CVE-2022-36849

CVE-2022-36849 is a use-after-free vulnerability in the sdp_mm_set_process_sensitive function of the sdpmm driver, affecting Samsung devices in the SMR Sep-2022 Release 1. The issue arises from post-release reuse in the sdpmm driver and could allow malicious actions. Publicly documented impact fo...

CVE-2022-36841

Affected software: libSDKRecognitionText.spensdk.samsung.so on Samsung devices. Vulnerability: heap-based overflow in PrepareRecogLibrary_Part function prior to SMR Sep-2022 Release 1, causing memory access fault. Exploitability/impact: CVE reports local access with memory impact; no explicit exp...

CVE-2022-36841

A heap-based overflow vulnerability in PrepareRecogLibraryPart function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault...

CVE-2022-36847

CVE-2022-36847 describes a use-after-free in the MTP driver’s mtp_send_signal function on Samsung Mobile devices, prior to the SMR Sep-2022 Release 1. The vulnerability could enable attackers to perform malicious actions locally; affected component is the MTP driver, with impact described as high...

PT-2022-23658 · Samsung · Libapexjni.Media.Samsung.So

Name of the Vulnerable Software and Affected Versions: libapexjni.media.samsung.so versions prior to SMR Sep-2022 Release 1 Description: The issue is related to an out of bound read in the libapexjni.media.samsung.so library, which allows an attacker to access unauthorized information...

Microsoft Edge (Chromium-Based) Insufficient data validation Vulnerability (Sep 2022)

This host is missing an important security update according to Microsoft Edge Chromium-Based update. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

FlatPress <= 1.2.1 XSS Vulnerability (Sep 2021)

FlatPress is prone to a cross-site scripting XSS vulnerability in the blog content. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft OMI Management Interface Authentication Bypass

By removing the authentication exchange, an attacker can issue requests to the local OMI management socket that will cause it to execute an operating system command as the root user. This vulnerability was patched in OMI version 1.6.8-1 released September 8th 2021. Module Options msf use...

Microsoft OMI Management Interface Authentication Bypass

By removing the authentication header, an attacker can issue an HTTP request to the OMI management endpoint that will cause it to execute an operating system command as the root user. This vulnerability was patched in OMI version 1.6.8-1 released September 8th 2021. Module Options msf use...

Description of the security update for Office Online Server: September 14, 2021 (KB5001999)

None None...

Security Updates for Microsoft Office Products (September 2021)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A session spoofing vulnerability exists. An attacker can exploit this to perform actions with the privileges of another user. CVE-2021-38650 - A remote code execution vulnerabilit...

CVE-2021-25461

An improper length check in APAService prior to SMR Sep-2021 Release 1 results in stack based Buffer Overflow...

CVE-2021-25462

NULL pointer dereference vulnerability in NPU driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption...

CVE-2021-25453

Some improper access control in Bluetooth APIs prior to SMR Sep-2021 Release 1 allows untrusted application to get Bluetooth information...

CVE-2021-25455

OOB read vulnerability in libsaviextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to access arbitrary address through pointer via forged avi file...

CVE-2021-25456

OOB read vulnerability in libswmfextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute memcpy at arbitrary address via forged wmf file...

CVE-2021-25457

An improper input validation vulnerability in DSP driver prior to SMR Sep-2021 Release 1 allows local attackers to get a limited kernel memory information...

CVE-2021-25458

NULL pointer dereference vulnerability in ION driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption...

CVE-2021-25459

An improper access control vulnerability in sspInit in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to start BlockchainTZService...

CVE-2021-25450

Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Sep-2021 Release 1 allows attackers to write file as system uid via remote socket...