yahoo-inc/cve-impacts huggingface dataset:
CVE-2021-25350: Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user information via log.
Key phrases: access user information via log, information exposure
CVE-2021-25351: Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attackers to log out user account on device without user password.
Key phrases: log out user account on device without user, improper access control
CVE-2021-25352: Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileged action by hijacking and modifying the intent.
Key phrases: execute privileged action by hijacking and modifying the
CVE-2021-25353: Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private file directories of Galaxy Themes application without permission via hijacking the PendingIntent.
Key phrases: read/write private file directories of Galaxy, pendingintent, hijack
CVE-2021-25354: Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via malicious deeplink.
Key phrases: launch non-exported activity in Samsung Browser, improper input check
CVE-2021-25355: Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hijacking the PendingIntent.
Key phrases: local attackers unauthorized action without permission via hijacking, pendingintent
CVE-2021-25356: An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install arbitrary application, grant device admin permission and then delete several installed application.
Key phrases: install arbitrary application, improper caller check
CVE-2021-25357: A pendingIntent hijacking vulnerability in Create Movie prior to SMR APR-2021 Release 1 in Android O(8.x) and P(9.0), 3.4.81.1 in Android Q(10,0), and 3.6.80.7 in Android R(11.0) allows unprivileged applications to access contact information.
Key phrases: access contact information, pendingintent hijacking
CVE-2021-25358: A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to access IMSI values without any permission via untrusted applications.
Key phrases: access IMSI values without any permission via untrusted
CVE-2021-25359: An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without proper permissions via untrusted applications.
Key phrases: access AP information without proper permissions via untrusted
CVE-2021-25360: An improper input validation vulnerability in libswmfextractor library prior to SMR APR-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process.
Key phrases: execute arbitrary code, execute arbitrary code on mediaextractor process, input validation, improper input validation
CVE-2021-25361: An improper access control vulnerability in stickerCenter prior to SMR APR-2021 Release 1 allows local attackers to read or write arbitrary files of system process via untrusted applications.
Key phrases: write arbitrary files, read or write arbitrary files of system process, improper access control
CVE-2021-25362: An improper permission management in CertInstaller prior to SMR APR-2021 Release 1 allows untrusted applications to delete certain local files.
Key phrases: delete certain local files, improper permission management, improper permissions
CVE-2021-25363: An improper access control in ActivityManagerService prior to SMR APR-2021 Release 1 allows untrusted applications to access running processesdelete some local files.
Key phrases: access running processesdelete some local files, improper access control
CVE-2021-25364: A pendingIntent hijacking vulnerability in Secure Folder prior to SMR APR-2021 Release 1 allows unprivileged applications to access contact information.
Key phrases: access contact information, pendingintent hijacking
CVE-2021-25365: An improper exception control in softsimd prior to SMR APR-2021 Release 1 allows unprivileged applications to access the API in softsimd.
Key phrases: access the API in softsimd
CVE-2021-25366: Improper access control in Samsung Internet prior to version 13.2.1.70 allows physically proximate attackers to bypass the secret mode's authentication.
Key phrases: bypass the secret mode's authentication, improper access control
CVE-2021-25367: Path Traversal vulnerability in Samsung Notes prior to version 4.2.00.22 allows attackers to access local files without permission.
Key phrases: access local files without permission, path traversal
CVE-2021-25368: Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is executed.
Key phrases: intercept when the provider is executed, hijacking
CVE-2021-25369: An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.
Key phrases: access control, improper access control
CVE-2021-25370: An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.
Key phrases: memory corruption, kernel panic
CVE-2021-25371: A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
Key phrases: load arbitrary ELF libraries, attackers load arbitrary ELF libraries inside DSP
CVE-2021-25372: An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.
Key phrases: out of bounds memory access
CVE-2021-25373: Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in Android Q(10.0) and 2.9.01.1 in Android R(11.0) allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.
Key phrases: perform unauthorized action without permission via hijacking the, unsafe pendingintent
CVE-2021-25374: An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9 in Android P(9.0) and above allows remote attackers to access a user data related with Samsung Account.
Key phrases: access a user data related with Samsung Account, authorization, improper authorization
CVE-2021-25375: Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another emails when users open the malicious attachment.
Key phrases: get attachments of another emails when users open, predictable index
CVE-2021-25376: An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTLS negotiation is failed.
Key phrases: plain text
CVE-2021-25377: Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(10.0) above allows attacker to execute privileged action.
Key phrases: execute privileged action, intent redirection
CVE-2021-25378: Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service.
Key phrases: remote temporary denial of service, improper access control
CVE-2021-25379: Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action.
Key phrases: execute privileged action, intent redirection
CVE-2021-25380: Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the user.
Key phrases: execute the actions registered by the user, exceptional conditions
CVE-2021-25381: Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.
Key phrases: perform unauthorized action without permission via hijacking the, unsafe pendingintent
CVE-2021-25382: An improper authorization of using debugging command in Secure Folder prior to SMR Oct-2020 Release 1 allows unauthorized access to contents in Secure Folder via debugging command.
Key phrases: contents in Secure Folder via debugging command, unauthorized access, improper authorization
CVE-2021-25383: An improper input validation vulnerability in scmn_mfal_read() in libsapeextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process.
Key phrases: execute arbitrary code, execute arbitrary code on mediaextractor process, input validation, improper input validation
CVE-2021-25384: An improper input validation vulnerability in sdfffd_parse_chunk_PROP() with Sample Rate Chunk in libsdffextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process.
Key phrases: execute arbitrary code, execute arbitrary code on mediaextractor process, input validation, improper input validation
CVE-2021-25385: An improper input validation vulnerability in sdfffd_parse_chunk_PROP() in libsdffextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process.
Key phrases: execute arbitrary code, execute arbitrary code on mediaextractor process, input validation, improper input validation
CVE-2021-25386: An improper input validation vulnerability in sdfffd_parse_chunk_FVER() in libsdffextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process.
Key phrases: execute arbitrary code, execute arbitrary code on mediaextractor process, input validation, improper input validation
CVE-2021-25387: An improper input validation vulnerability in sflacfd_get_frm() in libsflacextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process.
Key phrases: execute arbitrary code, execute arbitrary code on mediaextractor process, input validation, improper input validation
CVE-2021-25388: Improper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app.
Key phrases: install arbitrary app, improper caller check
CVE-2021-25389: Improper running task check in S Secure prior to SMR MAY-2021 Release 1 allows attackers to use locked app without authentication.
Key phrases: use locked app without authentication, improper running task check
CVE-2021-25390: Intent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.
Key phrases: execute privileged action, intent redirection
CVE-2021-25391: Intent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.
Key phrases: execute privileged action, intent redirection
CVE-2021-25392: Improper protection of backup path configuration in Samsung Dex prior to SMR MAY-2021 Release 1 allows local attackers to get sensitive information via changing the path.
Key phrases: get sensitive information via changing the path, improper protection
CVE-2021-25393: Improper sanitization of incoming intent in SecSettings prior to SMR MAY-2021 Release 1 allows local attackers to get permissions to access system uid data.
Key phrases: get permissions to access system uid data, improper sanitization
CVE-2021-25394: A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised.
Key phrases: allows arbitrary write, arbitrary write given a radio privilege is compromised, use after free, race condition
CVE-2021-25395: A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.
Key phrases: bypass signature check, bypass signature check given a radio privilege is, race condition
CVE-2021-25396: An improper input validation vulnerability in NPU firmware prior to SMR MAY-2021 Release 1 allows arbitrary memory write and code execution.
Key phrases: allows arbitrary memory, arbitrary memory write and code execution, input validation, improper input validation
CVE-2021-25397: An improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write arbitrary files of telephony process via untrusted applications.
Key phrases: write arbitrary files, write arbitrary files of telephony process via untrusted, improper access control
CVE-2021-25398: Intent redirection vulnerability in Bixby Voice prior to version 3.1.12 allows attacker to access contacts.
Key phrases: access contacts, intent redirection
CVE-2021-25399: Improper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the file with system privilege.
Key phrases: access the file with system privilege, improper configuration
CVE-2021-25400: Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action.
Key phrases: execute privileged action, intent redirection
CVE-2021-25401: Intent redirection vulnerability in Samsung Health prior to version 6.16 allows attacker to execute privileged action.
Key phrases: execute privileged action, intent redirection
CVE-2021-25402: Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information.
Key phrases: access s pen latency information, information exposure
CVE-2021-25403: Intent redirection vulnerability in Samsung Account prior to version 10.8.0.4 in Android P(9.0) and below, and 12.2.0.9 in Android Q(10.0) and above allows attacker to access contacts and file provider using SettingWebView component.
Key phrases: access contacts and file provider using SettingWebView component, intent redirection
CVE-2021-25404: Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log.
Key phrases: access user information via log, information exposure
CVE-2021-25405: An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files.
Key phrases: access local files, improper access control, screenoffactivity
CVE-2021-25406: Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to access connected BT device information.
Key phrases: access connected BT device information, information exposure
CVE-2021-25407: A possible out of bounds write vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write.
Key phrases: allows arbitrary memory write, out of bounds write
CVE-2021-25408: A possible buffer overflow vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write and code execution.
Key phrases: allows arbitrary memory, arbitrary memory write and code execution, buffer overflow
CVE-2021-25409: Improper access in Notification setting prior to SMR JUN-2021 Release 1 allows physically proximate attackers to set arbitrary notification via physically configuring device.
Key phrases: set arbitrary notification, set arbitrary notification via physically configuring device, improper access in notification setting
CVE-2021-25410: Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files with an escalated privilege.
Key phrases: access arbitrary files, access arbitrary files with an escalated privilege, improper access control, escalate privilege
CVE-2021-25411: Improper address validation vulnerability in RKP api prior to SMR JUN-2021 Release 1 allows root privileged local attackers to write read-only kernel memory.
Key phrases: write read-only kernel memory, improper address validation, root privilege
CVE-2021-25412: An improper access control vulnerability in genericssoservice prior to SMR JUN-2021 Release 1 allows local attackers to execute protected activity with system privilege via untrusted applications.
Key phrases: execute protected activity with system privilege via untrusted, improper access control
CVE-2021-25413: Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to get permissions to access arbitrary data with Samsung Contacts privilege.
Key phrases: access arbitrary data, get permissions to access arbitrary data with Samsung, improper sanitization of incoming intent
CVE-2021-25414: Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to copy or overwrite arbitrary files with Samsung Contacts privilege.
Key phrases: overwrite arbitrary files, copy or overwrite arbitrary files with Samsung Contacts, improper sanitization of incoming intent
CVE-2021-25415: Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to remap EL2 memory as writable.
Key phrases: remap EL2 memory as writable, improper address validation
CVE-2021-25416: Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to create executable kernel page outside code area.
Key phrases: create executable kernel page outside code area
CVE-2021-25417: Improper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage.
Key phrases: internal storage, improper authorization
CVE-2021-25418: Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrary activity in specific condition.
Key phrases: execute arbitrary activity, execute arbitrary activity in specific condition, improper component protection
CVE-2021-25419: Non-compliance of recommended secure coding scheme in Samsung Internet prior to version 14.0.1.62 allows attackers to display fake URL in address bar via phising URL link.
Key phrases: display fake URL in address bar via phising, phising url link
CVE-2021-25420: Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone within log.
Key phrases: leak Wi-Fi password connected to the, improper log management
CVE-2021-25421: Improper log management vulnerability in Galaxy Watch3 PlugIn prior to version 2.2.09.21033151 allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone within log.
Key phrases: leak Wi-Fi password connected to the, improper log management
CVE-2021-25422: Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone within log.
Key phrases: leak Wi-Fi password connected to the, improper log management
CVE-2021-25423: Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone via log.
Key phrases: leak Wi-Fi password connected to the, improper log management
CVE-2021-25424: Improper authentication vulnerability in Tizen bluetooth-frwk prior to Firmware update JUN-2021 Release allows bluetooth attacker to take over the user's bluetooth device without user awareness.
Key phrases: take over the user's bluetooth device without, improper authentication, user awareness
CVE-2021-25425: Improper check vulnerability in Samsung Health prior to version 6.17 allows attacker to read internal cache data via exported component.
Key phrases: read internal cache data via exported component, improper check
CVE-2021-25426: Improper component protection vulnerability in SmsViewerActivity of Samsung Message prior to SMR July-2021 Release 1 allows untrusted applications to access Message files.
Key phrases: access Message files, improper component protection
CVE-2021-25427: SQL injection vulnerability in Bluetooth prior to SMR July-2021 Release 1 allows unauthorized access to paired device information
Key phrases: paired device information, sql injection, unauthorized access
CVE-2021-25428: Improper validation check vulnerability in PackageManager prior to SMR July-2021 Release 1 allows untrusted applications to get dangerous level permission without user confirmation in limited circumstances.
Key phrases: get dangerous level permission without user confirmation in, improper validation check, limited circumstances
CVE-2021-25429: Improper privilege management vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access the Bluetooth information in Bluetooth application.
Key phrases: access the Bluetooth information in Bluetooth application, improper privilege management
CVE-2021-25430: Improper access control vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access the Bluetooth information in Bluetooth application.
Key phrases: access the Bluetooth information in Bluetooth application, improper access control
CVE-2021-25431: Improper access control vulnerability in Cameralyzer prior to versions 3.2.1041 in 3.2.x, 3.3.1040 in 3.3.x, and 3.4.4210 in 3.4.x allows untrusted applications to access some functions of Cameralyzer.
Key phrases: access some functions of Cameralyzer, improper access control
CVE-2021-25432: Information exposure vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above allows untrusted applications to access chat data.
Key phrases: access chat data, information exposure
CVE-2021-25433: Improper authorization vulnerability in Tizen factory reset policy prior to Firmware update JUL-2021 Release allows untrusted applications to perform factory reset using dbus signal.
Key phrases: perform factory reset using dbus signal, improper authorization
CVE-2021-25434: Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using param partition in wireless firmware download mode.
Key phrases: allows arbitrary code execution, arbitrary code execution using param partition in wireless, improper input validation
CVE-2021-25435: Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using recovery partition in wireless firmware download mode.
Key phrases: allows arbitrary code execution, arbitrary code execution using recovery partition in wireless, improper input validation
CVE-2021-25436: Improper input validation vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows arbitrary code execution via Samsung Accessory Protocol.
Key phrases: allows arbitrary code execution, arbitrary code execution via Samsung Accessory Protocol, improper input validation
CVE-2021-25437: Improper access control vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows attackers to arbitrary code execution by replacing FOTA update file.
Key phrases: arbitrary code execution by replacing FOTA update file, improper access control
CVE-2021-25438: Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above allows untrusted applications to cause local file inclusion in webview.
Key phrases: cause local file inclusion in webview, improper access control
CVE-2021-25439: Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above allows untrusted applications to cause arbitrary webpage loading in webview.
Key phrases: cause arbitrary webpage loading, cause arbitrary webpage loading in webview, improper access control
CVE-2021-25440: Improper access control vulnerability in FactoryCameraFB prior to version 3.4.74 allows untrusted applications to access arbitrary files with an escalated privilege.
Key phrases: access arbitrary files, access arbitrary files with an escalated privilege, improper access control, escalate privilege
CVE-2021-25441: Improper input validation vulnerability in AR Emoji Editor prior to version 4.4.03.5 in Android Q(10.0) and above allows untrusted applications to access arbitrary files with an escalated privilege.
Key phrases: access arbitrary files, access arbitrary files with an escalated privilege, improper input validation, escalate privilege
CVE-2021-25442: Improper MDM policy management vulnerability in KME module prior to KCS version 1.39 allows MDM users to bypass Knox Manage authentication.
Key phrases: bypass Knox Manage authentication, mdm policy management
CVE-2021-25443: A use after free vulnerability in conn_gadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an attacker.
Key phrases: malicious action by an attacker, use after free
CVE-2021-25444: An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process.
Key phrases: decryption of custom keyblob with privileged process, iv reuse
CVE-2021-25445: Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access internal files in Samsung Internet.
Key phrases: access internal files in Samsung Internet, unprotected component
CVE-2021-25446: Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause arbitrary webpage loading in webview.
Key phrases: cause arbitrary webpage loading, cause arbitrary webpage loading in webview, improper access control
CVE-2021-25447: Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause local file inclusion in webview.
Key phrases: cause local file inclusion in webview, improper access control
CVE-2021-25448: Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in webview.
Key phrases: allows arbitrary webpage loading, arbitrary webpage loading in webview, improper access control
CVE-2021-25449: An improper input validation vulnerability in libsapeextractor library prior to SMR Sep-2021 Release 1 allows attackers to execute arbitrary code in mediaextractor process.
Key phrases: execute arbitrary code, execute arbitrary code in mediaextractor process, input validation, improper input validation
CVE-2021-25450: Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Sep-2021 Release 1 allows attackers to write file as system uid via remote socket.
Key phrases: write file as system uid via remote socket, path traversal, to write files
CVE-2021-25451: A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data.
Key phrases: get IMSI data, pendingintent hijacking
CVE-2021-25452: An improper input validation vulnerability in loading graph file in DSP driver prior to SMR Sep-2021 Release 1 allows attackers to perform permanent denial of service on the device.
Key phrases: perform permanent denial of service on the device, input validation, improper input validation
CVE-2021-25453: Some improper access control in Bluetooth APIs prior to SMR Sep-2021 Release 1 allows untrusted application to get Bluetooth information.
Key phrases: get Bluetooth information, improper access control
CVE-2021-25454: OOB read vulnerability in libsaacextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute remote DoS via forged aac file.
Key phrases: execute remote DoS via forged aac file, oob read, remote dos
CVE-2021-25455: OOB read vulnerability in libsaviextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to access arbitrary address through pointer via forged avi file.
Key phrases: access arbitrary address, access arbitrary address through pointer via forged avi, oob read
CVE-2021-25456: OOB read vulnerability in libswmfextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute memcpy at arbitrary address via forged wmf file.
Key phrases: execute memcpy at arbitrary address via forged wmf, oob read
CVE-2021-25457: An improper input validation vulnerability in DSP driver prior to SMR Sep-2021 Release 1 allows local attackers to get a limited kernel memory information.
Key phrases: get a limited kernel memory information, input validation, improper input validation
CVE-2021-25458: NULL pointer dereference vulnerability in ION driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption.
Key phrases: cause memory corruption, null pointer dereference
CVE-2021-25459: An improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to start BlockchainTZService.
Key phrases: start BlockchainTZService, access control, improper access control
CVE-2021-25460: An improper access control vulnerability in sspExit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to terminate BlockchainTZService.
Key phrases: terminate BlockchainTZService, improper access control
CVE-2021-25461: An improper length check in APAService prior to SMR Sep-2021 Release 1 results in stack based Buffer Overflow.
Key phrases: buffer overflow
CVE-2021-25462: NULL pointer dereference vulnerability in NPU driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption.
Key phrases: cause memory corruption, null pointer dereference
CVE-2021-25463: Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview.
Key phrases: allows arbitrary webpage loading, arbitrary webpage loading in webview, improper access control
CVE-2021-25464: An improper file management vulnerability in SamsungCapture prior to version 4.8.02 allows sensitive information leak.
Key phrases: sensitive information leak, improper file management
CVE-2021-25465: An improper scheme check vulnerability in Samsung Themes prior to version 5.2.01 allows attackers to perform Man-in-the-middle attack.
Key phrases: perform Man-in-the-middle, scheme check, man-in-the-middle
CVE-2021-25466: Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and obtain Samsung Account token.
Key phrases: obtain Samsung Account token., perform Man-in-the-middle, improper scheme check, man-in-the-middle
CVE-2021-25467: Assuming system privilege is gained, possible buffer overflow vulnerabilities in the Vision DSP kernel driver prior to SMR Oct-2021 Release 1 allows privilege escalation to Root by hijacking loaded library.
Key phrases: Root by hijacking loaded library, buffer overflow, privilege escalation
CVE-2021-25468: A possible guessing and confirming a byte memory vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows attackers to read arbitrary memory address.
Key phrases: read arbitrary memory address, byte memory
CVE-2021-25469: A possible stack-based buffer overflow vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows arbitrary code execution.
Key phrases: allows arbitrary code execution, stack-based buffer overflow, stack based buffer overflow
CVE-2021-25470: An improper caller check logic of SMC call in TEEGRIS secure OS prior to SMR Oct-2021 Release 1 can be used to compromise TEE.
Key phrases: improper caller check logic, compromise tee
CVE-2021-25471: A lack of replay attack protection in Security Mode Command process prior to SMR Oct-2021 Release 1 can lead to denial of service on mobile network connection and battery depletion.
Key phrases: replay attack protection, denial of service, battery depletion
CVE-2021-25472: An improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted application to overwrite some Bluetooth information.
Key phrases: overwrite some Bluetooth information, access control, improper access control
CVE-2021-25473: Assuming a shell privilege is gained, an improper exception handling for multi_sim_bar_hide_by_meadia_full value in SystemUI prior to SMR Oct-2021 Release 1 allows an attacker to cause a permanent denial of service in user device before factory reset.
Key phrases: cause a permanent denial of service in user, shell privilege
CVE-2021-25474: Assuming a shell privilege is gained, an improper exception handling for multi_sim_bar_show_on_qspanel value in SystemUI prior to SMR Oct-2021 Release 1 allows an attacker to cause a permanent denial of service in user device before factory reset.
Key phrases: cause a permanent denial of service in user, shell privilege
CVE-2021-25475: A possible heap-based buffer overflow vulnerability in DSP kernel driver prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution.
Key phrases: allows arbitrary memory, arbitrary memory write and code execution, heap-based buffer overflow, heap based buffer overflow
CVE-2021-25476: An information disclosure vulnerability in Widevine TA log prior to SMR Oct-2021 Release 1 allows attackers to bypass the ASLR protection mechanism in TEE.
Key phrases: bypass the ASLR protection, bypass the ASLR protection mechanism in TEE, information disclosure, bypass aslr
CVE-2021-25477: An improper error handling in Mediatek RRC Protocol stack prior to SMR Oct-2021 Release 1 allows modem crash and remote denial of service.
Key phrases: modem crash and remote denial of service
CVE-2021-25478: A possible stack-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution.
Key phrases: allows arbitrary memory, arbitrary memory write and code execution, stack-based buffer overflow, stack based buffer overflow
CVE-2021-25479: A possible heap-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution.
Key phrases: allows arbitrary memory, arbitrary memory write and code execution, heap-based buffer overflow, heap based buffer overflow
CVE-2021-25480: A lack of replay attack protection in GUTI REALLOCATION COMMAND message process in Qualcomm modem prior to SMR Oct-2021 Release 1 can lead to remote denial of service on mobile network connection.
Key phrases: replay attack protection, remote denial of service
CVE-2021-25481: An improper error handling in Exynos CP booting driver prior to SMR Oct-2021 Release 1 allows local attackers to bypass a Secure Memory Protector of Exynos CP Memory.
Key phrases: bypass a Secure Memory Protector of Exynos CP Memory
CVE-2021-25482: SQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted application to overwrite some CMFA framework information.
Key phrases: overwrite some CMFA framework information, sql injection
CVE-2021-25483: Lack of boundary checking of a buffer in livfivextractor library prior to SMR Oct-2021 Release 1 allows OOB read.
Key phrases: OOB read, oob read
CVE-2021-25484: Improper authentication in InputManagerService prior to SMR Oct-2021 Release 1 allows monitoring the touch event.
Key phrases: monitoring the touch event, improper authentication
CVE-2021-25485: Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Oct-2021 Release 1 allows attackers to write file as system UID via BT remote socket.
Key phrases: write file as system UID via BT remote, path traversal, to write files
CVE-2021-25486: Exposure of information vulnerability in ipcdump prior to SMR Oct-2021 Release 1 allows an attacker detect device information via analyzing packet in log.
Key phrases: an attacker detect device information via analyzing packet
CVE-2021-25487: Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.
Key phrases: OOB read and it results in arbitrary code, oob read, arbitrary code execution
CVE-2021-25488: Lack of boundary checking of a buffer in recv_data() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read.
Key phrases: OOB read, oob read
CVE-2021-25489: Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.
Key phrases: format string bug, kernel panic
CVE-2021-25490: A keyblob downgrade attack in keymaster prior to SMR Oct-2021 Release 1 allows attacker to trigger IV reuse vulnerability with privileged process.
Key phrases: trigger IV reuse vulnerability with privileged process, iv reuse
CVE-2021-25491: A vulnerability in mfc driver prior to SMR Oct-2021 Release 1 allows memory corruption via NULL-pointer dereference.
Key phrases: memory corruption via NULL-pointer dereference, null-pointer dereference
CVE-2021-25492: Lack of boundary checking of a buffer in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows OOB read.
Key phrases: OOB read, oob read
CVE-2021-25493: Lack of boundary checking of a buffer in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows OOB read
Key phrases: OOB read, oob read
CVE-2021-25494: A possible buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitrary code execution.
Key phrases: allows arbitrary code execution, buffer overflow
CVE-2021-25495: A possible heap buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitrary code execution.
Key phrases: allows arbitrary code execution, heap buffer overflow
CVE-2021-25496: A possible buffer overflow vulnerability in maetd_dec_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary code execution.
Key phrases: allows arbitrary code execution, buffer overflow
CVE-2021-25497: A possible buffer overflow vulnerability in maetd_cpy_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary code execution.
Key phrases: allows arbitrary code execution, buffer overflow
CVE-2021-25498: A possible buffer overflow vulnerability in maetd_eco_cb_mode of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary code execution.
Key phrases: allows arbitrary code execution, buffer overflow
CVE-2021-25499: Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of Galaxy Store.
Key phrases: access content provider of Galaxy Store, intent redirection
CVE-2021-25500: A missing input validation in HDCP LDFW prior to SMR Nov-2021 Release 1 allows attackers to overwrite TZASC allowing TEE compromise.
Key phrases: overwrite TZASC allowing TEE compromise, tee compromise
CVE-2021-25501: An improper access control vulnerability in SCloudBnRReceiver in SecTelephonyProvider prior to SMR Nov-2021 Release 1 allows untrusted application to call some protected providers.
Key phrases: call some protected providers, improper access control
CVE-2021-25502: A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ESN value without priviledge.
Key phrases: read ESN value without priviledge, sensitive information
CVE-2021-25503: Improper input validation vulnerability in HDCP prior to SMR Nov-2021 Release 1 allows attackers to arbitrary code execution.
Key phrases: arbitrary code execution, improper input validation
CVE-2021-25504: Intent redirection vulnerability in Group Sharing prior to 10.8.03.2 allows attacker to access contact information.
Key phrases: access contact information, intent redirection
CVE-2021-25505: Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked.
Key phrases: use app without authentication when lockscreen is unlocked, improper authentication
CVE-2021-25506: Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial of service.
Key phrases: access it via malicious content provider or lead, denial of service
CVE-2021-25507: Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC application connected with user device to access part of notification data in Secure Folder without authorization.
Key phrases: access part of notification data in Secure Folder, improper authorization
CVE-2021-25508: Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key without limitation.
Key phrases: abuse the API key without limitation, improper privilege management
CVE-2021-25509: A missing input validation in Samsung Flow Windows application prior to Version 4.8.5.0 allows attackers to overwrite abtraty file in the Windows known folders.
Key phrases: overwrite abtraty file in the Windows known folders, missing input validation
CVE-2021-25510: An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows local arbitrary code execution.
Key phrases: local arbitrary code execution, improper validation
CVE-2021-25511: An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows attackers to write arbitrary files via a path traversal vulnerability.
Key phrases: write arbitrary files, write arbitrary files via a path traversal vulnerability, improper validation
CVE-2021-25512: An improper validation vulnerability in telephony prior to SMR Dec-2021 Release 1 allows attackers to launch certain activities.
Key phrases: launch certain activities, improper validation
CVE-2021-25513: An improper privilege management vulnerability in Apps Edge application prior to SMR Dec-2021 Release 1 allows unauthorized access to some device data on the lockscreen.
Key phrases: some device data on the lockscreen, improper privilege management, unauthorized access
CVE-2021-25514: An improper intent redirection handling in Tags prior to SMR Dec-2021 Release 1 allows attackers to access sensitive information.
Key phrases: access sensitive information, intent redirection handling
CVE-2021-25515: An improper usage of implicit intent in SemRewardManager prior to SMR Dec-2021 Release 1 allows attackers to access BSSID.
Key phrases: access BSSID, implicit intent
CVE-2021-25516: An improper check or handling of exceptional conditions in Exynos baseband prior to SMR Dec-2021 Release 1 allows attackers to track locations.
Key phrases: track locations, exceptional conditions
CVE-2021-25517: An improper input validation vulnerability in LDFW prior to SMR Dec-2021 Release 1 allows attackers to perform arbitrary code execution.
Key phrases: perform arbitrary code execution, input validation, improper input validation
CVE-2021-25518: An improper boundary check in secure_log of LDFW and BL31 prior to SMR Dec-2021 Release 1 allows arbitrary memory write and code execution.
Key phrases: allows arbitrary memory, arbitrary memory write and code execution
CVE-2021-25519: An improper access control vulnerability in CPLC prior to SMR Dec-2021 Release 1 allows local attackers to access CPLC information without permission.
Key phrases: access CPLC information without permission, improper access control
CVE-2021-25520: Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to execute script codes in Samsung Internet.
Key phrases: execute script codes in Samsung Internet, insecure caller check, input validation
CVE-2021-25521: Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get current tab URL in Samsung Internet.
Key phrases: get current tab URL in Samsung Internet, insecure caller check
CVE-2021-25522: Insecure storage of sensitive information vulnerability in Smart Capture prior to version 4.8.02.10 allows attacker to access victim's captured images without permission.
Key phrases: access victim's captured images without permission, insecure storage of sensitive information
CVE-2021-25523: Insecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows attacker to get Samsung Account ID.
Key phrases: get Samsung Account ID, insecure storage
CVE-2021-25524: Insecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to get Samsung Account ID.
Key phrases: get Samsung Account ID, insecure storage
CVE-2021-25525: Improper check or handling of exception conditions vulnerability in Samsung Pay (US only) prior to version 4.0.65 allows attacker to use NFC without user recognition.
Key phrases: use NFC without user recognition, improper check or handling of exception conditions
CVE-2021-25526: Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action.
Key phrases: execute privileged action, intent redirection
CVE-2021-25527: Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to access Bill Pay and Recharge menu without authentication.
Key phrases: access Bill Pay and Recharge menu without authentication, android application components
CVE-2021-25630: "loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolforkit" checks, if it was invoked by the "lool" user, and refuses to run with privileges, if it's not the case. In the vulnerable version of "loolforkit" this check was wrong, so a normal user could start "loolforkit" and eventually get local root privileges.
Key phrases: vulnerable version, root privilege
CVE-2021-25631: In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist but results in ShellExecute attempting to launch an executable type.
Key phrases: denylist
CVE-2021-25633: LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to combine multiple certificate data, which when opened caused LibreOffice to display a validly signed indicator but whose content was unrelated to the signature shown. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.
Key phrases: improper certificate validation
CVE-2021-25634: LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.
Key phrases: improper certificate validation