CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-42580 – Samsung Galaxy S23 instantgame Improper Input Validation Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-42580
Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to install APK from Galaxy Store. La validación de URL incorrecta del enlace profundo MCSLaunch en Galaxy Store anterior a la versión 4.5.64.4 permite a los atacantes ejecutar la API de JavaScript para instalar APK desde Galaxy Store. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S23 smartphones. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the InstantPlaysUrlUtil class. The issue results from a logical error when checking the safety of URIs. • https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12 •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30705
https://notcve.org/view.php?id=CVE-2023-30705
Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.56.6?allows local attackers to access privileged content providers as Galaxy Store permission. • https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=08 • CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-21514 – Samsung Galaxy S22 InstantPlaysDeepLink Permissive List of Allowed Inputs Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-21514
Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S22 smartphones. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the InstantPlaysDeepLink class. The issue results from a permissive list of allowed inputs. An attacker can leverage this vulnerability to execute code in the context of the current user. • https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-21515 – Samsung Galaxy S22 McsWebViewActivity Permissive List of Allowed Inputs Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-21515
InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S22 smartphones. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the McsWebViewActivity class. The issue results from a permissive list of allowed inputs. An attacker can leverage this vulnerability to execute code in the context of the current user. • https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01 • CWE-20: Improper Input Validation •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-21516 – Samsung Galaxy S22 McsWebViewActivity Permissive List of Allowed Inputs Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-21516
XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S22 smartphones. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the McsWebViewActivity class. The issue results from a permissive list of allowed inputs. An attacker can leverage this vulnerability to execute code in the context of the current user. • https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •