Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
This vulnerability discloses private information and affects all versions prior to the fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/394af194-61a7-4e33-b373-877d4c766fca - https://github.com/janeczku/calibre-web/commit/6f5390ead5df9779ac81fadefffb476e03f93548
CVE ID: CVE-2021-3987 State: PUBLISHED Published: 2024-11-15T10:52:29.478Z Last Updated: 2024-11-15T18:28:12.925Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: janeczku Products: janeczku/calibre-web Problem Types: CWE-284 Description: An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users. Additional Analyst Notes: - CISA ADP Vulnr
shelf. This issue can lead to unauthorized actions being performed by users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/29fcc091-87b6-43bc-ab4b-3c0bec3f71df - https://github.com/janeczku/calibre-web/commit/bcdc97641447965af486964537f3821f47b28874
CVE ID: CVE-2021-3988 State: PUBLISHED Published: 2024-11-15T10:52:39.637Z Last Updated: 2024-11-20T22:35:15.693Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: janeczku Products: janeczku/calibre-web Problem Types: CWE-79 Description: A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue i
ttackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue is present in the code handling the `#btn-upload-cover` change event. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/fa4c8fd1-7846-4dad-9112-2c07461f0609 - https://github.com/janeczku/calibre-web/commit/7ad419dc8c12180e842a82118f4866ac3d074bc5
CVE ID: CVE-2021-3989 State: PUBLISHED Published: 2021-12-01T10:55:10 Last Updated: 2024-08-03T17:09:09.754Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-601 Description: showdoc is vulnerable to URL Redirection to Untrusted Site Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ffc61eff-efea-42c5-92c2-e043fdf904d5 - https://github.com/star7th/showdoc/commit/335afc7ed6d6627c3d0434aa9acc168c77117614
CVE ID: CVE-2021-3990 State: PUBLISHED Published: 2021-12-01T10:50:10 Last Updated: 2024-08-03T17:16:03.673Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-338 Description: showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0680067d-56a7-4412-b06e-a267e850ae9f - https://github.com/star7th/showdoc/commit/a9886f26c08225e0adca75c67dfca3f7c42b87d0
CVE ID: CVE-2021-3991 State: PUBLISHED Published: 2024-11-15T10:52:49.304Z Last Updated: 2024-11-15T18:26:07.636Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: dolibarr Products: dolibarr/dolibarr Problem Types: CWE-285 Description: An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permission restrictions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/58ddbd8a-0faf-4b3f-aec9-5850bb19ab67 - https://github.com/doli
DP Vulnrichment: References: - https://huntr.com/bounties/58ddbd8a-0faf-4b3f-aec9-5850bb19ab67 - https://github.com/dolibarr/dolibarr/commit/63cd06394f39d60784d6e6a0ccf4867a71a6568f
CVE ID: CVE-2021-3992 State: PUBLISHED Published: 2021-12-01T10:45:11 Last Updated: 2024-08-03T17:16:03.035Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: kevinpapst Products: kevinpapst/kimai2 Problem Types: CWE-284 Description: kimai2 is vulnerable to Improper Access Control Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a0c438fb-c8e1-40cf-acc6-c8a532b80b93 - https://github.com/kevinpapst/kimai2/commit/ff9acab0fc81f0e9490462739ef15fe4ab028ea5
CVE ID: CVE-2021-3993 State: PUBLISHED Published: 2021-12-01T10:40:09 Last Updated: 2024-08-03T17:16:02.867Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-352 Description: showdoc is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/star7th/showdoc/commit/654e871a3923e79076818a9a03533fe88222c871 - https://huntr.dev/bounties/0aa84736-139b-4ae7-becf-604f7f60b1c9
CVE ID: CVE-2021-3994 State: PUBLISHED Published: 2021-12-01T10:40:14 Last Updated: 2024-08-03T17:16:02.960Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: django-helpdesk Products: django-helpdesk/django-helpdesk Problem Types: CWE-79 Description: django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/be7f211d-4bfd-44fd-91e8-682329906fbd - https://github.com/django-helpdesk/django-helpdesk/commit/a22eb0673fe0b7784f99c6b5fd343b64a6700f06
CVE ID: CVE-2021-3995 State: PUBLISHED Published: 2022-08-23T00:00:00 Last Updated: 2024-08-03T17:16:03.736Z Vendors: n/a Products: util-linux Problem Types: CWE-552 Description: A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems. Additional Analyst Notes: - CVE Program Container: References: - https://mirrors
ions that use the affected filesystems. Additional Analyst Notes: - CVE Program Container: References: - https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.3-ReleaseNotes - https://www.openwall.com/lists/oss-security/2022/01/24/2 - https://github.com/util-linux/util-linux/commit/57202f5713afa2af20ffbb6ab5331481d0396f8d - https://bugzilla.redhat.com/show_bug.cgi?id=2024631https://access.redhat.com/security/cve/CVE-2021-3995 - http://www.openwall.com/lists/oss-security/2022/11/30/2 - http://seclists.org/fulldisclosure/2022/Dec/4 - http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html - https://security.netapp.com/advisor
y.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html - https://security.netapp.com/advisory/ntap-20221209-0002/ - https://security.gentoo.org/glsa/202401-08
CVE ID: CVE-2021-3996 State: PUBLISHED Published: 2022-08-23T00:00:00 Last Updated: 2024-10-15T15:26:56.079Z Vendors: n/a Products: util-linux Problem Types: CWE-552 Description: A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
that use the affected filesystems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.3-ReleaseNotes - https://github.com/util-linux/util-linux/commit/166e87368ae88bf31112a30e078cceae637f4cdb - https://www.openwall.com/lists/oss-security/2022/01/24/2 - https://bugzilla.redhat.com/show_bug.cgi?id=2024628 - https://access.redhat.com/security/cve/CVE-2021-3996 - http://www.openwall.com/lists/oss-security/2022/11/30/2 - http://seclists.org/fulldisclosure/2022/Dec/4 - http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html - https://secu
tp://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html - https://security.netapp.com/advisory/ntap-20221209-0002/ - https://security.gentoo.org/glsa/202401-08
CVE ID: CVE-2021-3997 State: PUBLISHED Published: 2022-08-23T00:00:00 Last Updated: 2024-08-03T17:16:02.914Z Vendors: n/a Products: systemd Problem Types: CWE-674 Description: A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2024639 - https://www.openwall.com/lists/oss-security/2022/01/10/2 - https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1 - https://access.redhat.com/security/cve/CVE-2021-3997 - https://security.gentoo.org/glsa
37e20133c0208005274ce4a5b5c6a1 - https://access.redhat.com/security/cve/CVE-2021-3997 - https://security.gentoo.org/glsa/202305-15
CVE ID: CVE-2021-3998 State: PUBLISHED Published: 2022-08-24T00:00:00.000Z Last Updated: 2025-06-09T15:00:17.349Z Vendors: n/a Products: glibc Problem Types: CWE-125 Description: A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2022/01/24/4 - https://sourceware.org/bugzilla/show_bug.cgi?id=28770 - https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ee8d5e33adb284601c00c94687bc907e10aec9bb - https://sourceware.org/git/gitweb.cgi?p=glibc.gi
t/gitweb.cgi?p=glibc.git%3Bh=ee8d5e33adb284601c00c94687bc907e10aec9bb - https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=84d2d0fe20bdf94feed82b21b4d7d136db471f03 - https://bugzilla.redhat.com/show_bug.cgi?id=2024633 - https://access.redhat.com/security/cve/CVE-2021-3998 - https://security-tracker.debian.org/tracker/CVE-2021-3998 - https://security.netapp.com/advisory/ntap-20221020-0003/
CVE ID: CVE-2021-3999 State: PUBLISHED Published: 2022-08-24T00:00:00 Last Updated: 2024-08-03T17:16:03.318Z Vendors: n/a Products: glibc Problem Types: CWE-193 Description: A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2022/01/24/4 - https://sourceware.org/bugzilla/show_bug.cgi?i
References: - https://www.openwall.com/lists/oss-security/2022/01/24/4 - https://sourceware.org/bugzilla/show_bug.cgi?id=28769 - https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e - https://bugzilla.redhat.com/show_bug.cgi?id=2024637 - https://access.redhat.com/security/cve/CVE-2021-3999 - https://security-tracker.debian.org/tracker/CVE-2021-3999 - https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html - https://security.netapp.com/advisory/ntap-20221104-0001/
CVE ID: CVE-2021-40000 State: PUBLISHED Published: 2022-01-07T22:39:26 Last Updated: 2024-08-04T02:20:34.273Z Vendors: Huawei Products: HarmonyOS Problem Types: Heap-based Buffer Overflow Description: The Bluetooth module has an out-of-bounds write vulnerability. Successful exploitation of this vulnerability may result in malicious command execution at the remote end. Additional Analyst Notes: - CVE Program Container: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202112-0000001183296718
CVE ID: CVE-2021-40001 State: PUBLISHED Published: 2022-01-07T22:39:26 Last Updated: 2024-08-04T02:20:34.330Z Vendors: Huawei Products: HarmonyOS Problem Types: Path Traversal Description: The CaasKit module has a path traversal vulnerability. Successful exploitation of this vulnerability may cause the MeeTime application to be unavailable. Additional Analyst Notes: - CVE Program Container: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202112-0000001183296718
CVE ID: CVE-2021-40002 State: PUBLISHED Published: 2022-01-07T22:39:27 Last Updated: 2024-08-04T02:20:34.143Z Vendors: Huawei Products: HarmonyOS Problem Types: Heap-based Buffer Overflow Description: The Bluetooth module has an out-of-bounds write vulnerability. Successful exploitation of this vulnerability may result in malicious command execution at the remote end. Additional Analyst Notes: - CVE Program Container: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202112-0000001183296718
CVE ID: CVE-2021-40003 State: PUBLISHED Published: 2022-01-07T22:39:28 Last Updated: 2024-08-04T02:20:34.191Z Vendors: Huawei Products: HarmonyOS Problem Types: Path Traversal Description: HwPCAssistant has a path traversal vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202112-0000001183296718
CVE ID: CVE-2021-40004 State: PUBLISHED Published: 2022-01-07T22:39:29 Last Updated: 2024-08-04T02:20:34.166Z Vendors: Huawei Products: HarmonyOS Problem Types: Exposure of Sensitive Information to an Unauthorized Actor Description: The cellular module has a vulnerability in permission management. Successful exploitation of this vulnerability may affect data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202112-0000001183296718
CVE ID: CVE-2021-40005 State: PUBLISHED Published: 2022-01-07T22:39:30 Last Updated: 2024-08-04T02:20:34.228Z Vendors: Huawei Products: HarmonyOS Problem Types: Improper Access Control Description: The distributed data service component has a vulnerability in data access control. Successful exploitation of this vulnerability may affect data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202112-0000001183296718
CVE ID: CVE-2021-40006 State: PUBLISHED Published: 2022-01-07T22:39:30 Last Updated: 2024-08-04T02:20:34.199Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-254 Description: Vulnerability of design defects in the security algorithm component. Successful exploitation of this vulnerability may affect confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202112-0000001183296718 - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-0000001667644725 - https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE ID: CVE-2021-40007 State: PUBLISHED Published: 2021-12-13T15:48:04 Last Updated: 2024-08-04T02:20:34.366Z Vendors: n/a Products: eCNS280_TD Problem Types: Information Disclosure Description: There is an information leak vulnerability in eCNS280_TD V100R005C10SPC650. The vulnerability is caused by improper log output management. An attacker with the ability to access the log file of device may lead to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211208-01-informationleak-en
CVE ID: CVE-2021-40008 State: PUBLISHED Published: 2021-12-13T15:48:05 Last Updated: 2024-08-04T02:27:30.309Z Vendors: n/a Products: CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEngine 7800 Problem Types: Memory Leak Description: There is a memory leak vulnerability in CloudEngine 12800 V200R019C00SPC800, CloudEngine 5800 V200R019C00SPC800, CloudEngine 6800 V200R019C00SPC800 and CloudEngine 7800 V200R019C00SPC800. The software does not sufficiently track and release allocated memory while parse a series of crafted binary messages, which could consume remaining memory. Successful exploit could cause memory exhaust. Additional Analyst Notes: - CVE Program Container: References: - h
emory. Successful exploit could cause memory exhaust. Additional Analyst Notes: - CVE Program Container: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211208-01-memleak-en
CVE ID: CVE-2021-40009 State: PUBLISHED Published: 2022-01-07T22:39:33 Last Updated: 2024-08-04T02:27:30.289Z Vendors: Huawei Products: EMUI, Magic UI, HarmonyOS Problem Types: Out-of-bounds write vulnerability Description: There is an Out-of-bounds write vulnerability in the AOD module in smartphones. Successful exploitation of this vulnerability may affect service integrity. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/1/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202201-0000001238736331
CVE ID: CVE-2021-40010 State: PUBLISHED Published: 2022-01-07T22:39:40 Last Updated: 2024-08-04T02:27:30.340Z Vendors: n/a Products: HarmonyOS;EMUI;Magic UI Problem Types: Heap overflow vulnerability Description: The bone voice ID TA has a heap overflow vulnerability.Successful exploitation of this vulnerability may result in malicious code execution. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/5/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202201-0000001194056366
CVE ID: CVE-2021-40011 State: PUBLISHED Published: 2022-01-07T22:39:31 Last Updated: 2024-08-04T02:27:30.292Z Vendors: n/a Products: EMUI;Magic UI;HarmonyOS Problem Types: Uncontrolled resource consumption vulnerability Description: There is an uncontrolled resource consumption vulnerability in the display module. Successful exploitation of this vulnerability may affect integrity. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/1/ - https://consumer.huawei.com/en/support/bulletin/2022/3/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202203-0000001257385193
CVE ID: CVE-2021-40012 State: PUBLISHED Published: 2022-07-11T13:53:47 Last Updated: 2024-08-04T02:27:30.290Z Vendors: Huawei Products: HarmonyOS, EMUI, Magic UI Problem Types: Incorrect pointer usage vulnerability Description: Vulnerability of pointers being incorrectly used during data transmission in the video framework. Successful exploitation of this vulnerability may affect confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/7/ - https://consumer.huawei.com/en/support/bulletin/2022/8/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202208-0000001363876177
CVE ID: CVE-2021-40013 State: PUBLISHED Published: 2022-07-11T13:53:52 Last Updated: 2024-08-04T02:27:30.452Z Vendors: Huawei Products: EMUI, Magic UI Problem Types: Improper permission control vulnerability Description: Improper permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability will affect integrity. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/7/
CVE ID: CVE-2021-40014 State: PUBLISHED Published: 2022-01-07T22:39:41 Last Updated: 2024-08-04T02:27:30.472Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Information Management Errors Description: The bone voice ID trusted application (TA) has a heap overflow vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202201-0000001238736331 - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858 - https://consumer.huawei.com/en/support/bulletin/2023/7/
CVE ID: CVE-2021-40015 State: PUBLISHED Published: 2022-02-09T22:03:57 Last Updated: 2024-08-04T02:27:30.449Z Vendors: Huawei Products: EMUI, Magic UI, HarmonyOS Problem Types: Race condition vulnerability Description: There is a race condition vulnerability in the binder driver subsystem in the kernel.Successful exploitation of this vulnerability may affect kernel stability. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/2/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202202-0000001204253396
CVE ID: CVE-2021-40016 State: PUBLISHED Published: 2022-07-11T13:53:57 Last Updated: 2024-08-04T02:27:30.606Z Vendors: Huawei Products: EMUI, Magic UI Problem Types: Improper permission control vulnerability Description: Improper permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability will affect confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/7/
CVE ID: CVE-2021-40017 State: PUBLISHED Published: 2022-09-16T00:00:00 Last Updated: 2024-08-04T02:27:30.453Z Vendors: n/a Products: HarmonyOS;EMUI Problem Types: Out-of-bounds memory access vulnerability Description: The HW_KEYMASTER module lacks the validity check of the key format. Successful exploitation of this vulnerability may result in out-of-bounds memory access. Additional Analyst Notes: - CVE Program Container: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-0000001392278845 - https://consumer.huawei.com/en/support/bulletin/2022/10/
CVE ID: CVE-2021-40018 State: PUBLISHED Published: 2022-01-07T22:39:42 Last Updated: 2024-08-04T02:27:30.444Z Vendors: Huawei Products: HarmonyOS Problem Types: Null Pointer Reference Description: The eID module has a null pointer reference vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202201-0000001238736331
CVE ID: CVE-2021-40019 State: PUBLISHED Published: 2022-09-16T17:58:03 Last Updated: 2024-08-04T02:27:30.562Z Vendors: Huawei Products: EMUI Problem Types: Out-of-bounds heap read vulnerability Description: Out-of-bounds heap read vulnerability in the HW_KEYMASTER module. Successful exploitation of this vulnerability may cause out-of-bounds access. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/9/