CVE-2023-21501

Improper input validation vulnerability in mPOS fiserve trustlet prior to SMR May-2023 Release 1 allows local attackers to execute arbitrary code...

PT-2023-18239 · Unknown · Call Settings

Name of the Vulnerable Software and Affected Versions: Call Settings versions prior to SMR May-2023 Release 1 Description: The issue allows physical attackers to access some media data stored in sandbox due to an improper export of android application components vulnerability in...

CVE-2023-21497

CVE-2023-21497 affects the mPOS TUI trustlet (Samsung devices) prior to SMR May-2023 Release 1. It arises from an externally-controlled format string vulnerability that could allow a local attacker to access memory addresses. Affected component: mPOS TUI trustlet; root cause: format string handli...

CVE-2023-21502

Improper input validation vulnerability in FactoryTest application prior to SMR May-2023 Release 1 allows local attackers to get privilege escalation via debugging commands...

CVE-2023-21488

CVE-2023-21488 affects Samsung Tips prior to SMR May-2023 Release 1. Root cause: improper access control allowing local attackers to launch arbitrary activities in Tips. Affected software: Tips (Samsung mobile devices) before the May-2023 update. Mitigation: upgrade to SMR May-2023 Release 1 or l...

CVE-2023-21487

Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to change a call setting...

PT-2023-18251 · Unknown · Mpos Tui Trustlet

Name of the Vulnerable Software and Affected Versions: mPOS TUI trustlet versions prior to SMR May-2023 Release 1 Description: The issue allows local attackers to access the memory address due to the use of an externally-controlled format string vulnerability in the mPOS TUI trustlet...

CVE-2023-21498

CVE-2023-21498 concerns Samsung’s mPOS TUI trustlet. The vulnerability is an improper input validation flaw in the function setPartnerTAInfo, which can allow a local attacker to overwrite trustlet memory. The issue is addressed in the SMR May-2023 Release 1 or later (per multiple sources in the c...

CVE-2023-21502

CVE-2023-21502 affects the FactoryTest application prior to Samsung SMR May-2023 Release 1. Root cause is improper input validation, enabling local privilege escalation via debugging commands. Public details consistently describe local access requirements and privilege escalation; no remote/vecto...

CVE-2023-21487

Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to change a call setting...

CVE-2023-21491

CVE-2023-21491 concerns Samsung ThemeManager before SMR May-2023 Release 1, where an improper access control flaw allows a local attacker to write arbitrary files with system privileges. Multiple sources corroborate that the issue is rooted in ThemeManager and affects Samsung mobile devices, with...

PT-2023-18245 · Unknown · Thememanager

Name of the Vulnerable Software and Affected Versions: ThemeManager versions prior to SMR May-2023 Release 1 Description: The issue is related to improper access control in ThemeManager, allowing local attackers to write arbitrary files with system privilege. Recommendations: For versions prior t...

CVE-2023-21499

Out-of-bounds write vulnerability in TACommunicationmposencryptpin in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to execute arbitrary code...

CVE-2023-21484

Improper access control vulnerability in AppLock prior to SMR May-2023 Release 1 allows local attackers without proper permission to execute a privileged operation...

PT-2023-18257 · Unknown · Factorytest

Name of the Vulnerable Software and Affected Versions: FactoryTest application prior to SMR May-2023 Release 1 Description: The issue is related to improper input validation in the FactoryTest application, allowing local attackers to achieve privilege escalation through debugging commands...

(Pwn2Own) VMware Workstation UHCI Component Uninitialized Variable Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of VMware Workstation. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

Microsoft Windows win32kfull Null Pointer Dereference Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...

(Pwn2Own) Oracle VirtualBox VGA MMIO Handling Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

(Pwn2Own) Oracle VirtualBox OHCI USB Controller Uninitialized Memory Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

Microsoft Windows win32kfull Null Pointer Dereference Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...