Improper access control

Improper address validation in HArx in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernel, to corrupt EL2 memory...

CVE-2021-25346

CVE-2021-25346 affects Samsung quram library, with vulnerable versions prior to SMR Jan-2021 Release 1. The root cause is an arbitrary memory overwrite that can lead to arbitrary code execution. Publicly documented impact aligns with memory corruption in quram components; Samsung has released sec...

CVE-2021-25347

CVE-2021-25347 affects the Samsung Email application. A hijacking vulnerability in versions prior to the SMR Feb-2021 Release 1 could allow an attacker to intercept when the provider is executed. The available documents consistently describe interception as the impact, but do not provide detailed...

CVE-2021-25347

Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the provider is executed...

CVE-2021-25344

Missing permission check in knoxcustom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number without permission...

CVE-2021-25344

The CVE-2021-25344 issue affects Samsung knox_custom service (mobile app). Root cause: missing privilege check in knox_custom before SMR Mar-2021 Release 1. Impact: attacker may access the device serial number without permission (local attack). Public details confirm the vulnerability and timing;...

CVE-2021-25340

CVE-2021-25340 concerns Samsung Keyboard prior to SMR Feb‑2021 Release 1, with an improper access control flaw that enables physically proximate attackers to change arbitrary settings during the Initialization State. The issue affects Samsung Keyboard software and is exploitable without user inte...

CVE-2021-25340

Improper access control vulnerability in Samsung keyboard version prior to SMR Feb-2021 Release 1 allows physically proximate attackers to change in arbitrary settings during Initialization State...

CVE-2021-25339

The CVE-2021-25339 entry relates to Samsung mobile devices with an improper address validation in HArx. Root cause stated: incorrect address validation can allow memory corruption in EL2 when the kernel is compromised. Affected scope is Samsung mobile devices prior to SMR Mar-2021 Release 1; expl...

CVE-2021-25338

CVE-2021-25338 describes an improper memory access control weakness in the RKP of Samsung mobile devices prior to the SMR Mar-2021 Release 1. The issue allows a compromised kernel to write portions of the RKP EL2 memory region, implying local attacker capabilities with kernel-level access and pot...

CVE-2021-25338

Improper memory access control in RKP in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernel, to write certain part of RKP EL2 memory region...

CVE-2021-25337

CVE-2021-25337 is an Samsung-only vulnerability in the clipboard content provider (system_server) that allowed untrusted apps to read/write arbitrary files via improper access control before SMR Mar-2021 Release 1. The issue stems from missing access checks in the SemClipboardProvider.insert path...

CVE-2021-25336

Improper access control in NotificationManagerService in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to acquire notification access via sending a crafted malicious intent...

CVE-2021-25336

CVE-2021-25336 affects Samsung mobile devices via improper access control in NotificationManagerService. The root cause is insufficient access checks that allow untrusted applications to obtain notification access by sending a crafted malicious intent. Documented impact is limited to exploitation...

CVE-2021-25335

Improper lockscreen status check in cocktailbar service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows unauthenticated users to access hidden notification contents over the lockscreen in specific condition...

CVE-2021-25334

Improper input check in wallpaper service in Samsung mobile devices prior to SMR Feb-2021 Release 1 allows untrusted application to cause permanent denial of service...

Design/Logic Flaw

Calling of non-existent provider in MobileWips application prior to SMR Feb-2021 Release 1 allows unauthorized actions including denial of service attack by hijacking the provider...

CVE-2021-25330

The CVE-2021-25330 entry concerns Samsung MobileWips (MobileWips app) on Samsung devices. Public descriptions indicate a flaw where calling a non-existent provider enables unauthorized actions, including a denial-of-service attack by hijacking the provider, and that this affects the version prior...

smr-ovoschi.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1161838 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2019-6740

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update SMR-JAN-2019 - SVE-2018-13467. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or...