CVE-2024-20885

CVE-2024-20885 affects Samsung Dialer prior to SMR May-2024 Release 1. The vulnerability is an improper component protection issue that allows local attackers to place a call without proper permission. Impact is described as local, with low to medium severities in provided metrics (CVSS base scor...

CVE-2024-20884

CVE-2024-20884 affects the getSemBatteryUsageStats function in BatteryStatsService. The issue is described as an incorrect use of a privileged API that could allow a local attacker to access privileged API calls. The vulnerability is associated with Samsung/Mobile platforms and is tied to the SMR...

CVE-2024-20883

CVE-2024-20883 involves incorrect use of a privileged API in BatteryStatsService.registerBatteryStatsCallback. Affected component: BatteryStatsService (Android/Samsung). Prior to SMR Jun-2024 Release 1, local attackers with low privileges and no user interaction could exploit the vulnerable API t...

CVE-2024-20882

CVE-2024-20882 describes an out-of-bounds read in the bootloader prior to SMR June-2024 Release 1. The issue enables a physical attacker to access arbitrary data from the device via the bootloader component. The vulnerability is tied to a trusted code path executed with physical access and requir...

CVE-2024-20881

CVE-2024-20881 affects chnactiv TA prior to SMR Jun-2024 Release 1. The issue is due to improper input validation, enabling local privileged attackers to potentially execute arbitrary code. The connected documents confirm the vulnerability description but do not provide explicit remediation steps...

CVE-2024-20880

CVE-2024-20880 describes a stack-based buffer overflow in the bootloader before SMR Jun-2024 Release 1, enabling a physical attacker to overwrite memory. Documents consistently identify the issue as affecting the bootloader with a physical attack vector and potential memory overwrite impact, but ...

CVE-2024-20879

CVE-2024-20879 affects the library component libsavscmn.so prior to Samsung SMR Jun-2024 Release 1. The vulnerability stems from improper input validation in libsavscmn.so, enabling local attackers to write out-of-bounds memory. Impact is indicated as local access with potential integrity/availab...

CVE-2024-20878

CVE-2024-20878 describes a heap out-of-bounds write in parsing grid image within libsavscmn.so, prior to SMR June-2024 Release 1. This local vulnerability allows an attacker with local access to potentially execute arbitrary code. Affected detail in public sources consistently cites the same root...

CVE-2024-20877

Summary: CVE-2024-20877 appears in multiple feeds as a heap out-of-bounds write vulnerability in the grid image header parsing of libsavscmn.so, prior to Samsung SMR Jun-2024 Release 1, enabling local arbitrary code execution. Documents confirm the affected component and impact (local code execut...

CVE-2024-20876

CVE-2024-20876 affects the libsheifdecadapter.so component. The issue is due to improper input validation, enabling local attackers to trigger memory corruption prior to the SMR Jun-2024 Release 1. This vulnerability is local, with high potential impact on confidentiality, integrity, and availabi...

CVE-2024-20875

This CVE affects SemClipboard. The vulnerability is due to improper caller verification, enabling a local attacker to access arbitrary files through the SemClipboard component prior to SMR June-2024 Release 1. Impact is confined to local access with confidentiality impact; no exploit details are ...

CVE-2024-20874

CVE-2024-20874 affects Samsung SmartManagerCN prior to SMR Jun-2024 Release 1. The vulnerability is an improper access control that enables local attackers to perform privileged activities. The NVD metrics show a • LOCAL • LOW complexity • NONE/LOW privileges required with HIGH confidentiality, i...

CVE-2024-20873

The CVE-2024-20873 entry concerns an improper input validation vulnerability in the caminfo driver (Samsung Mobile) prior to the SMR Jun-2024 Release 1. The underlying issue allows local privileged attackers to result in a write out-of-bounds memory condition. Documents consistently describe the ...

CVE-2024-5485

CVE-2024-5485 affects the SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! WordPress plugin. The stored XSS exists in the Trigger Link shortcode in all versions up to 1.0.47 (per the CVE description) and can be exploited by an authenticated user with contributor-level a...

CVE-2024-4856

CVE-2024-4856 refers to the FS Product Inquiry WordPress plugin (versions ≤ 1.1.1) and describes a reflected XSS flaw. The vulnerability arises from not sanitising/escaping a parameter before echoing it on the page, potentially impacting admins or unauthenticated users. Public sources corroborate...

CVE-2024-4857

CVE-2024-4857 affects the WordPress plugin “FS Product Inquiry” for versions up to 1.1.1, where user input in form submissions is not sanitized/escaped, enabling unauthenticated Stored XSS. Affected product: FS Product Inquiry WordPress plugin

CVE-2024-0757

CVE-2024-0757 : The WordPress plugin “Insert or Embed Articulate Content into WordPress” (

CVE-2024-4749

The CVE-2024-4749 entry concerns the WP eMember WordPress plugin (versions before 10.3.9). The vulnerability is a Reflected XSS due to the fieldId parameter not being sanitized/escaped before echo, potentially enabling script injection in output pages. Public details confirm affected software and...

CVE-2024-4057

The CVE-2024-4057 issue affects Gutenberg Blocks with AI by Kadence WP for WordPress, where certain block attributes are not validated/escaped before they are output in a page/post containing the block. This can allow stored XSS by users with contributor role and above. Root cause: output of unva...

CVE-2024-4750

The CVE-2024-4750 entry concerns the BuddyBoss Platform WordPress plugin prior to 2.6.0, where an Insecure Direct Object Reference (IDOR) allows a user to like a private post by manipulating the post ID in the request (id parameter). Multiple sources (Patchstack, PT-Security, WPVulndb, CVE record...