CVE-2023-21491

CVE-2023-21491 concerns Samsung ThemeManager before SMR May-2023 Release 1, where an improper access control flaw allows a local attacker to write arbitrary files with system privileges. Multiple sources corroborate that the issue is rooted in ThemeManager and affects Samsung mobile devices, with...

CVE-2023-21488

Improper access control vulnerablility in Tips prior to SMR May-2023 Release 1 allows local attackers to launch arbitrary activity in Tips...

CVE-2023-21501

Improper input validation vulnerability in mPOS fiserve trustlet prior to SMR May-2023 Release 1 allows local attackers to execute arbitrary code...

CVE-2023-21493

CVE-2023-21493 affects SemShareFileProvider prior to SMR May-2023 Release 1. The vulnerability is an improper access-control issue that enables local attackers to access protected data. Root cause is insufficient access restrictions on SemShareFileProvider components. Affected software is SemShar...

CVE-2023-21502

Improper input validation vulnerability in FactoryTest application prior to SMR May-2023 Release 1 allows local attackers to get privilege escalation via debugging commands...

CVE-2023-21498

CVE-2023-21498 concerns Samsung’s mPOS TUI trustlet. The vulnerability is an improper input validation flaw in the function setPartnerTAInfo, which can allow a local attacker to overwrite trustlet memory. The issue is addressed in the SMR May-2023 Release 1 or later (per multiple sources in the c...

CVE-2023-21487

Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to change a call setting...

PT-2023-18239 · Unknown · Call Settings

Name of the Vulnerable Software and Affected Versions: Call Settings versions prior to SMR May-2023 Release 1 Description: The issue allows physical attackers to access some media data stored in sandbox due to an improper export of android application components vulnerability in...

CVE-2023-21493

Improper access control vulnerability in SemShareFileProvider prior to SMR May-2023 Release 1 allows local attackers to access protected data...

CVE-2023-21500

The CVE-2023-21500 entry describes a double free validation issue in the mPOS TUI trustlet’s setPinPadImages function. Affected component: mPOS TUI trustlet prior to Samsung SMR May-2023 Release 1. Root cause: improper memory handling allows local attackers to access the trustlet memory. Impact i...

CVE-2023-21502

CVE-2023-21502 affects the FactoryTest application prior to Samsung SMR May-2023 Release 1. Root cause is improper input validation, enabling local privilege escalation via debugging commands. Public details consistently describe local access requirements and privilege escalation; no remote/vecto...

CVE-2023-21497

CVE-2023-21497 affects the mPOS TUI trustlet (Samsung devices) prior to SMR May-2023 Release 1. It arises from an externally-controlled format string vulnerability that could allow a local attacker to access memory addresses. Affected component: mPOS TUI trustlet; root cause: format string handli...

(Pwn2Own) VMware Workstation UHCI Component Uninitialized Variable Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of VMware Workstation. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

Microsoft Windows win32kfull Null Pointer Dereference Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...

(Pwn2Own) Oracle VirtualBox GPA Request Handling Uninitialized Memory Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

(Pwn2Own) Oracle VirtualBox OHCI USB Controller Uninitialized Memory Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

Microsoft Windows win32kfull Null Pointer Dereference Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...

Microsoft Windows win32kfull Null Pointer Dereference Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...

Microsoft Windows win32kfull Null Pointer Dereference Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...

Microsoft Windows win32kfull Null Pointer Dereference Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...