🔏 Friday Five 10/7 🔏
📖 Read
via "".
This week saw some good news around securing the midterm elections, warnings about IRS phishing scams, and new orders from CISA. Catch up in this week’s Friday Five!
📖 Read
via "".
‼ CVE-2022-39847 ‼
📖 Read
via "National Vulnerability Database".
Use after free vulnerability in set_nft_pid and signal_handler function of NFC driver prior to SMR Oct-2022 Release 1 allows attackers to perform malicious actions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33896 ‼
📖 Read
via "National Vulnerability Database".
A buffer underflow vulnerability exists in the way Hword of Hancom Office 2020 version 11.0.0.5357 parses XML-based office files. A specially-crafted malformed file can cause memory corruption by using memory before buffer start, which can lead to code execution. A victim would need to access a malicious file to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39852 ‼
📖 Read
via "National Vulnerability Database".
A heap-based overflow vulnerability in makeContactAGIF in libagifencoder.quram.so library prior to SMR Oct-2022 Release 1 allows attacker to perform code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39863 ‼
📖 Read
via "National Vulnerability Database".
Intent redirection vulnerability in Samsung Account prior to version 13.5.01.3 allows attackers to access content providers without permission.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39867 ‼
📖 Read
via "National Vulnerability Database".
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via SHOW_PERSISTENT_BANNER broadcast.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39859 ‼
📖 Read
via "National Vulnerability Database".
Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via implicit intent.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39877 ‼
📖 Read
via "National Vulnerability Database".
Improper access control vulnerability in ProfileSharingAccount in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows attackers to identify the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39860 ‼
📖 Read
via "National Vulnerability Database".
Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive information via implicit broadcast.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39850 ‼
📖 Read
via "National Vulnerability Database".
Improper access control in mum_container_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39870 ‼
📖 Read
via "National Vulnerability Database".
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via PUSH_MESSAGE_RECEIVED broadcast.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39875 ‼
📖 Read
via "National Vulnerability Database".
Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39864 ‼
📖 Read
via "National Vulnerability Database".
Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via implicit intent.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39856 ‼
📖 Read
via "National Vulnerability Database".
Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers to access call information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36868 ‼
📖 Read
via "National Vulnerability Database".
Improper restriction of broadcasting Intent in MouseNKeyHidDevice prior to SMR Oct-2022 Release 1 leaks MAC address of the connected Bluetooth device.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39866 ‼
📖 Read
via "National Vulnerability Database".
Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39871 ‼
📖 Read
via "National Vulnerability Database".
Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcasts.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39878 ‼
📖 Read
via "National Vulnerability Database".
Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via implicit intent broadcast.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39868 ‼
📖 Read
via "National Vulnerability Database".
Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39872 ‼
📖 Read
via "National Vulnerability Database".
Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39874 ‼
📖 Read
via "National Vulnerability Database".
Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.📖 Read
via "National Vulnerability Database".