Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-45514 State: PUBLISHED Published: 2024-11-21T00:00:00 Last Updated: 2024-11-21T18:11:27.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoints of Zimbra Webmail due to insufficient sanitization of the packages parameter. Attackers can bypass the existing checks by using encoded characters, allowing the injection and execution of arbitrary JavaScript within a victim's session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Resp
ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
CVE ID: CVE-2024-45515 State: PUBLISHED Published: 2025-07-30T00:00:00.000Z Last Updated: 2025-07-30T18:52:05.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due to insufficient validation of the content type metadata when importing files into the briefcase. Attackers can exploit this issue by crafting a file with manipulated metadata, allowing them to bypass content type checks and execute arbitrary JavaScript within the victim's session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Sec
ctim's session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes
CVE ID: CVE-2024-45516 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-19T14:25:22.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, including malformed <img> tags with embedded JavaScript. The vulnerability is triggered when a us
ation of HTML content, including malformed <img> tags with embedded JavaScript. The vulnerability is triggered when a user views a specially crafted email in the Classic UI, requiring no additional user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4#Security_Fixes
CVE ID: CVE-2024-45517 State: PUBLISHED Published: 2024-11-21T00:00:00 Last Updated: 2024-11-21T18:11:27.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability in the /h/rest endpoint of the Zimbra webmail and admin panel interfaces allows attackers to execute arbitrary JavaScript in the victim's session. This issue is caused by improper sanitization of user input, leading to potential compromise of sensitive information. Exploitation requires user interaction to access the malicious URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.c
tion to access the malicious URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
CVE ID: CVE-2024-45518 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-22T18:10:41.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities,
cution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Securit
mbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
CVE ID: CVE-2024-45519 State: PUBLISHED Published: 2024-10-02T00:00:00.000Z Last Updated: 2025-10-21T22:55:43.984Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes -
bra.com/wiki/Zimbra_Responsible_Disclosure_Policy - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
CVE ID: CVE-2024-45520 State: PUBLISHED Published: 2024-12-01T00:00:00 Last Updated: 2024-12-02T15:49:10.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1 allows a remote Denial of Service because of memory corruption during scanning of a PE32 file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://withsecure.com - https://www.withsecure.com/en/support/security-advisories/cve-2024-45520
CVE ID: CVE-2024-45522 State: PUBLISHED Published: 2024-09-01T00:00:00 Last Updated: 2024-09-03T14:58:51.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linen before cd37c3e does not verify that the domain is linen.dev or www.linen.dev when resetting a password. This occurs in create in apps/web/pages/api/forgot-password/index.ts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Linen-dev/linen.dev/commit/cd37c3e88ec29f4e7baae7e32fe80d0137848d10
CVE ID: CVE-2024-45523 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-20T13:45:25.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bravura Security Fabric versions 12.3.x before 12.3.5.32784, 12.4.x before 12.4.3.35110, 12.5.x before 12.5.2.35950, 12.6.x before 12.6.2.37183, and 12.7.x before 12.7.1.38241. An unauthenticated attacker can cause a resource leak by issuing multiple failed login attempts through API SOAP. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bravurasecurity.com/cve-2024-45523-resource-leak-in-api-after-a-failed-login-attempt
CVE ID: CVE-2024-45526 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-23T18:32:55.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. A remote attacker can send requests with invalid credentials and cause the server performance to degrade gradually. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-45526.pdf
CVE ID: CVE-2024-45527 State: PUBLISHED Published: 2024-09-02T00:00:00 Last Updated: 2024-09-03T14:56:15.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via index.php?logout=1, and can also be used to insert a link to an external phishing website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://github.com/ShellFighter/Reports/blob/main/Vanderbilt%20REDCap%2014.7.0.md
CVE ID: CVE-2024-45528 State: PUBLISHED Published: 2024-09-02T00:00:00 Last Updated: 2024-09-03T15:10:23.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: CodeAstro MembershipM-PHP (aka Membership Management System in PHP) 1.0 allows add_members.php fullname stored XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ShellFighter/VulnerabilityResearch/blob/main/MMS.md
CVE ID: CVE-2024-45537 State: PUBLISHED Published: 2024-09-17T18:37:49.823Z Last Updated: 2025-03-14T15:09:00.250Z Vendors: Apache Software Foundation Products: Apache Druid Problem Types: CWE-20 Description: Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed properties that users are able to provide for their JDBC connections. By default, this allowed properties list restricts users to TLS-related properties only. However, when configuration a MySQL JDBC connection, users can use a particu
ricts users to TLS-related properties only. However, when configuration a MySQL JDBC connection, users can use a particularly-crafted JDBC connection string to provide properties that are not on this allow list. Users without the permission to configure JDBC connections are not able to exploit this vulnerability. CVE-2021-26919 describes a similar vulnerability which was partially addressed in Apache Druid 0.20.2. This issue is fixed in Apache Druid 30.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/2ovx1t77y6tlkhk5b42clp4vwo4c8cjv
CVE ID: CVE-2024-45540 State: PUBLISHED Published: 2025-04-07T10:15:39.027Z Last Updated: 2025-04-07T18:39:03.384Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while invoking IOCTL map buffer request from userspace. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
CVE ID: CVE-2024-45541 State: PUBLISHED Published: 2025-01-06T10:33:22.981Z Last Updated: 2025-01-06T14:18:35.413Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-120 Description: Memory corruption when IOCTL call is invoked from user-space to read board data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE ID: CVE-2024-45542 State: PUBLISHED Published: 2025-01-06T10:33:24.141Z Last Updated: 2025-01-06T14:18:35.300Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-121 Description: Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE ID: CVE-2024-45543 State: PUBLISHED Published: 2025-04-07T10:15:40.394Z Last Updated: 2025-04-07T18:12:21.866Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-787 Description: Memory corruption while accessing MSM channel map and mixer functions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
CVE ID: CVE-2024-45544 State: PUBLISHED Published: 2025-04-07T10:15:41.689Z Last Updated: 2025-04-07T17:42:45.236Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while processing IOCTL calls to add route entry in the HW. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
CVE ID: CVE-2024-45546 State: PUBLISHED Published: 2025-01-06T10:33:25.262Z Last Updated: 2025-01-06T14:18:35.175Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Memory corruption while processing FIPS encryption or decryption IOCTL call invoked from user-space. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE ID: CVE-2024-45547 State: PUBLISHED Published: 2025-01-06T10:33:26.354Z Last Updated: 2025-01-06T14:18:34.993Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-120 Description: Memory corruption while processing IOCTL call invoked from user-space to verify non extension FIPS encryption and decryption functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE ID: CVE-2024-45548 State: PUBLISHED Published: 2025-01-06T10:33:27.476Z Last Updated: 2025-01-06T14:18:34.868Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Memory corruption while processing FIPS encryption or decryption validation functionality IOCTL call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE ID: CVE-2024-45549 State: PUBLISHED Published: 2025-04-07T10:15:43.251Z Last Updated: 2025-04-07T16:54:13.006Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-497 Description: Information disclosure while creating MQ channels. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
CVE ID: CVE-2024-45550 State: PUBLISHED Published: 2025-01-06T10:33:28.599Z Last Updated: 2025-01-06T14:18:34.673Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-129 Description: Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE ID: CVE-2024-45551 State: PUBLISHED Published: 2025-04-07T10:15:44.780Z Last Updated: 2025-04-07T16:49:45.365Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-1390 Description: Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
CVE ID: CVE-2024-45552 State: PUBLISHED Published: 2025-04-07T10:15:46.280Z Last Updated: 2025-04-07T15:53:03.856Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
CVE ID: CVE-2024-45553 State: PUBLISHED Published: 2025-01-06T10:33:29.773Z Last Updated: 2025-01-08T04:55:46.814Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE ID: CVE-2024-45554 State: PUBLISHED Published: 2025-05-06T08:31:53.725Z Last Updated: 2025-05-07T03:55:43.352Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption during concurrent SSR execution due to race condition on the global maps list. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45555 State: PUBLISHED Published: 2025-01-06T10:33:30.879Z Last Updated: 2025-02-28T06:09:05.191Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-787 Description: Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive images, enabling the booting of a tampered IFS2 system image. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE ID: CVE-2024-45556 State: PUBLISHED Published: 2025-04-07T10:15:47.649Z Last Updated: 2025-04-07T15:51:55.660Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-1262 Description: Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
CVE ID: CVE-2024-45557 State: PUBLISHED Published: 2025-04-07T10:15:48.940Z Last Updated: 2025-04-08T03:56:15.157Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-823 Description: Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
CVE ID: CVE-2024-45558 State: PUBLISHED Published: 2025-01-06T10:33:31.971Z Last Updated: 2025-01-06T14:18:34.320Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE ID: CVE-2024-45559 State: PUBLISHED Published: 2025-01-06T10:33:33.201Z Last Updated: 2025-02-28T06:09:08.161Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE ID: CVE-2024-45560 State: PUBLISHED Published: 2025-02-03T16:51:24.662Z Last Updated: 2025-02-12T20:51:24.628Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-367 Description: Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE ID: CVE-2024-45561 State: PUBLISHED Published: 2025-02-03T16:51:25.844Z Last Updated: 2025-02-12T20:51:24.213Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Memory corruption while handling IOCTL call from user-space to set latency level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE ID: CVE-2024-45562 State: PUBLISHED Published: 2025-05-06T08:31:55.106Z Last Updated: 2025-05-06T13:48:09.879Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption during concurrent access to server info object due to unprotected critical field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45563 State: PUBLISHED Published: 2025-05-06T08:31:56.320Z Last Updated: 2025-05-06T13:47:35.604Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-787 Description: Memory corruption while handling schedule request in Camera Request Manager(CRM) due to invalid link count in the corresponding session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html