Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 89

Export CSV
CVE-2023-6317

PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction

A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN.  Full versions and TV models affected: webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA webOS 5.5.0 - 04.50.51 running on OLED55CXPUA webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB   webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed
Vendors
Lg
Products
Lg43um7000pla Oled48c1pub Oled55a23la and 2 more
CVE-2023-6318

Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service

A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability. Full versions and TV models affected: * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA  * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB  * webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA

CVSS 3.1 · 9.1 Critical EPSS 4.7% KEV · Not listed
Vendors
Lg
Products
Oled48c1pub Oled55a23la Oled55cxpua and 1 more
CVE-2023-6319

Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service

A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability. * webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA  * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA  * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB  * webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA

CVSS 3.1 · 9.1 Critical EPSS 6.4% KEV · Not listed
Vendors
Lg
Products
Lg43um7000pla Oled48c1pub Oled55a23la and 2 more
CVE-2023-6320

Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint

A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of specially crafted requests can lead to command execution as the dbus user. An attacker can make authenticated requests to trigger this vulnerability. Full versions and TV models affected: * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA  * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB

CVSS 3.1 · 9.1 Critical EPSS 4.0% KEV · Not listed
Vendors
Lg
Products
Oled48c1pub Oled55cxpua Webos
CVE-2024-6179

XSS vulnerability in LG SuperSign CMS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Lg
Products
Supersign Cms
CVE-2024-6178

XSS vulnerability in LG SuperSign CMS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Lg
Products
Supersign Cms
CVE-2024-6177

XSS vulnerability in LG SuperSign CMS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Lg
Products
Supersign Cms
CVE-2024-1886

Absolute path traversal attack on LG Signage

This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed
Vendors
Lg
Products
Webos Signage
CVE-2024-1885

Remote Code Execution attack on LG Signage

This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Lg
Products
Webos Signage
CVE-2023-4616

thumbnail Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the current user.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Lg
Products
Lg Led Assistant
CVE-2023-4615

updateFile Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/download/updateFile endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the current user.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Lg
Products
Lg Led Assistant
CVE-2023-4614

setThumbnailRC Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/installation/setThumbnailRc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Lg
Products
Lg Led Assistant
CVE-2023-4613

Upload Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Lg
Products
Lg Led Assistant
CVE-2023-44129

Messaging - Gaining access to arbitrary content providers via QClipIntentReceiverActivity

The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality by launching this activity and then sending a broadcast with the "com.lge.message.action.QCLIP" action. The attacker can send, e.g., their own data/clipdata and set Intent.FLAG_GRANT_* flags. After the attacker received that intent in the "onActivityResult()" method, they would have access to arbitrary content providers that have the `android:grantUriPermissions="true"` flag set.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Google Lg
Products
Android V60 Thin Q 5g
CVE-2023-44128

LGInstallService - Deletion of arbitrary files with system privilege

he vulnerability is to delete arbitrary files in LGInstallService ("com.lge.lginstallservies") app. The app contains the exported "com.lge.lginstallservies.InstallService" service that exposes an AIDL interface. All its "installPackage*" methods are finally calling the "installPackageVerify()" method that performs signature validation after the delete file method. An attacker can control conditions so this security check is never performed and an attacker-controlled file is deleted.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Lg
Products
Android V60 Thin Q 5g
CVE-2023-44127

Call management - Implicit activity intents disclose contact details and phone numbers

he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Google Lg
Products
Android V60 Thin Q 5g
CVE-2023-44126

Call management - Implicit intents disclose telephony data such as phone numbers, call states, contacts

The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers, contacts info, etc.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Google Lg
Products
Android V60 Thin Q 5g
CVE-2023-44125

Personalized service - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking

The vulnerability is the use of implicit PendingIntents without the PendingIntent.FLAG_IMMUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Personalized service ("com.lge.abba") app. The attacker's app, if it had access to app notifications, could intercept them and redirect them to its activity, before making it grant access permissions to content providers with the `android:grantUriPermissions="true"` flag.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Google Lg
Products
Android V60 Thin Q 5g
CVE-2023-44124

Screen recording - Theft of arbitrary files with system privilege

The vulnerability is to theft of arbitrary files with system privilege in the Screen recording ("com.lge.gametools.gamerecorder") app in the "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. They also can return arbitrary data that will be passed to the "onActivityResult()" method. The Screen recording app saves contents of arbitrary URIs to SD card which is a world-readable storage.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Google Lg
Products
Android V60 Thin Q 5g
CVE-2023-44123

Bluetooth - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking

The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Bluetooth ("com.lge.bluetoothsetting") app. The attacker's app, if it had access to app notifications, could intercept them and redirect them to its activity, before making it grant access permissions to content providers with the `android:grantUriPermissions="true"` flag.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Google Lg
Products
Android V60 Thin Q 5g