Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,284 results · page 7 of 26

Aug 6, 2024Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the backgrouCVE-2024-34609 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Aug 6, 2024Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the bacCVE-2024-34608 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Aug 6, 2024Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the backgCVE-2024-34607 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Aug 6, 2024Improper access control in SmartThingsService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the backgrCVE-2024-34606 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Improper access control in SmartThingsService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Aug 6, 2024Improper access control in SamsungHealthService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the backCVE-2024-34605 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Improper access control in SamsungHealthService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Aug 6, 2024Improper access control in LedCoverService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the backgrounCVE-2024-34604 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Improper access control in LedCoverService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Jul 8, 2024Improper access control in Samsung Message prior to SMR Jul-2024 Release 1 allows local attackers to access location data.CVE-2024-34603 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper access control in Samsung Message prior to SMR Jul-2024 Release 1 allows local attackers to access location data.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 8, 2024Use of implicit intent for sensitive communication in Samsung Messages prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.CVE-2024-34602 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Use of implicit intent for sensitive communication in Samsung Messages prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. User interaction is required for triggering this vulnerability.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper access control in clickAdapterItem of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.CVE-2024-34595 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.8
Improper access control in clickAdapterItem of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local attackers to read kernel memory address.CVE-2024-34594 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local attackers to read kernel memory address.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper input validation in parsing and distributing RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary codeCVE-2024-34593 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.5
Improper input validation in parsing and distributing RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper input validation in parsing RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of servicCVE-2024-34592 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper input validation in parsing RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper input validation in parsing an item data from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporarCVE-2024-34591 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper input validation in parsing an item data from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper input validation혻in parsing an item type from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporarCVE-2024-34590 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper input validation혻in parsing an item type from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper input validation in parsing RTCP RR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service.CVE-2024-34589 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper input validation in parsing RTCP RR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper input validation혻in parsing RTCP SR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service.CVE-2024-34588 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper input validation혻in parsing RTCP SR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper input validation in parsing application information from RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arCVE-2024-34587 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.5
Improper input validation in parsing application information from RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper access control in KnoxCustomManagerService prior to SMR Jul-2024 Release 1 allows local attackers to configure Knox privacy policy.CVE-2024-34586 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.9
Improper access control in KnoxCustomManagerService prior to SMR Jul-2024 Release 1 allows local attackers to configure Knox privacy policy.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper access control in launchApp of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.CVE-2024-34585 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.8
Improper access control in launchApp of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper access control in system property prior to SMR Jul-2024 Release 1 allows local attackers to get device identifier.CVE-2024-34583 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper access control in system property prior to SMR Jul-2024 Release 1 allows local attackers to get device identifier.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper input validation in copying data to buffer cache in libsaped prior to SMR Jul-2024 Release 1 allows local attackers to write out-of-bounds memory.CVE-2024-20901 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.9
Improper input validation in copying data to buffer cache in libsaped prior to SMR Jul-2024 Release 1 allows local attackers to write out-of-bounds memory.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication.CVE-2024-20900 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive informCVE-2024-20899 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Use of implicit intent for sensitive communication in SoftphoneClient in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive infCVE-2024-20898 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Use of implicit intent for sensitive communication in SoftphoneClient in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Use of implicit intent for sensitive communication in FCM function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive informCVE-2024-20897 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Use of implicit intent for sensitive communication in FCM function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Use of implicit intent for sensitive communication in Configuration message prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.CVE-2024-20896 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Use of implicit intent for sensitive communication in Configuration message prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper access control in Dar service prior to SMR Jul-2024 Release 1 allows local attackers to bypass restriction for calling SDP features.CVE-2024-20895 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.7
Improper access control in Dar service prior to SMR Jul-2024 Release 1 allows local attackers to bypass restriction for calling SDP features.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper handling of exceptional conditions in Secure Folder prior to SMR Jul-2024 Release 1 allows physical attackers to bypass authentication under certain coCVE-2024-20894 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.3
Improper handling of exceptional conditions in Secure Folder prior to SMR Jul-2024 Release 1 allows physical attackers to bypass authentication under certain condition. User interaction is required for triggering this vulnerability.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper input validation in libmediaextractorservice.so prior to SMR Jul-2024 Release 1 allows local attackers to trigger memory corruption.CVE-2024-20893 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.1
Improper input validation in libmediaextractorservice.so prior to SMR Jul-2024 Release 1 allows local attackers to trigger memory corruption.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper verification of signature in FilterProvider prior to SMR Jul-2024 Release 1 allows local attackers to execute privileged behaviors.CVE-2024-20892 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.5
Improper verification of signature in FilterProvider prior to SMR Jul-2024 Release 1 allows local attackers to execute privileged behaviors. User interaction is required for triggering this vulnerability.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper access control in launchFullscreenIntent of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.CVE-2024-20891 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.8
Improper access control in launchFullscreenIntent of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper input validation in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to trigger abnormal behavior.CVE-2024-20890 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper input validation in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to trigger abnormal behavior.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices.CVE-2024-20889 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.9
Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Improper access control in OneUIHome prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.CVE-2024-20888 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.8
Improper access control in OneUIHome prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. User interaction is required for triggering this vulnerability.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 4, 2024Improper component protection vulnerability in Samsung Dialer prior to SMR May-2024 Release 1 allows local attackers to make a call without proper permission.CVE-2024-20885 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.1
Improper component protection vulnerability in Samsung Dialer prior to SMR May-2024 Release 1 allows local attackers to make a call without proper permission.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 4, 2024Incorrect use of privileged API vulnerability in getSemBatteryUsageStats in BatteryStatsService prior to SMR Jun-2024 Release 1 allows local attackers to use prCVE-2024-20884 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Incorrect use of privileged API vulnerability in getSemBatteryUsageStats in BatteryStatsService prior to SMR Jun-2024 Release 1 allows local attackers to use privileged API.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 4, 2024Incorrect use of privileged API vulnerability in registerBatteryStatsCallback in BatteryStatsService prior to SMR Jun-2024 Release 1 allows local attackers to uCVE-2024-20883 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Incorrect use of privileged API vulnerability in registerBatteryStatsCallback in BatteryStatsService prior to SMR Jun-2024 Release 1 allows local attackers to use privileged API.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 4, 2024Out-of-bounds read vulnerability in bootloader prior to SMR June-2024 Release 1 allows physical attackers to arbitrary data access.CVE-2024-20882 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.6
Out-of-bounds read vulnerability in bootloader prior to SMR June-2024 Release 1 allows physical attackers to arbitrary data access.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 4, 2024Improper input validation vulnerability in chnactiv TA prior to SMR Jun-2024 Release 1 allows local privileged attackers lead to potential arbitrary code executCVE-2024-20881 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.4
Improper input validation vulnerability in chnactiv TA prior to SMR Jun-2024 Release 1 allows local privileged attackers lead to potential arbitrary code execution.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 4, 2024Stack-based buffer overflow vulnerability in bootloader prior to SMR Jun-2024 Release 1 allows physical attackers to overwrite memory.CVE-2024-20880 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.4
Stack-based buffer overflow vulnerability in bootloader prior to SMR Jun-2024 Release 1 allows physical attackers to overwrite memory.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 4, 2024Improper input validation vulnerability in libsavscmn.so prior to SMR Jun-2024 Release 1 allows local attackers to write out-of-bounds memory.CVE-2024-20879 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper input validation vulnerability in libsavscmn.so prior to SMR Jun-2024 Release 1 allows local attackers to write out-of-bounds memory.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 4, 2024Heap out-of-bound write vulnerability in parsing grid image in libsavscmn.so prior to SMR June-2024 Release 1 allows local attackers to execute arbitrary code.CVE-2024-20878 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.3
Heap out-of-bound write vulnerability in parsing grid image in libsavscmn.so prior to SMR June-2024 Release 1 allows local attackers to execute arbitrary code.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 4, 2024Heap out-of-bound write vulnerability in parsing grid image header in libsavscmn.so prior to SMR Jun-2024 Release 1 allows local attackers to execute arbitrary CVE-2024-20877 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.3
Heap out-of-bound write vulnerability in parsing grid image header in libsavscmn.so prior to SMR Jun-2024 Release 1 allows local attackers to execute arbitrary code.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 4, 2024Improper input validation in libsheifdecadapter.so prior to SMR Jun-2024 Release 1 allows local attackers to lead to memory corruption.CVE-2024-20876 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.1
Improper input validation in libsheifdecadapter.so prior to SMR Jun-2024 Release 1 allows local attackers to lead to memory corruption.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 4, 2024Improper caller verification vulnerability in SemClipboard prior to SMR June-2024 Release 1 allows local attackers to access arbitrary files.CVE-2024-20875 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper caller verification vulnerability in SemClipboard prior to SMR June-2024 Release 1 allows local attackers to access arbitrary files.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 4, 2024Improper access control vulnerability in SmartManagerCN prior to SMR Jun-2024 Release 1 allows local attackers to launch privileged activities.CVE-2024-20874 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.9
Improper access control vulnerability in SmartManagerCN prior to SMR Jun-2024 Release 1 allows local attackers to launch privileged activities.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 4, 2024Improper input validation vulnerability in caminfo driver prior to SMR Jun-2024 Release 1 allows local privileged attackers to write out-of-bounds memory.CVE-2024-20873 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.2
Improper input validation vulnerability in caminfo driver prior to SMR Jun-2024 Release 1 allows local privileged attackers to write out-of-bounds memory.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
May 7, 2024Authentication bypass vulnerability in Setupwizard prior to SMR May-2024 Release 1 allows physical attackers to skip activation step.CVE-2024-20866 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.7
Authentication bypass vulnerability in Setupwizard prior to SMR May-2024 Release 1 allows physical attackers to skip activation step.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
May 7, 2024Authentication bypass in bootloader prior to SMR May-2024 Release 1 allows physical attackers to flash arbitrary images.CVE-2024-20865 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.6
Authentication bypass in bootloader prior to SMR May-2024 Release 1 allows physical attackers to flash arbitrary images.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
May 7, 2024Improper access control vulnerability in DarManagerService prior to SMR May-2024 Release 1 allows local attackers to monitor system resources.CVE-2024-20864 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Improper access control vulnerability in DarManagerService prior to SMR May-2024 Release 1 allows local attackers to monitor system resources.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.