Page 23 of 1544 results (0.014 seconds)

CVSS: 4.0EPSS: 0%CPEs: 64EXPL: 0

Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of service attack by hijacking the provider. Llamar a un proveedor inexistente en SMP sdk anterior a la versión 3.0.9, permite acciones no autorizadas, incluyendo el ataque de denegación de servicio mediante el secuestro del proveedor • https://security.samsungmobile.com https://security.samsungmobile.com/serviceWeb.smsb • CWE-287: Improper Authentication •

CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 1

On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) device to pair silently with a vulnerable target device, without any user interaction, when the target device's Bluetooth is on, and it is running an app that offers a connectable BLE advertisement. An example of such an app could be a Bluetooth-based contact tracing app, such as Australia's COVIDSafe app, Singapore's TraceTogether app, or France's TousAntiCovid (formerly StopCovid). As part of the pairing process, two pieces (among others) of personally identifiable information are exchanged: the Identity Address of the Bluetooth adapter of the target device, and its associated Identity Resolving Key (IRK). Either one of these identifiers can be used to perform re-identification of the target device for long term tracking. The list of affected devices includes (but is not limited to): Galaxy Note 5, Galaxy S6 Edge, Galaxy A3, Tab A (2017), J2 Pro (2018), Galaxy Note 4, and Galaxy S5. • https://github.com/alwentiu/contact-tracing-research/blob/main/samsung.pdf •

CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0

If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This was fixed by removing the Remote Debugging via USB feature from affected devices. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. • https://bugzilla.mozilla.org/show_bug.cgi?id=1658865 https://www.mozilla.org/security/advisories/mfsa2020-50 •

CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0

An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 software. Certain automated testing is mishandled. The LG ID is LVE-SMP-200019 (August 2020). Se detectó un problema en los dispositivos móviles LG con software de Sistema Operativo Android versiones 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0 y 10. Determinadas pruebas automatizadas se manejan inapropiadamente. • https://lgsecurity.lge.com •

CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0

An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 software. Key logging may occur because of an obsolete API. The LG ID is LVE-SMP-170010 (August 2020). Se detectó un problema en los dispositivos móviles LG con software de Sistema Operativo Android versiones 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0 y 10. El registro de claves puede ocurrir debido a una API obsoleta. • https://lgsecurity.lge.com • CWE-203: Observable Discrepancy •