rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-33651 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:07.000Z
CVE-2022-33652 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:09.000Z
CVE-2022-33653 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:10.000Z
CVE-2022-33654 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:12.000Z
CVE-2022-33655 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:13.000Z
CVE-2022-33656 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:15.000Z
CVE-2022-33657 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:16.000Z
CVE-2022-33658 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:17.000Z
CVE-2022-33659 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:19.000Z
CVE-2022-33660 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:20.000Z
CVE-2022-33661 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:22.000Z
CVE-2022-33662 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:23.000Z
CVE-2022-33663 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:25.000Z
CVE-2022-33664 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:26.000Z
CVE-2022-33665 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:28.000Z
CVE-2022-33666 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:29.000Z
CVE-2022-33667 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:31.000Z
CVE-2022-33668 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:32.000Z
CVE-2022-33669 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:34.000Z
CVE-2022-33670 Windows Partition Management Driver Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows 11 version 21H2
vendor: Microsoft
product: Windows 10 Version 21H1
vendor: Microsoft
product: Windows 10 Version 20H2
vendor: Microsoft
product: Windows Server version 20H2
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 8.1
vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows 10 Version 1507
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2022-08-09T19:50:56.000Z
CVE-2022-33671 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:35.000Z
CVE-2022-33672 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:37.000Z
CVE-2022-33673 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:38.000Z
CVE-2022-33674 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.3
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:39.000Z
CVE-2022-33675 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:41.000Z
CVE-2022-33676 Azure Site Recovery Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-07-12T22:38:42.000Z
CVE-2022-33677 Azure Site Recovery Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2022-07-12T22:38:44.000Z
CVE-2022-33678 Azure Site Recovery Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Azure Site Recovery VMWare to Azure
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2022-07-12T22:38:45.000Z
CVE-2022-33679 Windows Kerberos Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008  Service Pack 2
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Published: 2022-09-13T18:41:31.000Z
CVE-2022-33680 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Microsoft Edge (Chromium-based)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.3
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2022-07-07T20:00:14.000Z
CVE-2022-33681 Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM
Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and connections from the Pulsar Proxy to the Pulsar Broker are vulnerable. Authentication data is sent before verifying the server’s TLS certificate matches the hostname, which means authentication data could be exposed to an attacker. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. Because the client sends authentication data before performing hostname verification, an attacker could gain access to the client’s authentication data. The client eventually closes the connection when it verifies the hostname and identifies the targeted hostname does not match a hostname on the certificate. Because the client eventually closes the connection, the value of the intercepted authentication data depends on the authentication method used by the client. Token based authentication and username/password authentication methods are vulnerable because the authentication data can be used to impersonate the client in a separate session. This issue affects Apache Pulsar Java Client versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Apache Software Foundation
product: Apache Pulsar
Credits: lang: en
value: This issue was discovered by Michael Marshall of DataStax.
Published: 2022-09-23T09:25:13.000Z
CVE-2022-33682 Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack
TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle attacks, which could leak credentials, configuration data, message data, and any other data sent by these clients. The vulnerability is for both the pulsar+ssl protocol and HTTPS. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. This issue affects Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Apache Software Foundation
product: Apache Pulsar
Credits: lang: en
value: This issue was discovered by Michael Marshall of DataStax.
Published: 2022-09-23T09:25:14.000Z
CVE-2022-33683 Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack 
Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack. This issue affects Apache Pulsar Broker and Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Apache Software Foundation
product: Apache Pulsar
Credits: lang: en
value: This issue was discovered by Michael Marshall of DataStax.
Published: 2022-09-23T09:25:15.000Z
CVE-2022-33684 Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate Validation
The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or modify the GET request that is sent to the ClientCredentialFlow 'issuer url'. The intercepted credentials can be used to acquire authentication data from the OAuth2.0 server to then authenticate with an Apache Pulsar cluster. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack. The Apache Pulsar Python Client wraps the C++ client, so it is also vulnerable in the same way. This issue affects Apache Pulsar C++ Client and Python Client versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0 to 2.10.1; 2.6.4 and earlier. Any users running affected versions of the C++ Client or the Python Client should rotate vulnerable OAuth2.0 credentials, including client_id and client_secret. 2.7 C++ and Python Client users should upgrade to 2.7.5 and rotate vulnerable OAuth2.0 credentials. 2.8 C++ and Python Client users should upgrade to 2.8.4 and rotate vulnerable OAuth2.0 credentials. 2.9 C++ and Python Client users should upgrade to 2.9.3 and rotate vulnerable OAuth2.0 credentials. 2.10 C++ and Python Client users should upgrade to 2.10.2 and rotate vulnerable OAuth2.0 credentials. 3.0 C++ users are unaffected and 3.0 Python Client users will be unaffected when it is released. Any users running the C++ and Python Client for 2.6 or less should upgrade to one of the above patched versions.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Apache Software Foundation
product: Apache Pulsar
Credits: lang: en
value: This issue was discovered by Michael Rowley, michaellrowley@protonmail.com
Published: 2022-11-04T00:00:00.000Z
CVE-2022-33685 
Unprotected dynamic receiver in Wearable Manager Service prior to SMR Jul-2022 Release 1 allows attacker to launch arbitray activity and access senstive information.
Problem types: cwe_id: CWE-561
description: CWE-561: Dead Code
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-07-11T13:33:16.000Z
CVE-2022-33686 
Exposure of Sensitive Information in GsmAlarmManager prior to SMR Jul-2022 Release 1 allows local attacker to access iccid via log.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-07-11T13:33:22.000Z
CVE-2022-33687 
Exposure of Sensitive Information in telephony-common.jar prior to SMR Jul-2022 Release 1 allows local attackers to access IMSI via log.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-07-11T13:33:28.000Z
CVE-2022-33688 
Sensitive information exposure vulnerability in EventType in SecTelephonyProvider prior to SMR Jul-2022 Release 1 allows local attackers with log access permission to get IMSI through device log.
Problem types: cwe_id: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-07-11T13:33:34.000Z
CVE-2022-33689 
Improper access control vulnerability in TelephonyUI prior to SMR Jul-2022 Release 1 allows attackers to change preferred network type by unprotected binder call.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-07-11T13:33:44.000Z
CVE-2022-33690 
Improper input validation in Contacts Storage prior to SMR Jul-2022 Release 1 allows attacker to access arbitrary file.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-07-11T13:33:58.000Z
CVE-2022-33691 
A possible race condition vulnerability in score driver prior to SMR Jul-2022 Release 1 can allow local attackers to interleave malicious operations.
Problem types: cwe_id: CWE-367
description: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2022-07-11T13:34:41.000Z