rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-39810 
An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter. Session hijacking or similar attacks would not be possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T16:39:26.000Z
CVE-2022-39811 
Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying permissions for access to resources, it allows an attacker to view pages that are not allowed, and modify the system configuration, bypassing all controls (without checking for user identity).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-39812 
Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An unauthenticated user can upload files to an arbitrary path. An attacker can change the uploadDir parameter in a POST request (not possible using the GUI) to an arbitrary directory. Because the application does not check in which directory a file will be uploaded, an attacker can perform a variety of attacks that can result in unauthorized access to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-39813 
Italtel NetMatch-S CI 5.2.0-20211008 allows Multiple Reflected/Stored XSS issues under NMSCIWebGui/j_security_check via the j_username parameter, or NMSCIWebGui/actloglineview.jsp via the name or actLine parameter. An attacker leveraging this vulnerability could inject arbitrary JavaScript. The payload would then be triggered every time an authenticated user browses the page containing it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-39814 
In NOKIA 1350 OMS R14.2, an Open Redirect vulnerability occurs is the login page via next HTTP GET parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T20:36:57.000Z
CVE-2022-39815 
In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. This vulnerability allow unauthenticated users to execute commands on the operating system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T20:36:50.000Z
CVE-2022-39816 
In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials (cleartext administrator password) occur in the edit configuration page. Exploitation requires an authenticated attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T20:36:45.000Z
CVE-2022-39817 
In NOKIA 1350 OMS R14.2, multiple SQL Injection vulnerabilities occurs. Exploitation requires an authenticated attacker. Through the injection of arbitrary SQL statements, a potential authenticated attacker can modify query syntax and perform unauthorized (and unexpected) operations against the remote database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T20:36:39.000Z
CVE-2022-39818 
In NOKIA NFM-T R19.9, an OS Command Injection vulnerability occurs in /cgi-bin/R19.9/log.pl of the VM Manager WebUI via the cmd HTTP GET parameter. This allows authenticated users to execute commands, with root privileges, on the operating system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-25T00:00:00.000Z
CVE-2022-39819 
In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. This allows authenticated users to execute commands on the operating system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T20:36:33.000Z
CVE-2022-39820 
In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xml.DRC and /DEPOT/KECustom_199/OTNE_DRC/RestUploadManager.xml. A remote user, authenticated to the operating system, with access privileges to the directory /root or /DEPOT, is able to read cleartext credentials to access the web portal NFM-T and control all the PPS Network elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-25T00:00:00.000Z
CVE-2022-39821 
In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs. The web application stores critical information, such as cleartext user credentials, in world-readable files in the filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T20:36:27.000Z
CVE-2022-39822 
In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter. An authenticated attacker is required for exploitation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-25T00:00:00.000Z
CVE-2022-39823 
An issue was discovered in Softing OPC UA C++ SDK 5.66 through 6.x before 6.10. An OPC/UA browse request exceeding the server limit on continuation points may cause a use-after-free error
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-20T00:00:00.000Z
CVE-2022-39824 
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-05T02:54:02.000Z
CVE-2022-39828 
sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_private_key, leading to a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-05T03:43:31.000Z
CVE-2022-39829 
There is a NULL pointer dereference in aes256_encrypt in Samsung mTower through 0.3.0 due to a missing check on the return value of EVP_CIPHER_CTX_new.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-05T03:43:20.000Z
CVE-2022-39830 
sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_public_key_affine_coordinates, leading to a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-05T03:43:12.000Z
CVE-2022-39831 
An issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function read_bytes_internal in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact. This issue is different from CVE-2018-20230.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-05T04:12:37.000Z
CVE-2022-39832 
An issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function read_string in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-05T04:12:30.000Z
CVE-2022-39833 
FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-23T00:00:00.000Z
CVE-2022-39834 
A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2. A low-privilege user can store JavaScript in order to exploit a higher-privilege user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-17T00:00:00.000Z
CVE-2022-39835 
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-27T18:21:13.000Z
CVE-2022-39836 
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-24T00:00:00.000Z
CVE-2022-39837 
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-24T00:00:00.000Z
CVE-2022-39838 
Systematic FIX Adapter (ALFAFX) 2.4.0.25 13/09/2017 allows remote file inclusion via a UNC share pathname, and also allows absolute path traversal to local pathnames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-05T15:39:50.000Z
CVE-2022-39839 
Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-05T05:06:50.000Z
CVE-2022-39840 
Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-05T05:06:17.000Z
CVE-2022-39842 
An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-05T00:00:00.000Z
CVE-2022-39843 
123elf Lotus 1-2-3 before 1.0.0rc3 for Linux, and Lotus 1-2-3 R3 for UNIX and other platforms through 9.8.2, allow attackers to execute arbitrary code via a crafted worksheet. This occurs because of a stack-based buffer overflow in the cell format processing routines, as demonstrated by a certain function call from process_fmt() that can be reached via a w3r_format element in a wk3 document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-05T06:02:03.000Z
CVE-2022-39844 
Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrary directory using directory junction.
Problem types: cwe_id: CWE-354
description: CWE-354 Improper Validation of Integrity Check Value
Affected products: vendor: Samsung Mobile
product: Smart Switch PC
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2022-09-09T14:39:57.000Z
CVE-2022-39845 
Improper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attackers to delete arbitrary directory using directory junction.
Problem types: cwe_id: CWE-354
description: CWE-354 Improper Validation of Integrity Check Value
Affected products: vendor: Samsung Mobile
product: Samsung Kies
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2022-09-09T14:39:57.000Z
CVE-2022-39846 
DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.22083_3 allows attacker to execute arbitrary code.
Problem types: cwe_id: CWE-427
description: CWE-427:Uncontrolled Search Path Element
Affected products: vendor: Samsung Mobile
product: Smart Switch PC
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2022-09-09T14:39:57.000Z
CVE-2022-39847 
Use after free vulnerability in set_nft_pid and signal_handler function of NFC driver prior to SMR Oct-2022 Release 1 allows attackers to perform malicious actions.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 4.9
baseSeverity: MEDIUM
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39848 
Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log.
Problem types: cwe_id: CWE-213
description: CWE-213: Exposure of Sensitive Information Due to Incompatible Policies
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39849 
Improper access control in knox_vpn_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39850 
Improper access control in mum_container_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39851 
Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bind service that require BIND_REMOTEVIEWS permission.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 4
baseSeverity: MEDIUM
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39852 
A heap-based overflow vulnerability in makeContactAGIF in libagifencoder.quram.so library prior to SMR Oct-2022 Release 1 allows attacker to perform code execution.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 8
baseSeverity: HIGH
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39853 
A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory access fault.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 4.4
baseSeverity: MEDIUM
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39854 
Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39855 
Improper access control vulnerability in FACM application prior to SMR Oct-2022 Release 1 allows a local attacker to connect arbitrary AP and Bluetooth devices.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.1
baseSeverity: MEDIUM
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39856 
Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers to access call information.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39857 
Improper access control vulnerability in CameraTestActivity in FactoryCameraFB prior to version 3.5.51 allows attackers to access broadcasting Intent as system uid privilege.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Samsung Mobile
product: FactoryCameraFB
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39858 
Path traversal vulnerability in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to write arbitrary file as FactoryCamera privilege.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;)
Affected products: vendor: Samsung Mobile
product: FactoryCamera
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39859 
Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via implicit intent.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Samsung Mobile
product: UPHelper
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39860 
Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive information via implicit broadcast.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Samsung Mobile
product: QuickShare
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 4.4
baseSeverity: MEDIUM
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39861 
Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without camera privilege.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Samsung Mobile
product: FactoryCamera
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39862 
Improper authorization in Dynamic Lockscreen prior to SMR Sep-2022 Release 1 in Android R(11) and 3.3.03.66 in Android S(12) allows unauthorized use of javascript interface api.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39863 
Intent redirection vulnerability in Samsung Account prior to version 13.5.01.3 allows attackers to access content providers without permission.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Samsung Mobile
product: Samsung Account
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 3.6
baseSeverity: LOW
Published: 2022-10-07T00:00:00.000Z
CVE-2022-39864 
Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via implicit intent.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Samsung Mobile
product: SmartThings
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
Published: 2022-10-07T00:00:00.000Z