deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-0758
Published: 2023-02-09
Description: A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220469 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/skisw/Vul/blob/main/vuloa; https://vuldb.com/?ctiid.220469; https://vuldb.com/?id.220469
CVE: CVE-2023-0759
Published: 2023-02-09
Description: Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-268
References: https://github.com/cockpit-hq/cockpit/commit/78d6ed3bf093ee11356ba66320c628c727068714; https://huntr.dev/bounties/49e2cccc-bb56-4633-ba6a-b3803e251347; https://github.com/cockpit-hq/cockpit/commit/78d6ed3bf093ee11356ba66320c628c727068714
CVE: CVE-2023-0760
Published: 2023-02-09
Description: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to V2.1.0-DEV.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/gpac/gpac/commit/ea7395f39f601a7750d48d606e9d10ea0b7beefe; https://huntr.dev/bounties/d06223df-a473-4c82-96d0-23726b844b21; https://www.debian.org/security/2023/dsa-5452
CVE: CVE-2023-0574
Published: 2023-02-09
Description: Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0.0.0 through 2.13.0.0


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-307, CWE-915, CWE-918
References: https://www.yugabyte.com/; https://www.yugabyte.com/
CVE: CVE-2023-22953
Published: 2023-02-09
Description: In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.
CVSS Score: 8.8 (HIGH)
References: https://docs.expressionengine.com/latest/installation/changelog.html; https://gist.github.com/ahmedsherif/7b8f18a54a80ae0ac5ff6307c35b7d43; https://hackerone.com/reports/1820492
CVE: CVE-2023-0624
Published: 2023-02-09
Description: OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/oberhofer/; https://github.com/Orangescrum/orangescrum/; https://fluidattacks.com/advisories/oberhofer/
CVE: CVE-2021-41064
Published: 2023-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-42792
Published: 2023-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-42793
Published: 2023-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2022-30564
Published: 2023-02-09
Description: Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a specially crafted packet to the vulnerable interface, an attacker can modify the device system time.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://www.dahuasecurity.com/support/cybersecurity/details/1147; https://www.dahuasecurity.com/support/cybersecurity/details/1147
CVE: CVE-2022-48286
Published: 2023-02-09
Description: The multi-screen collaboration module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48287
Published: 2023-02-09
Description: The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-693
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48288
Published: 2023-02-09
Description: The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48289
Published: 2023-02-09
Description: The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48290
Published: 2023-02-09
Description: The phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiality and integrity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-693
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48292
Published: 2023-02-09
Description: The Bluetooth module has an out-of-memory (OOM) vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48293
Published: 2023-02-09
Description: The Bluetooth module has an OOM vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48294
Published: 2023-02-09
Description: The IHwAttestationService interface has a defect in authentication. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48295
Published: 2023-02-09
Description: The IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this vulnerability can lead to filling problems (batch installation of applications).
CVSS Score: 7.5 (HIGH)
CWE: CWE-281, CWE-281
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48296
Published: 2023-02-09
Description: The SystemUI has a vulnerability in permission management. Successful exploitation of this vulnerability may cause users to receive broadcasts from malicious apps, conveying false alarm information about external storage devices.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-281, CWE-281
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48297
Published: 2023-02-09
Description: The geofencing kernel code has a vulnerability of not verifying the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284, CWE-1284
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48298
Published: 2023-02-09
Description: The geofencing kernel code does not verify the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284, CWE-1284
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48299
Published: 2023-02-09
Description: The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48300
Published: 2023-02-09
Description: The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48301
Published: 2023-02-09
Description: The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-installed apps that have been uninstalled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281, CWE-281
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2022-48302
Published: 2023-02-09
Description: The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://consumer.huawei.com/en/support/bulletin/2023/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE: CVE-2023-0575
Published: 2023-02-09
Description: External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (DevopsBase.Java:execCommand, TableManager.Java:runCommand modules) allows API Manipulation, Privilege Abuse. This vulnerability is associated with program files backup.Py.

This issue affects Yugabyte DB: Lesser then 2.2.0.0


CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-642
References: https://www.yugabyte.com/; https://www.yugabyte.com/
CVE: CVE-2023-0745
Published: 2023-02-09
Description: 
	
		
		
	
	
		
			
				
					The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary
files through the backup upload endpoint by using path traversal characters.



				


			


		


	
 This vulnerability is associated with program files PlatformReplicationManager.Java.

This issue affects YugabyteDB Anywhere: from 2.0.0.0 through 2.13.0.0


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://www.yugabyte.com/; https://www.yugabyte.com/
CVE: CVE-2023-22603
Published: 2023-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-22604
Published: 2023-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-22605
Published: 2023-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2023-22606
Published: 2023-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2023-22607
Published: 2023-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2023-22609
Published: 2023-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2023-24815
Published: 2023-02-09
Description: Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (`*`) then an attacker can exfiltrate any class path resource. When computing the relative path to locate the resource, in case of wildcards, the code: `return "/" + rest;` from `Utils.java` returns the user input (without validation) as the segment to lookup. Even though checks are performed to avoid escaping the sandbox, given that the input was not sanitized `\` are not properly handled and an attacker can build a path that is valid within the classpath. This issue only affects users deploying in windows environments and upgrading is the advised remediation path. There are no known workarounds for this vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-22
References: https://github.com/vert-x3/vertx-web/blob/62c0d66fa1c179ae6a4d[PII_REDACTED]9a2b97e60f/vertx-web/src/main/java/io/vertx/ext/web/impl/Utils.java#L83; https://github.com/vert-x3/vertx-web/commit/9e3a783b1d1a731055e9049078b1b1494ece9c15; https://github.com/vert-x3/vertx-web/security/advisories/GHSA-53jx-vvf9-4x38
CVE: CVE-2023-21419
Published: 2023-02-09
Description: An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container remain unlocked under certain condition.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01
CVE: CVE-2023-21420
Published: 2023-02-09
Description: Use of Externally-Controlled Format String vulnerabilities in STST TA prior to SMR Jan-2023 Release 1 allows arbitrary code execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-134, CWE-134
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01
CVE: CVE-2023-21421
Published: 2023-02-09
Description: Improper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allows attacker to access device SIM PIN.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-280, CWE-269
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01
CVE: CVE-2023-21422
Published: 2023-02-09
Description: Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attackers to set custom DNS server without permission via binding WifiService.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01
CVE: CVE-2023-21423
Published: 2023-02-09
Description: Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without permission using unprotected action.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01
CVE: CVE-2023-21424
Published: 2023-02-09
Description: Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attacker to modify network related values, network code, carrier id and operator brand.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01
CVE: CVE-2023-21425
Published: 2023-02-09
Description: Improper access control vulnerability in telecom application prior to SMR JAN-2023 Release 1 allows local attackers to get sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01
CVE: CVE-2023-21426
Published: 2023-02-09
Description: Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01
CVE: CVE-2023-21427
Published: 2023-02-09
Description: Improper access control vulnerability in NfcTile prior to SMR Jan-2023 Release 1 allows to attacker to use NFC without user recognition.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01
CVE: CVE-2023-21428
Published: 2023-02-09
Description: Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Preferred Call. The patch removes unused code.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01
CVE: CVE-2023-21429
Published: 2023-02-09
Description: Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01
CVE: CVE-2023-21430
Published: 2023-02-09
Description: An out-of-bound read vulnerability in mapToBuffer function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR JAN-2023 Release 1 allows attacker to cause memory access fault.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=01
CVE: CVE-2023-21431
Published: 2023-02-09
Description: Improper input validation in Bixby Vision prior to version 3.7.70.17 allows attacker to access data of Bixby Vision.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01
CVE: CVE-2023-21432
Published: 2023-02-09
Description: Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the owner.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01
CVE: CVE-2023-21433
Published: 2023-02-09
Description: Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy Store.
CVSS Score: 7.8 (HIGH)
CWE: CWE-285, CWE-276
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01
CVE: CVE-2023-21434
Published: 2023-02-09
Description: Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching a web page.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01
CVE: CVE-2023-21435
Published: 2023-02-09
Description: Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via log.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200, CWE-532
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02
CVE: CVE-2023-21436
Published: 2023-02-09
Description: Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID.
CVSS Score: 3.3 (LOW)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02
CVE: CVE-2023-21437
Published: 2023-02-09
Description: Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows local attackers to access sensitive information via implicit broadcast.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02
CVE: CVE-2023-21438
Published: 2023-02-09
Description: Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder.
CVSS Score: 2.1 (LOW)
CWE: CWE-284, CWE-668
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02
CVE: CVE-2023-21439
Published: 2023-02-09
Description: Improper input validation vulnerability in UwbDataTxStatusEvent prior to SMR Feb-2023 Release 1 allows attackers to launch certain activities.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02