CVE-2023-21429

Vulnerable component: Samsung ePDG. Issue stems from improper usage of implicit intent in ePDG prior to SMR JAN-2023 Release 1, enabling an attacker to access the SSID. Impact is limited to local access (per CVSS) with low confidentiality impact as described in the sources. Remediation: apply Sam...

CVE-2023-21436

Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID...

CVE-2023-21447

Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access information with Samsung Cloud's privilege via implicit intent...

PT-2023-18202 · Contacts · Contacts

Name of the Vulnerable Software and Affected Versions: Contacts versions prior to SMR Feb-2023 Release 1 Description: The issue is related to the improper usage of implicit intent in Contacts, which allows an attacker to obtain an account ID. Recommendations: For versions prior to SMR Feb-2023...

CVE-2023-21445

CVE-2023-21445 concerns an improper access control vulnerability in Samsung MyFiles. Affected platforms include Android R (11) versions prior to 12.2.09, Android S (12) prior to 13.1.03.501, and Android T (13) prior to 14.1.00.422. The flaw allows a local attacker to write a file with MyFiles pri...

ASB-A-244154558

In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-20904

In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2023-20904

In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Code injection

In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2023-17694 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-12L through Android-13 Description: The issue is related to a possible launch of arbitrary activity due to an Intent mismatch in the code of SettingsActivity.java. This could lead to local escalation of privilege with...

CVE-2023-20904

In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2023-20904

In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

ASB-A-246300272

In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2022-20512

In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2022-20512

In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Input validation

In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2022-20512

In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2022-14725 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to improper input validation in the navigateUpTo function of Task.java, which could allow launching an intent handler with a mismatched intent. This could lead to local escalation ...

CVE-2022-39915

Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q10, 12.2.11.3000 in Android R11, 12.3.07.2000 in Android S12, and 12.4.02.0 in Android T13 allows attackers to access sensitive information via implicit intent...

CVE-2022-39915

Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q10, 12.2.11.3000 in Android R11, 12.3.07.2000 in Android S12, and 12.4.02.0 in Android T13 allows attackers to access sensitive information via implicit intent...