CVE-2021-25527

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to access Bill Pay and Recharge menu without authentication.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-926

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Pay	>= -, < 4.1.77

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12Vendor Advisory

Timeline

Published: Dec 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-256307.8"loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolfo CVE-2021-256318.8In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented CVE-2021-256337.5LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the docum CVE-2021-256347.5LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the docum CVE-2021-256355.5An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untruste CVE-2021-256367.5LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the docum CVE-2021-256406.1In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redi CVE-2021-256419.8Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versio CVE-2021-256428.8ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without v CVE-2021-256434.9An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @CVE-2021-256447.5An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leake CVE-2021-256454.4An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with ad