022-31686
Published: 2022-11-09
Description: VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.vmware.com/security/advisories/VMSA-2022-0028.html; https://www.vmware.com/security/advisories/VMSA-2022-0028.html
CVE: CVE-2022-31687
Published: 2022-11-09
Description: VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://www.vmware.com/security/advisories/VMSA-2022-0028.html; https://www.vmware.com/security/advisories/VMSA-2022-0028.html
CVE: CVE-2022-31688
Published: 2022-11-09
Description: VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.vmware.com/security/advisories/VMSA-2022-0028.html; https://www.vmware.com/security/advisories/VMSA-2022-0028.html
CVE: CVE-2022-31689
Published: 2022-11-09
Description: VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384, CWE-384
References: https://www.vmware.com/security/advisories/VMSA-2022-0028.html; https://www.vmware.com/security/advisories/VMSA-2022-0028.html
CVE: CVE-2022-43031
Published: 2022-11-09
Description: DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator accounts and modify Admin passwords.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://gist.github.com/cai-niao98/77a7aa934492c2d651b37b75243eda0b; https://github.com/cai-niao98/Dedecmsv6; https://gist.github.com/cai-niao98/77a7aa934492c2d651b37b75243eda0b
CVE: CVE-2022-43058
Published: 2022-11-09
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms//classes/Master.php?f=delete_activity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/ctg503/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-1.md; https://github.com/ctg503/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-1.md
CVE: CVE-2022-43310
Published: 2022-11-09
Description: An Uncontrolled Search Path Element in Foxit Software released Foxit Reader v11.2.118.51569 allows attackers to escalate privileges when searching for DLL libraries without specifying an absolute path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://github.com/hxxt9049/futing; https://www.foxitsoftware.cn/support/security-bulletins.html; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2022-44546
Published: 2022-11-09
Description: The kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation of this vulnerability may cause a system restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-459
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44547
Published: 2022-11-09
Description: The Display Service module has a UAF vulnerability. Successful exploitation of this vulnerability may affect the display service availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44548
Published: 2022-11-09
Description: There is a vulnerability in permission verification during the Bluetooth pairing process. Successful exploitation of this vulnerability may cause the dialog box for confirming the pairing not to be displayed during Bluetooth pairing.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44549
Published: 2022-11-09
Description: The LBS module has a vulnerability in geofencing API access. Successful exploitation of this vulnerability may cause third-party apps to access the geofencing APIs without authorization, affecting user confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44550
Published: 2022-11-09
Description: The graphics display module has a UAF vulnerability when traversing graphic layers. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44551
Published: 2022-11-09
Description: The iaware module has a vulnerability in thread security. Successful exploitation of this vulnerability will affect confidentiality, integrity, and availability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44552
Published: 2022-11-09
Description: The lock screen module has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44553
Published: 2022-11-09
Description: The HiView module has a vulnerability of not filtering third-party apps out when the HiView module traverses to invoke the system provider. Successful exploitation of this vulnerability may cause third-party apps to start periodically.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44554
Published: 2022-11-09
Description: The power module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause abnormal status of a module on the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44555
Published: 2022-11-09
Description: The DDMP/ODMF module has a service hijacking vulnerability. Successful exploit of this vulnerability may cause services to be unavailable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-294
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44557
Published: 2022-11-09
Description: The SmartTrimProcessEvent module has a vulnerability of obtaining the read and write permissions on arbitrary system files. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44558
Published: 2022-11-09
Description: The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44559
Published: 2022-11-09
Description: The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44560
Published: 2022-11-09
Description: The launcher module has an Intent redirection vulnerability. Successful exploitation of this vulnerability may cause launcher module data to be modified.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-601
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44561
Published: 2022-11-09
Description: The preset launcher module has a permission verification vulnerability. Successful exploitation of this vulnerability makes unauthorized apps add arbitrary widgets and shortcuts without interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44562
Published: 2022-11-09
Description: The system framework layer has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-44563
Published: 2022-11-09
Description: There is a race condition vulnerability in SD upgrade mode. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-37966
Published: 2022-11-09
Description: Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37966; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37966; https://security.gentoo.org/glsa/202309-06
CVE: CVE-2022-37967
Published: 2022-11-09
Description: Windows Kerberos Elevation of Privilege Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967; https://security.gentoo.org/glsa/202309-06
CVE: CVE-2022-37992
Published: 2022-11-09
Description: Windows Group Policy Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37992; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37992
CVE: CVE-2022-38014
Published: 2022-11-09
Description: Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38014; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38014
CVE: CVE-2022-38015
Published: 2022-11-09
Description: Windows Hyper-V Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38015; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38015
CVE: CVE-2022-38023
Published: 2022-11-09
Description: Netlogon RPC Elevation of Privilege Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38023; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38023; https://security.gentoo.org/glsa/202309-06
CVE: CVE-2022-39306
Published: 2022-11-09
Description: Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows users to sign up with whatever username/email address the user chooses and become a member of the organization. This introduces a vulnerability which can be used with malicious intent. This issue is patched in version 9.2.4, and has been backported to 8.5.15. There are no known workarounds.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84
CVE: CVE-2022-39879
Published: 2022-11-09
Description: Improper authorization vulnerability in?CallBGProvider prior to SMR Nov-2022 Release 1 allows local attacker to grant permission for accessing information with phone uid.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=11
CVE: CVE-2022-39880
Published: 2022-11-09
Description: Improper input validation vulnerability in DualOutFocusViewer prior to SMR Nov-2022 Release 1 allows local attacker to perform an arbitrary code execution.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=11
CVE: CVE-2022-39881
Published: 2022-11-09
Description: Improper input validation vulnerability for processing SIB12 PDU in Exynos modems prior to SMR Sep-2022 Release allows remote attacker to read out of bounds memory.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=11
CVE: CVE-2022-39882
Published: 2022-11-09
Description: Heap overflow vulnerability in sflacf_fal_bytes_peek function in libsmat.so library prior to SMR Nov-2022 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 8.0 (HIGH)
CWE: CWE-787, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=11
CVE: CVE-2022-39883
Published: 2022-11-09
Description: Improper authorization vulnerability in StorageManagerService prior to SMR Nov-2022 Release 1 allows local attacker to call privileged API.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=11