Page 24 of 926 results (0.004 seconds)

CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0

A possible arbitrary memory overwrite vulnerabilities in quram library version prior to SMR Jan-2021 Release 1 allow arbitrary code execution. Una posible vulnerabilidad de sobrescritura de memoria arbitraria en la biblioteca quram versión anterior a SMR Jan-2021 Release 1, permite una ejecución de código arbitraria This vulnerability allows remote attackers to disclose sensitive information on affected installations of Samsung Galaxy S20. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Quram ImageCodec component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. • https://security.samsungmobile.com https://security.samsungmobile.com/securityUpdate.smsb https://www.zerodayinitiative.com/advisories/ZDI-21-342 • CWE-787: Out-of-bounds Write •

CVSS: 4.0EPSS: 0%CPEs: 65EXPL: 0

Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0) and above) allows unauthorized actions including denial of service attack by hijacking the provider. Llamar a un proveedor inexistente en Samsung Members anterior a la versión 2.4.81.13 (en Android O(8.1) y por debajo) y 3.8.00.13 (en Android P(9.0) y por encima), permite acciones no autorizadas, incluyendo el ataque de denegación de servicio al secuestrar el proveedor • https://security.samsungmobile.com https://security.samsungmobile.com/serviceWeb.smsb • CWE-287: Improper Authentication •

CVSS: 4.0EPSS: 0%CPEs: 64EXPL: 0

Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of service attack by hijacking the provider. Llamar a un proveedor inexistente en SMP sdk anterior a la versión 3.0.9, permite acciones no autorizadas, incluyendo el ataque de denegación de servicio mediante el secuestro del proveedor • https://security.samsungmobile.com https://security.samsungmobile.com/serviceWeb.smsb • CWE-287: Improper Authentication •

CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. In preloaded applications, the HostnameVerified default is mishandled. The LG ID is LVE-SMP-200029 (February 2021). Se detectó un problema en los dispositivos móviles LG con software de Sistema Operativo Android versiones 8.0, 8.1, 9.0 y 10. En aplicaciones precargadas, el HostnameVerified es manejado inapropiadamente. • https://lgsecurity.lge.com •

CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. The USB laf gadget has a use-after-free. The LG ID is LVE-SMP-200031 (February 2021). Se detectó un problema en los dispositivos móviles LG con software de Sistema Operativo Android versiones 8.0, 8.1, 9.0 y 10. El gadget laf USB presenta un uso de la memoria previamente liberada. • https://lgsecurity.lge.com • CWE-416: Use After Free •