Browse CVEs

HIGH 7.5 CVE-2022-40760 A Buffer Access with Incorrect Length Value vulnerablity in the TEE_MACUpdate function in Samsung mTower through 0.3.0 allows a trusted application t… Mtower after 0.3.0 Fix from $1,9502022-09-16 HIGH 7.5 CVE-2022-40761 The function tee_obj_free in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function … Mtower after 0.3.0 Fix from $1,9502022-09-16 HIGH 7.5 CVE-2022-40762 A Memory Allocation with Excessive Size Value vulnerablity in the TEE_Realloc function in Samsung mTower through 0.3.0 allows a trusted application t… Mtower after 0.3.0 Fix from $1,9502022-09-16 HIGH 7.8 CVE-2022-39846 DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.22083_3 allows attacker to execute arbitrary code. Smart Switch Pc 4.3.22083_3+ Fix from $1,9502022-09-09 HIGH 7.1 CVE-2022-39844 Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrary directo… Smart Switch Pc 4.3.22083+ Fix from $1,9502022-09-09 HIGH 7.1 CVE-2022-39845 Improper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attackers to delete arbitrary director… Kies 2.6.4.22074+ Fix from $1,9502022-09-09 MEDIUM 6.2 CVE-2022-36874 Improper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin prior to 2.2.11.22040751 allows attacker to access device IM… Galaxy Watch Plugin 2.2.11.22040751+ Fix from $1,6002022-09-09 MEDIUM 5.5 CVE-2022-36875 Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 allows attacker to access the f… Galaxy Watch Plugin 2.2.11.22081151+ Fix from $1,6002022-09-09 HIGH 7.8 CVE-2022-36864 Improper access control and intent redirection in Samsung Email prior to 6.1.70.20 allows attacker to access specific formatted file and execute priv… Samsung Email 6.1.70.20+ Fix from $1,9502022-09-09 MEDIUM 6.5 CVE-2022-36870 Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows att… Samsung Pay 5.0.63 / 5.1.47+ Fix from $1,6002022-09-09 MEDIUM 6.5 CVE-2022-36871 Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to acc… Samsung Pay 5.0.63 / 5.1.47+ Fix from $1,6002022-09-09 MEDIUM 6.5 CVE-2022-36872 Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to ac… Samsung Pay 5.0.63 / 5.1.47+ Fix from $1,6002022-09-09 MEDIUM 6.5 CVE-2022-36873 Improper restriction of broadcasting Intent in GalaxyStoreBridgePageLinker of?Waterplugin prior to version 2.2.11.22081151 leaks MAC address of the c… Galaxy Watch Plugin 2.2.11.22081151+ Fix from $1,6002022-09-09 MEDIUM 6.1 CVE-2022-36869 Improper access control vulnerability in ContactsDumpActivity of?Contacts Provider prior to version 12.7.59 allows attacker to access the file withou… Contacts Provider 12.7.59+ Fix from $1,6002022-09-09 MEDIUM 5.5 CVE-2022-36867 Improper access control vulnerability in Editor Lite prior to version 4.0.40.14 allows attackers to access sensitive information. Editor Lite 4.0.40.14+ Fix from $1,6002022-09-09 HIGH 7.5 CVE-2022-40280 An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a m… Tizenrt Mitigation only Fix from $1,9502022-09-08 HIGH 7.5 CVE-2022-40281 An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). cyassl_connect_step2 in curl/vtls/cyassl.c has a missing X509_free after SS… Tizenrt Mitigation only Fix from $1,9502022-09-08 HIGH 7.5 CVE-2022-39828 sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_private_key, leading to a denial of service. Mtower after 0.3.0 Fix from $1,9502022-09-05 HIGH 7.5 CVE-2022-39829 There is a NULL pointer dereference in aes256_encrypt in Samsung mTower through 0.3.0 due to a missing check on the return value of EVP_CIPHER_CTX_ne… Mtower after 0.3.0 Fix from $1,9502022-09-05 HIGH 7.5 CVE-2022-39830 sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_public_key_affine_coordinates, leading to a denial… Mtower after 0.3.0 Fix from $1,9502022-09-05 HIGH 7.5 CVE-2022-36621 Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_AllocateTransientObject. Mtower after 0.3.0 Fix from $1,9502022-09-01 HIGH 7.5 CVE-2022-36622 Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_GetObjectInfo1. Mtower after 0.3.0 Fix from $1,9502022-09-01 HIGH 7.5 CVE-2022-38155 TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted application to achieve Excessive Memory Allocation via a large len value, as demonstrated… Mtower after 0.3.0 Fix from $1,9502022-08-11 HIGH 7.8 CVE-2022-36833 Improper Privilege Management vulnerability in Game Optimizing Service prior to versions 3.3.04.0 in Android 10, and 3.5.04.8 in Android 11 and above… Gameoptimizingservice 3.3.04.0 / 3.5.04.8+ Fix from $1,9502022-08-05 HIGH 7.8 CVE-2022-36840 DLL hijacking vulnerability in Samsung Update Setup prior to version 2.2.9.50 allows attackers to execute arbitrary code. Update 2.2.9.50+ Fix from $1,9502022-08-05 MEDIUM 5.5 CVE-2022-36836 Unprotected provider vulnerability in Charm by Samsung prior to version 1.2.3 allows attackers to read connection state without permission. Charm Firmware 1.2.3+ Fix from $1,6002022-08-05 MEDIUM 5.5 CVE-2022-36837 Intent redirection vulnerability using implicit intent in Samsung email prior to version 6.1.70.20 allows attacker to get sensitive information. Samsung Email 6.1.70.20+ Fix from $1,6002022-08-05 MEDIUM 5.5 CVE-2022-36839 SQL injection vulnerability via IAPService in Samsung Checkout prior to version 5.0.53.1 allows attackers to access IAP information. Checkout 5.0.53.1+ Fix from $1,6002022-08-05 MEDIUM 5.0 CVE-2022-36834 Exposure of Sensitive Information vulnerability in Game Launcher prior to version 6.0.07 allows local attacker to access app data with user interacti… Game Launcher 6.0.07+ Fix from $1,6002022-08-05 MEDIUM 5.5 CVE-2022-33734 Sensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection info… Charm 1.2.3+ Fix from $1,6002022-08-05