rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-20783 
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182882; Issue ID: MSV-4684.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:47:01.550Z
CVE-2025-20784 
In display, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182882; Issue ID: MSV-4683.
Problem types: cwe_id: CWE-457
description: CWE-457 Use of Uninitialized Variable
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:47:03.436Z
CVE-2025-20785 
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10149882; Issue ID: MSV-4677.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:47:05.514Z
CVE-2025-20786 
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10149882; Issue ID: MSV-4673.
Problem types: cwe_id: CWE-415
description: CWE-415 Double Free
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:47:07.490Z
CVE-2025-20787 
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10149879; Issue ID: MSV-4658.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:47:09.208Z
CVE-2025-20788 
In GPU pdma, there is a possible memory corruption due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117735; Issue ID: MSV-4539.
Problem types: cwe_id: CWE-1262
description: CWE-1262 Improper Access Control for Register Interface
Affected products: vendor: MediaTek, Inc.
product: MT6991, MT8196
Published: 2025-12-02T02:34:51.415Z
CVE-2025-20789 
In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117741; Issue ID: MSV-4538.
Problem types: cwe_id: CWE-201
description: CWE-201 Information Exposure Through Sent Data
Affected products: vendor: MediaTek, Inc.
product: MT6781, MT6833, MT6853, MT6877, MT6893, MT8196
Published: 2025-12-02T02:35:00.762Z
CVE-2025-20790 
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01677581; Issue ID: MSV-4701.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: MediaTek, Inc.
product: MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6880, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893, MT8675, MT8771, MT8791, MT8791T, MT8797
Published: 2025-12-02T02:34:09.548Z
CVE-2025-20791 
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661189; Issue ID: MSV-4298.
Problem types: cwe_id: CWE-617
description: CWE-617 Reachable Assertion
Affected products: vendor: MediaTek, Inc.
product: MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6880, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893, MT8675, MT8771, MT8791, MT8791T, MT8797
Published: 2025-12-02T02:34:19.882Z
CVE-2025-20792 
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01717526; Issue ID: MSV-5591.
Problem types: cwe_id: CWE-617
description: CWE-617 Reachable Assertion
Affected products: vendor: MediaTek, Inc.
product: MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6880, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893, MT8791T
Published: 2025-12-02T02:34:02.269Z
CVE-2025-20793 
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01430930; Issue ID: MSV-4836.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:46:33.180Z
CVE-2025-20794 
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01689259 / MOLY01586470; Issue ID: MSV-4847.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack Overflow
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:46:31.408Z
CVE-2025-20795 
In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10276761; Issue ID: MSV-5141.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:46:29.572Z
CVE-2025-20796 
In imgsys, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS10314745; Issue ID: MSV-5553.
Problem types: cwe_id: CWE-1285
description: CWE-1285 Specified Index, Position, or Offset
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:46:40.242Z
CVE-2025-20797 
In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10315812; Issue ID: MSV-5534.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack Overflow
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:46:41.998Z
CVE-2025-20798 
In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10315812; Issue ID: MSV-5533.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:46:43.705Z
CVE-2025-20799 
In c2ps, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10274607; Issue ID: MSV-5049.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:46:45.382Z
CVE-2025-20800 
In mminfra, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10267349; Issue ID: MSV-5033.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:46:47.318Z
CVE-2025-20801 
In seninf, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10251210; Issue ID: MSV-4926.
Problem types: cwe_id: CWE-415
description: CWE-415 Double Free
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:46:49.056Z
CVE-2025-20802 
In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10238968; Issue ID: MSV-4914.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:46:50.794Z
CVE-2025-20803 
In dpe, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS10199779; Issue ID: MSV-4504.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:47:10.931Z
CVE-2025-20804 
In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS10198951; Issue ID: MSV-4503.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:47:12.671Z
CVE-2025-20805 
In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10114696; Issue ID: MSV-4480.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:47:14.477Z
CVE-2025-20806 
In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10114835; Issue ID: MSV-4479.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:47:16.268Z
CVE-2025-20807 
In dpe, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10114841; Issue ID: MSV-4451.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow
Affected products: vendor: MediaTek, Inc.
product: MediaTek chipset
default_status: unaffected
Published: 2026-01-06T01:47:42.663Z
CVE-2025-20881 
Out-of-bounds write in accessing buffer storing the decoded video frames in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.
Problem types: description: CWE-787 Out-of-bounds Write
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: 2025-02-04T07:19:26.808Z
CVE-2025-20882 
Out-of-bounds write in accessing uninitialized memory for svc1td in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.
Problem types: description: CWE-787 Out-of-bounds Write
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: 2025-02-04T07:19:27.982Z
CVE-2025-20883 
Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles.
Problem types: description: CWE-284: Improper Access Control
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
default_status: affected
CVSS v3.1: version: 3.1
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2025-02-04T07:19:29.121Z
CVE-2025-20884 
Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles.
Problem types: description: CWE-284: Improper Access Control
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
default_status: affected
CVSS v3.1: version: 3.1
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2025-02-04T07:19:30.246Z
CVE-2025-20885 
Out-of-bounds write in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to cause memory corruption.
Problem types: description: CWE-787: Out-of-bounds Write
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.4
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: 2025-02-04T07:19:31.385Z
CVE-2025-20886 
Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key.
Problem types: description: CWE-531: Inclusion of Sensitive Information in Test Code
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Published: 2025-02-04T07:19:32.626Z
CVE-2025-20887 
Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability.
Problem types: description: CWE-125 Out-of-bounds Read
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
Published: 2025-02-04T07:19:33.828Z
CVE-2025-20888 
Out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.
Problem types: description: CWE-787 Out-of-bounds Write
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: 2025-02-04T07:19:35.006Z
CVE-2025-20889 
Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability.
Problem types: description: CWE-125 Out-of-bounds Read
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
Published: 2025-02-04T07:19:36.135Z
CVE-2025-20890 
Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.
Problem types: description: CWE-787 Out-of-bounds Write
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: 2025-02-04T07:19:37.251Z
CVE-2025-20891 
Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability.
Problem types: description: CWE-125 Out-of-bounds Read
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
Published: 2025-02-04T07:19:38.335Z
CVE-2025-20892 
Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. User interaction is required for triggering this vulnerability.
Problem types: description: CWE-693: Protection Mechanism Failure
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
default_status: affected
CVSS v3.1: version: 3.1
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Published: 2025-02-04T07:19:39.432Z
CVE-2025-20893 
Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the configuration of notifications.
Problem types: description: CWE-287 Improper Authentication
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2025-02-04T07:19:40.532Z
CVE-2025-20894 
Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles.
Problem types: description: CWE-284: Improper Access Control
Affected products: vendor: Samsung Mobile
product: Samsung Email
default_status: affected
CVSS v3.1: version: 3.1
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2025-02-04T07:19:41.631Z
CVE-2025-20895 
Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary applications to bypass restrictions of Setupwizard.
Problem types: description: CWE-288: Authentication Bypass Using an Alternate Path
Affected products: vendor: Samsung Mobile
product: Galaxy Store
default_status: affected
CVSS v3.1: version: 3.1
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: LOW
baseScore: 3.2
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Published: 2025-02-04T07:19:42.808Z
CVE-2025-20896 
Use of implicit intent for sensitive communication in EasySetup prior to version 11.1.18 allows local attackers to access sensitive information.
Problem types: description: CWE-927: Use of Implicit Intent for Sensitive Communication
Affected products: vendor: Samsung Mobile
product: EasySetup
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: 2025-02-04T07:19:43.898Z