Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-45410 State: PUBLISHED Published: 2024-09-19T22:51:02.622Z Last Updated: 2024-09-20T14:59:42.914Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: traefik Products: traefik Problem Types: CWE-345, CWE-348 Description: Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified.
rs. Since the application trusts the value of these headers, security implications might arise, if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/traefik/traefik/security/advisories/GHSA-62c8-mh53-4cqv - https://github.com/traefik/traefik/rele
: - https://github.com/traefik/traefik/security/advisories/GHSA-62c8-mh53-4cqv - https://github.com/traefik/traefik/releases/tag/v2.11.9 - https://github.com/traefik/traefik/releases/tag/v3.1.3
CVE ID: CVE-2024-45411 State: PUBLISHED Published: 2024-09-09T18:20:28.363Z Last Updated: 2024-09-16T12:04:18.107Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: twigphp Products: Twig Problem Types: CWE-693 Description: Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66 - https://github.com/twigphp/Twig/commit/11f68
- https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66 - https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6 - https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de - https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233
CVE ID: CVE-2024-45412 State: PUBLISHED Published: 2024-09-10T15:19:40.623Z Last Updated: 2024-09-10T16:09:40.822Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: yeti-platform Products: yeti Problem Types: CWE-770 Description: Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial of service with attacks such as One Million Unicode payload. This can get worse with the use of special Unicode characters like U+2100 (℀), or
s such as One Million Unicode payload. This can get worse with the use of special Unicode characters like U+2100 (℀), or U+2105 (℅) which could lead the payload size to be tripled. Versions prior to 2.1.11 are affected by this vulnerability. The patch is included in 2.1.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yeti-platform/yeti/security/advisories/GHSA-cwwm-pq9x-2cxv - https://github.com/yeti-platform/yeti/commit/f1f0082e7c165f148ae95f4deeb2786404797a39 - https://hackerone.com/reports/2258758
CVE ID: CVE-2024-45413 State: PUBLISHED Published: 2024-09-16T00:00:00 Last Updated: 2024-09-18T15:22:15.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function. This function is an API wrapper for LUA to decrypt RSA encrypted ciphertext, the decrypted data is stored on the stack without checking its length. An authenticated attacker can get RCE as root by exploiting this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory/
CVE ID: CVE-2024-45414 State: PUBLISHED Published: 2024-09-16T00:00:00 Last Updated: 2024-09-18T15:21:25.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. This function is responsible for decrypting RSA encrypted ciphertext, the encrypted data is supplied base64 encoded. The decoded ciphertext is stored on the stack without checking its length. An unauthenticated attacker can get RCE as root by exploiting this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-ad
t Notes: - CISA ADP Vulnrichment: References: - https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory/
CVE ID: CVE-2024-45415 State: PUBLISHED Published: 2024-09-16T00:00:00 Last Updated: 2024-09-18T15:23:17.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. This function is responsible for validating the checksum of data in post request. The checksum is sent encrypted in the request, the function decrypts it and stores the checksum on the stack without validating it. An unauthenticated attacker can get RCE as root by exploiting this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wr3nchsr.github.io/zte-multiple-routers
bility. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory/
CVE ID: CVE-2024-45416 State: PUBLISHED Published: 2024-09-16T00:00:00 Last Updated: 2024-09-18T15:18:27.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are stored in the directory /var/lua_session, the function iterates on all files in this directory and executes them using the function dofile without any validation if it is a valid session file or not. An attacker who is able to write a malicious file in the sessions directory can get RCE as root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wr3nchsr.github.io/zte-mu
can get RCE as root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory/
CVE ID: CVE-2024-45417 State: PUBLISHED Published: 2025-02-25T19:49:22.296Z Last Updated: 2025-02-26T16:42:11.552Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Zoom Communications, Inc Products: Zoom Apps for macOS Problem Types: CWE-708 Description: Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct a disclosure of information via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24039/
CVE ID: CVE-2024-45418 State: PUBLISHED Published: 2025-02-25T19:52:25.471Z Last Updated: 2025-02-25T20:07:09.959Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Zoom Communications, Inc Products: Zoom Apps for macOS Problem Types: CWE-61 Description: Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24040/
CVE ID: CVE-2024-45419 State: PUBLISHED Published: 2024-11-19T19:28:48.335Z Last Updated: 2024-11-19T21:46:16.379Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Zoom Communications Inc. Products: Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers Problem Types: CWE-252 Description: Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24041
CVE ID: CVE-2024-45420 State: PUBLISHED Published: 2024-11-19T19:32:02.656Z Last Updated: 2024-11-20T15:16:27.856Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Zoom Communications Inc. Products: Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers Problem Types: CWE-400 Description: Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24042
CVE ID: CVE-2024-45421 State: PUBLISHED Published: 2025-02-25T19:55:02.666Z Last Updated: 2025-02-25T20:09:12.193Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Communications, Inc Products: Zoom Apps Problem Types: CWE-122 Description: Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24043/
CVE ID: CVE-2024-45422 State: PUBLISHED Published: 2024-11-19T19:45:25.914Z Last Updated: 2024-11-20T15:42:40.830Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Zoom Communications Inc. Products: Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers Problem Types: CWE-20 Description: Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24044
CVE ID: CVE-2024-45424 State: PUBLISHED Published: 2025-02-25T19:34:24.811Z Last Updated: 2025-02-25T19:39:53.249Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-840 Description: Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24036/
CVE ID: CVE-2024-45425 State: PUBLISHED Published: 2025-02-25T19:38:02.925Z Last Updated: 2025-02-26T16:57:20.637Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-286 Description: Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24037/
CVE ID: CVE-2024-45426 State: PUBLISHED Published: 2025-02-25T19:39:48.596Z Last Updated: 2025-02-26T16:49:25.061Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-708 Description: Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24038/
CVE ID: CVE-2024-45429 State: PUBLISHED Published: 2024-09-04T23:07:58.383Z Last Updated: 2025-03-25T15:47:51.771Z Vendors: WP Engine Products: Advanced Custom Fields, Advanced Custom Fields Pro Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker's. Additional Analyst Notes: - CISA ADP Vulnrichm
browser of the logged-in user with the same privilege as the attacker's. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.advancedcustomfields.com/blog/acf-6-3-6/ - https://wordpress.org/plugins/advanced-custom-fields/ - https://www.advancedcustomfields.com/ - https://jvn.jp/en/jp/JVN67963942/
CVE ID: CVE-2024-45431 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-12T17:29:10.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Improper Input Validation. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of proper validation of remote L2CAP channel ID (CID). An attacker can leverage this to create an L2CAP channel with the null identifier assigned as a remote CID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.opensynergy.com/ - https://pcacybersecurity.com/resources/advisory/perfekt-blue
CVE ID: CVE-2024-45432 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-12T17:27:55.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSynergy BlueSDK (aka Blue SDK) through 6.x mishandles a function call. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from an incorrect variable used as a function argument. An attacker can leverage this to cause unexpected behavior or obtain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.opensynergy.com/ - https://pcacybersecurity.com/resources/advisory/perfekt-blue
CVE ID: CVE-2024-45433 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-12T17:25:30.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Incorrect Control Flow Scoping. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of proper return control flow after detecting an unusual condition. An attacker can leverage this to bypass a security validation and make the incoming data be processed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.opensynergy.com/ - https://pcacybersecurity.com/resources/advisory/perfekt-blue
CVE ID: CVE-2024-45434 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-12T17:31:13.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of validating the existence of an object before performing operations on the object (aka use after free). An attacker can leverage this to achieve remote code execution in the context of a user account under which the Bluetooth process runs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.opensynergy.com/ - https://pcacybersecurity.c
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.opensynergy.com/ - https://pcacybersecurity.com/resources/advisory/perfekt-blue
CVE ID: CVE-2024-45435 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-29T13:23:45.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/tariqhawis/c67177164d3b7975210caddb25b60d62 - https://github.com/chartist-js/chartist/issues/1427
CVE ID: CVE-2024-45436 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-29T14:16:30.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ollama/ollama/pull/5314 - https://github.com/ollama/ollama/compare/v0.1.46...v0.1.47
CVE ID: CVE-2024-45438 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-11-03T19:30:54.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. Notably, when a non-existent email address is provided as part of the email parameter, SpamTitan will automatically create a user record and associate quarantine settings with it - all without requiring authentication. Additional Analyst Notes: - CISA ADP Vulnri
ssociate quarantine settings with it - all without requiring authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.titanhq.com/en/13161-spamtitan-release-notes.html - https://www.titanhq.com/email-protection/ - https://www.seralys.com/research/CVE-2024-45438.txt - https://seclists.org/fulldisclosure/2025/Sep/15
CVE ID: CVE-2024-45440 State: PUBLISHED Published: 2024-08-29T00:00:00.000Z Last Updated: 2025-04-21T14:58:52.108Z Vendors: Drupal Products: Drupal core Problem Types: n/a Description: core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.drupal.org/project/drupal/issues/3457781 - https://senscybersecurity.nl/CVE-2024-45440-Explained/
CVE ID: CVE-2024-45441 State: PUBLISHED Published: 2024-09-04T01:37:25.340Z Last Updated: 2024-09-04T13:27:47.004Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: huawei, Huawei Products: HarmonyOS, EMUI Problem Types: CWE-20 Description: Input verification vulnerability in the system service module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE ID: CVE-2024-45442 State: PUBLISHED Published: 2024-09-04T01:38:53.322Z Last Updated: 2024-09-04T13:27:20.571Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-264 Description: Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE ID: CVE-2024-45443 State: PUBLISHED Published: 2024-09-04T01:49:51.125Z Last Updated: 2024-09-04T13:34:39.560Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-22 Description: Directory traversal vulnerability in the cust module Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE ID: CVE-2024-45444 State: PUBLISHED Published: 2024-09-04T01:51:49.034Z Last Updated: 2024-09-04T13:21:46.703Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-20 Description: Access permission verification vulnerability in the WMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE ID: CVE-2024-45445 State: PUBLISHED Published: 2024-09-04T01:54:26.309Z Last Updated: 2024-09-04T13:13:31.811Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-459 Description: Vulnerability of resources not being closed or released in the keystore module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE ID: CVE-2024-45446 State: PUBLISHED Published: 2024-09-04T02:14:48.613Z Last Updated: 2024-09-04T13:12:39.116Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-20 Description: Access permission verification vulnerability in the camera driver module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE ID: CVE-2024-45447 State: PUBLISHED Published: 2024-09-04T02:16:37.736Z Last Updated: 2024-09-04T13:11:52.999Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-200 Description: Access control vulnerability in the camera framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE ID: CVE-2024-45448 State: PUBLISHED Published: 2024-09-04T02:19:20.881Z Last Updated: 2025-09-18T06:35:41.599Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-1259 Description: Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/9/ - https://consumer.huawei.com/en/support/bulletin/2024/11/
CVE ID: CVE-2024-45449 State: PUBLISHED Published: 2024-09-04T02:21:12.057Z Last Updated: 2024-09-04T13:07:58.483Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-264 Description: Access permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE ID: CVE-2024-45450 State: PUBLISHED Published: 2024-09-04T01:15:26.814Z Last Updated: 2024-09-04T13:32:51.043Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-200 Description: Permission control vulnerability in the software update module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://consumer.huawei.com/en/support/bulletin/2024/9/