CVE-2015-9546

An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-06-16. In some cases, HTTP is used for an Inputmethod, rather than HTTPS. A man-in-the-middle attacker can modify the client-server data stream to insert directory traversal sequences into an extracted file path. The Samsung ID is SVE-2015-4363 (November 2015).

• CWE-22

• https://security.samsungmobile.com/securityUpdate.smsbVendor Advisory
• https://security.samsungmobile.com/securityUpdate.smsbVendor Advisory

Published

Apr 10, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-9540Chamilo LMS through 1.9.10.2 allows a link_goto.php?link_url…6.1
• CVE-2015-9541Qt through 5.14 allows an exponential XML entity expansion a…7.5
• CVE-2015-9542add_password in pam_radius_auth.c in pam_radius 1.4.0 does n…7.5
• CVE-2015-9543An issue was discovered in OpenStack Nova before 18.2.4, 19.…3.3
• CVE-2015-9544An issue was discovered in xdLocalStorage through 2.0.5. The…7.1
• CVE-2015-9545An issue was discovered in xdLocalStorage through 2.0.5. The…7.1
• CVE-2015-9547An issue was discovered on Samsung mobile devices with JBP(4…7.5
• CVE-2015-9548An issue was discovered in Mattermost Server before 1.2.0. I…7.5
• CVE-2015-9549A reflected Cross-site Scripting (XSS) vulnerability exists …6.1
• CVE-2015-9550An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B…7.5
• CVE-2015-9551An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B…9.8