Known Exploited

    Dashboard / Known Exploited

    Filters
    5.5
    Medium

    CVE-2023-41991

    Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.

    Alert Date:25 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.apple.com/en-us/HT213926, https://support.apple.com/en-us/HT213927, https://support.apple.com/en-us/HT213928, https://support.apple.com/en-us/HT213929, https://support.apple.com/en-us/HT213931 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41991

    7.8
    High

    CVE-2023-41992

    Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.

    Alert Date:25 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.apple.com/en-us/HT213926, https://support.apple.com/en-us/HT213927, https://support.apple.com/en-us/HT213928, https://support.apple.com/en-us/HT213929, https://support.apple.com/en-us/HT213931, https://support.apple.com/en-us/HT213932; https://nvd.nist.gov/vuln/detail/CVE-2023-41992

    8.8
    High

    CVE-2023-41993

    Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    Alert Date:25 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.apple.com/en-us/HT213926, https://support.apple.com/en-us/HT213927, https://support.apple.com/en-us/HT213930; https://nvd.nist.gov/vuln/detail/CVE-2023-41993

    7.2
    High

    CVE-2023-41179

    Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.

    Alert Date:21 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://success.trendmicro.com/dcx/s/solution/000294994?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2023-41179

    8.8
    High

    CVE-2023-28434

    MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.

    Alert Date:19 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c; https://nvd.nist.gov/vuln/detail/CVE-2023-28434

    5
    Medium

    CVE-2022-22265

    Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution.

    Alert Date:18 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://nvd.nist.gov/vuln/detail/CVE-2022-22265

    9.8
    Critical

    CVE-2014-8361

    Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.

    Alert Date:18 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://web.archive.org/web/20150831100501/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055; https://nvd.nist.gov/vuln/detail/CVE-2014-8361

    8.8
    High

    CVE-2017-6884

    Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.

    Alert Date:18 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-emg2926-q10a-ethernet-cpe, https://www.zyxelguard.com/Zyxel-EOL.asp; https://nvd.nist.gov/vuln/detail/CVE-2017-6884

    9.8
    Critical

    CVE-2021-3129

    Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().

    Alert Date:18 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://github.com/facade/ignition/releases/tag/2.5.2; https://nvd.nist.gov/vuln/detail/CVE-2021-3129

    7.8
    High

    CVE-2023-26369

    Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.

    Alert Date:14 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://helpx.adobe.com/security/products/acrobat/apsb23-34.html; https://nvd.nist.gov/vuln/detail/CVE-2023-26369

    8.8
    High

    CVE-2023-35674

    Android Framework contains an unspecified vulnerability that allows for privilege escalation.

    Alert Date:13 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://source.android.com/docs/security/bulletin/2023-09-01; https://nvd.nist.gov/vuln/detail/CVE-2023-35674

    5
    Medium

    CVE-2023-20269

    Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.

    Alert Date:13 Sept 2023
    Action:Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.

    Note: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC; https://nvd.nist.gov/vuln/detail/CVE-2023-20269

    8.8
    High

    CVE-2023-4863

    Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.

    Alert Date:13 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html?m=1; https://nvd.nist.gov/vuln/detail/CVE-2023-4863

    6.5
    Medium

    CVE-2023-36761

    Microsoft Word contains an unspecified vulnerability that allows for information disclosure.

    Alert Date:12 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36761; https://nvd.nist.gov/vuln/detail/CVE-2023-36761

    7.8
    High

    CVE-2023-36802

    Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.

    Alert Date:12 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36802; https://nvd.nist.gov/vuln/detail/CVE-2023-36802

    7.8
    High

    CVE-2023-41064

    Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.

    Alert Date:11 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.apple.com/en-us/HT213905, https://support.apple.com/en-us/HT213906; https://nvd.nist.gov/vuln/detail/CVE-2023-41064

    7.8
    High

    CVE-2023-41061

    Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.

    Alert Date:11 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.apple.com/en-us/HT213905, https://support.apple.com/kb/HT213907; https://nvd.nist.gov/vuln/detail/CVE-2023-41061

    9.8
    Critical

    CVE-2023-33246

    Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.

    Alert Date:6 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp; https://nvd.nist.gov/vuln/detail/CVE-2023-33246

    7.8
    High

    CVE-2023-38831

    RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.

    Alert Date:24 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: http://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa; https://nvd.nist.gov/vuln/detail/CVE-2023-38831

    8.6
    High

    CVE-2023-32315

    Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.

    Alert Date:24 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://www.igniterealtime.org/downloads/#openfire; https://nvd.nist.gov/vuln/detail/CVE-2023-32315

    9.8
    Critical

    CVE-2023-38035

    Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

    Alert Date:22 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2023-38035

    7.5
    High

    CVE-2023-27532

    Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.

    Alert Date:22 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://www.veeam.com/kb4424; https://nvd.nist.gov/vuln/detail/CVE-2023-27532

    9.8
    Critical

    CVE-2023-26359

    Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.

    Alert Date:21 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html; https://nvd.nist.gov/vuln/detail/CVE-2023-26359

    9.8
    Critical

    CVE-2023-24489

    Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.

    Alert Date:16 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.citrix.com/article/CTX559517/sharefile-storagezones-controller-security-update-for-cve202324489; https://nvd.nist.gov/vuln/detail/CVE-2023-24489

    7.5
    High

    CVE-2023-38180

    Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).

    Alert Date:9 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-38180; https://nvd.nist.gov/vuln/detail/CVE-2023-38180

    9.8
    Critical

    CVE-2017-18368

    Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.

    Alert Date:7 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-a-new-variant-of-gafgyt-malware; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-p660hn-t1a-dsl-cpe; https://nvd.nist.gov/vuln/detail/CVE-2017-18368

    7.2
    High

    CVE-2023-35081

    Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).

    Alert Date:31 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2023-35081

    6.1
    Medium

    CVE-2023-37580

    Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.

    Alert Date:27 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://wiki.zimbra.com/wiki/Security_Center ; https://nvd.nist.gov/vuln/detail/CVE-2023-37580

    5.5
    Medium

    CVE-2023-38606

    Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.

    Alert Date:26 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.apple.com/en-us/HT213841, https://support.apple.com/en-us/HT213842, https://support.apple.com/en-us/HT213843,https://support.apple.com/en-us/HT213844,https://support.apple.com/en-us/HT213845,https://support.apple.com/en-us/HT213846,https://support.apple.com/en-us/HT213848 ; https://nvd.nist.gov/vuln/detail/CVE-2023-38606

    9.8
    Critical

    CVE-2023-35078

    Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.

    Alert Date:25 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2023-35078

    7.5
    High

    CVE-2023-29298

    Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.

    Alert Date:20 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html; https://nvd.nist.gov/vuln/detail/CVE-2023-29298

    7.5
    High

    CVE-2023-38205

    Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.

    Alert Date:20 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html ; https://nvd.nist.gov/vuln/detail/CVE-2023-38205

    9.8
    Critical

    CVE-2023-3519

    Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.

    Alert Date:19 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467; https://nvd.nist.gov/vuln/detail/CVE-2023-3519

    7.5
    High

    CVE-2023-36884

    Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.

    Alert Date:17 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884; https://nvd.nist.gov/vuln/detail/CVE-2023-36884

    9.8
    Critical

    CVE-2022-29303

    SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server.

    Alert Date:13 Jul 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://jvn.jp/en/vu/JVNVU92327282/; https://nvd.nist.gov/vuln/detail/CVE-2022-29303

    8.8
    High

    CVE-2023-37450

    Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    Alert Date:13 Jul 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://support.apple.com/en-us/HT213826, https://support.apple.com/en-us/HT213841, https://support.apple.com/en-us/HT213843, https://support.apple.com/en-us/HT213846, https://support.apple.com/en-us/HT213848; https://nvd.nist.gov/vuln/detail/CVE-2023-37450

    7.8
    High

    CVE-2023-32046

    Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.

    Alert Date:11 Jul 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32046; https://nvd.nist.gov/vuln/detail/CVE-2023-32046

    8.8
    High

    CVE-2023-32049

    Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.

    Alert Date:11 Jul 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32049; https://nvd.nist.gov/vuln/detail/CVE-2023-32049

    8.8
    High

    CVE-2023-35311

    Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.

    Alert Date:11 Jul 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-35311; https://nvd.nist.gov/vuln/detail/CVE-2023-35311

    7.8
    High

    CVE-2023-36874

    Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.

    Alert Date:11 Jul 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36874; https://nvd.nist.gov/vuln/detail/CVE-2023-36874

    9.8
    Critical

    CVE-2022-31199

    Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.

    Alert Date:11 Jul 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: Patch application requires login to customer portal: https://security.netwrix.com/Account/SignIn?ReturnUrl=%2FAdvisories%2FADV-2022-003; https://nvd.nist.gov/vuln/detail/CVE-2022-31199

    8.8
    High

    CVE-2021-29256

    Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.

    Alert Date:7 Jul 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://nvd.nist.gov/vuln/detail/CVE-2021-29256

    9.8
    Critical

    CVE-2019-17621

    D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

    Alert Date:29 Jun 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147; https://nvd.nist.gov/vuln/detail/CVE-2019-17621

    7.8
    High

    CVE-2019-20500

    D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

    Alert Date:29 Jun 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113; https://nvd.nist.gov/vuln/detail/CVE-2019-20500

    7.3
    High

    CVE-2021-25487

    Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.

    Alert Date:29 Jun 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

    Note: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10; https://nvd.nist.gov/vuln/detail/CVE-2021-25487

    3.3
    Low

    CVE-2021-25489

    Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.

    Alert Date:29 Jun 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

    Note: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10; https://nvd.nist.gov/vuln/detail/CVE-2021-25489

    6.4
    Medium

    CVE-2021-25394

    Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.

    Alert Date:29 Jun 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

    Note: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://nvd.nist.gov/vuln/detail/CVE-2021-25394

    6.4
    Medium

    CVE-2021-25395

    Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.

    Alert Date:29 Jun 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

    Note: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://nvd.nist.gov/vuln/detail/CVE-2021-25395

    6.1
    Medium

    CVE-2021-25371

    Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP.

    Alert Date:29 Jun 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

    Note: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=3; https://nvd.nist.gov/vuln/detail/CVE-2021-25371

    6.1
    Medium

    CVE-2021-25372

    Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.

    Alert Date:29 Jun 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

    Note: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=3; https://nvd.nist.gov/vuln/detail/CVE-2021-25372

    Items Per Page