CVE-2023-42580

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to install APK from Galaxy Store.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Dec 5, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-425817.5Improper URL validation from InstantPlay deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to acCVE-2023-42598.8Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.CVE-2023-426010.0Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.CVE-2023-426275.4Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP CVE-2023-426285.4Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83CVE-2023-426295.4Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 CVE-2023-42638.8Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driverCVE-2023-426315.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426325.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426335.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426345.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executiCVE-2023-426355.5In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional executi
CVE-2023-42580: Critical severity, CVSS 9.8 | Vulnix