Vulnerabilities

TI-2023-05803 CVE-2023-6320 · GHSA-wm52-4cc3-xxgg

Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint

MEDIUM 48

A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.03952 Published 2024-04-09 No fix listed CWE-78

TI-2023-05802 CVE-2023-6319 · GHSA-rgwx-4v25-2mj5

Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service

MEDIUM 51

A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.06437 Published 2024-04-09 No fix listed CWE-78

TI-2023-05801 CVE-2023-6318 · GHSA-m5v4-f2gf-v6x5

Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service

MEDIUM 49

A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.04667 Published 2024-04-09 No fix listed CWE-78

TI-2023-05800 CVE-2023-6317 · GHSA-rm4x-93m8-4qcv

PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction

MEDIUM 44

A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01087 Published 2024-04-09 No fix listed CWE-639

TI-2022-07783 CVE-2022-23731 · GHSA-r5xr-54pp-gfxj

V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models.

LOW 35

V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00627 Published 2022-03-11 No fix listed CWE-264

TI-2022-07782 CVE-2022-23730 · GHSA-qwfh-q845-fhm2

The public API error causes for the attacker to be able to bypass API access control.

MEDIUM 44

The public API error causes for the attacker to be able to bypass API access control.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01024 Published 2022-03-11 No fix listed CWE-284

TI-2022-07779 CVE-2022-23727 · GHSA-2vxh-hj65-9hr4

There is a privilege escalation vulnerability in some webOS TVs.

LOW 33

There is a privilege escalation vulnerability in some webOS TVs.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00226 Published 2022-01-28 No fix listed

TI-2020-07844 CVE-2020-9759 · GHSA-j24f-gw9v-x4vp

webOS TV Emulator privilege escalation vulnerability

LOW 34

A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00472 Published 2020-03-23 No fix listed CWE-494

Vulnerabilities

Filters