CVE-2018-16271

The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to improper D-Bus security policy configurations. An arbitrary email can also be sent from the mailbox via the paired smartphone. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.

• CWE-269

• https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdfExploit, Third Party Advisory
• https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.beExploit, Third Party Advisory
• https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdfExploit, Third Party Advisory
• https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.beExploit, Third Party Advisory

Published

Jan 22, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16265The bt/bt_core system service in Tizen allows an unprivilege…6.5
• CVE-2018-16266The Enlightenment system service in Tizen allows an unprivil…8.1
• CVE-2018-16267The system-popup system service in Tizen allows an unprivile…8.1
• CVE-2018-16268The SoundServer/FocusServer system services in Tizen allow a…4.3
• CVE-2018-16269The wnoti system service in Samsung Galaxy Gear series allow…7.5
• CVE-2018-16270Samsung Galaxy Gear series before build RE2 includes the hci…7.5
• CVE-2018-16272The wpa_supplicant system service in Samsung Galaxy Gear ser…9.8
• CVE-2018-16275OPSWAT MetaDefender before v4.11.2 allows CSV injection.
• CVE-2018-16276An issue was discovered in yurex_read in drivers/usb/misc/yu…7.8
• CVE-2018-16277The Image Import function in XWiki through 10.7 has XSS.
• CVE-2018-16278phpkaiyuancms PhpOpenSourceCMS (POSCMS) V3.2.0 allows an una…
• CVE-2018-16281The DEISER "Profields - Project Custom Fields" app before 6.…