Veille CVE

Semaine du 26 juin au 2 juillet 2023

8 CVE

Critique 1 Élevée 2 Moyenne 5 Faible 0 Non évaluée 0 Tri : plus récentes
  1. CVE-2021-25489 5.5 Moyenne Exploitée

    Samsung Mobile Devices · Samsung android

    Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.

  2. CVE-2021-25487 7.8 Élevée Exploitée

    Samsung Mobile Devices · Samsung android

    Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.

  3. CVE-2021-25395 6.4 Moyenne Exploitée

    Samsung Mobile Devices · Samsung android

    A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.

  4. CVE-2021-25394 6.4 Moyenne Exploitée

    Samsung Mobile Devices · Samsung android

    A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised.

  5. CVE-2021-25372 6.7 Moyenne Exploitée

    Samsung Mobile Devices · Samsung android

    An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

  6. CVE-2021-25371 6.7 Moyenne Exploitée

    Samsung Mobile Devices · Samsung android

    A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.

  7. CVE-2019-20500 7.8 Élevée Exploitée

    Dlink dwl-2600ap firmware

    D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

  8. CVE-2019-17621 9.8 Critique Exploitée

    Dlink dir-859 firmware · Dlink dir-822 firmware · Dlink dir-823 firmware · Dlink dir-865l firmware

    The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.