CVE-2023-45591

CVE-2023-45591 describes a CWE-122 heap-based overflow in the logger_generic function of the Ax_rtu binary on AiLux imx6 bundle. A remote authenticated attacker could trigger memory corruption in the process context, with potential DoS and possible arbitrary code execution with root privileges, a...

CVE-2022-48630

CVE-2022-48630 affects the Linux kernel crypto: qcom-rng. The issue is an infinite loop in qcom_rng_read() when max is not a multiple of WORD_SZ, caused by removing a break in the else branch. The fix re-adds the break (a simple patch) to avoid looping. The vulnerability was demonstrated/tested o...

CVE-2022-48629

Summary : CVE-2022-48629 affects the Linux kernel crypto RNG for Qualcomm (qcom-rng). The issue arises in qcom_rng_read() and qcom_rng_generate() where the destination buffer may not be fully filled on success, leaving trailing zeros when the RNG can return 0 from the generate() function. This co...

CVE-2023-5457

CVE-2023-5457 is a CWE-1269 issue in the Django-based application where debug=True in Django causes exposure of sensitive information. It affects AiLux imx6 bundle prior to version imx6_1.0.7-2. Root cause: non-release configuration leaking data. Impact: confidentiality, integrity, and availabili...

Hardcoded credentials

A CWE-798 “Use of Hard-coded Credentials” vulnerability in the MariaDB database of the web application allows a remote unauthenticated attacker to access the database service and all included data with the same privileges of the web application. This issue affects: AiLux imx6 bundle below version...

CVE-2023-5456

CVE-2023-5456 is a CWE-798 vulnerability affecting AiLux imx6 bundle prior to version imx6_1.0.7-2. The issue arises from hard-coded credentials in the MariaDB database used by the web application, enabling a remote unauthenticated attacker to access the database service and all data with the web...

Code injection

swftools v0.9.2 was discovered to contain a strcpy parameter overlap via /home/swftools/src/swfc+0x48318a...

Design/Logic Flaw

swftools v0.9.2 was discovered to contain a segmentation violation via the function sfont at swftools/src/swfc.c...

Design/Logic Flaw

swftools v0.9.2 was discovered to contain a segmentation violation via the function freelines at swftools/lib/modules/swfshape.c...

Hardcoded credentials

Maintenance Server, in Cybellum's QCOW air-gapped distribution China Edition, versions 2.15.5 through 2.27, was compiled with a hard-coded private cryptographic key. An attacker with administrative privileges & access to the air-gapped server could potentially use this key to run commands on the...

CVE-2023-42419

The CVE-2023-42419 issue affects Cybellum's Maintenance Server in the QCOW air-gapped distribution (China Edition) for versions 2.15.5 through 2.27. It was compiled with a hard-coded private cryptographic key, enabling an attacker with administrative privileges and access to the air-gapped server...

Input validation

Improper validation vulnerability in Samsung Internet prior to version 24.0.3.2 allows local attackers to execute arbitrary code...

Information disclosure

The sensitive information exposure vulnerability in WlanTest prior to SMR Mar-2024 Release 1 allows local attackers to access MAC address without proper permission...

Input validation

Improper handling of granting permission for Trusted Web Activities in Samsung Internet prior to version 24.0.0.41 allows local attackers to grant permission to their own TWA WebApps without user interaction...

Stack overflow

Stack overflow in Little Kernel in bootloader prior to SMR Mar-2024 Release 1 allows a privileged attackers to execute arbitrary code...

Heap overflow

Heap overflow in Little Kernel in bootloader prior to SMR Mar-2024 Release 1 allows a privileged attacker to execute arbitrary code...

Input validation

Improper Handling of Insufficient Privileges in Samsung Account prior to version 14.8.00.3 allows local attackers to access data...

CVE-2024-20841

The CVE-2024-20841 issue affects Samsung Account on Samsung mobile devices, where versions prior to 14.8.00.3 improperly handle privileges, allowing local attackers to access data (confidentiality impact). Root cause: insufficient privilege checks enabling data exposure. Affected: Samsung Account...

CVE-2024-20838

Samsung Internet prior to version 24.0.3.2 contains an improper validation vulnerability that could allow local attackers to execute arbitrary code. Affected: Samsung Internet on supported Samsung devices (pre-24.0.3.2). Root cause: improper validation in the browser component. Impact: local code...

CVE-2024-20836

CVE-2024-20836 describes an out-of-bounds read in libsubextractor.so (ssmis_get_frm) prior to SMR Mar-2024 Release 1, enabling local attackers to read memory. Affected: libsubextractor.so; Impact: read access to out-of-bounds memory. Mitigation: upgrade to SMR Mar-2024 Release 1 or later; tempora...