Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-38374 State: PUBLISHED Published: 2024-06-28T18:01:51.789Z Last Updated: 2024-08-02T04:04:25.277Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CycloneDX Products: cyclonedx-core-java Problem Types: CWE-611 Description: The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to
ocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8 - https://github.com/CycloneDX/cyclonedx-core-java/pull/434 - https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d
CVE ID: CVE-2024-38375 State: PUBLISHED Published: 2024-06-26T18:46:12.471Z Last Updated: 2024-08-02T04:04:25.287Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H) Vendors: fastly Products: js-compute-runtime Problem Types: CWE-416 Description: @fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and often results in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the `@fastly/js-compute`
in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the `@fastly/js-compute` package. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/fastly/js-compute-runtime/security/advisories/GHSA-mp3g-vpm9-9vqv - https://github.com/fastly/js-compute-runtime/commit/4e16641ef4e159c4a11b500ac861b8fa8d9ff5d3
CVE ID: CVE-2024-38379 State: PUBLISHED Published: 2024-06-22T09:09:32.464Z Last Updated: 2025-03-19T14:35:10.998Z Vendors: Apache Software Foundation Products: Apache Allura Problem Types: CWE-79 Description: Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted. This issue affects Apache Allura: from 1.4.0 through 1.17.0. Users are recommended to upgrade to version 1.17.1, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/2lb6
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp
CVE ID: CVE-2024-38380 State: PUBLISHED Published: 2024-09-17T17:15:54.587Z Last Updated: 2024-09-17T19:38:39.378Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Millbeck Communications Products: Proroute H685t-w Problem Types: CWE-79 Description: This vulnerability occurs when user-supplied input is improperly sanitized and then reflected back to the user's browser, allowing an attacker to execute arbitrary JavaScript in the context of the victim's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-261-02
CVE ID: CVE-2024-38381 State: PUBLISHED Published: 2024-06-21T10:18:12.302Z Last Updated: 2025-11-04T17:21:21.599Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in nci_rx_work syzbot reported the following uninit-value access issue [1] nci_rx_work() parses received packet from ndev->rx_q. It should be validated header size, payload size and total packet size before processing the packet. If an invalid packet is detected, it should be silently discarded. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee
VE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6 - https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619 - https://git.kernel.org/stable/c/f80b786ab0550d0020191a59077b2c7e069db2d1 - https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe - https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3 - https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea - https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c - https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed
CVE ID: CVE-2024-38382 State: PUBLISHED Published: 2024-09-02T03:24:56.930Z Last Updated: 2024-09-03T14:56:33.327Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-125, CWE-922 Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md
CVE ID: CVE-2024-38383 State: PUBLISHED Published: 2024-11-13T21:11:50.314Z Last Updated: 2024-11-14T19:38:20.784Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Quartus(R) Prime Pro Edition software for Windows Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition software for Windows before version 24.2 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01195.html
CVE ID: CVE-2024-38384 State: PUBLISHED Published: 2024-06-24T13:50:51.033Z Last Updated: 2025-05-04T09:13:26.836Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued __blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start is being executed. If WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in the loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with one stat instance being added in blk_cgroup_bio_start(), then the local list in __blkcg_rstat_flush() could be corrupted. Fix the issue by adding one barrier. Additional
art(), then the local list in __blkcg_rstat_flush() could be corrupted. Fix the issue by adding one barrier. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/714e59b5456e4d6e4295a9968c564abe193f461c - https://git.kernel.org/stable/c/785298ab6b802afa75089239266b6bbea590809c - https://git.kernel.org/stable/c/d0aac2363549e12cc79b8e285f13d5a9f42fd08e
CVE ID: CVE-2024-38385 State: PUBLISHED Published: 2024-06-25T14:22:37.560Z Last Updated: 2025-05-04T09:13:28.503Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after() irq_find_at_or_after() dereferences the interrupt descriptor which is returned by mt_find() while neither holding sparse_irq_lock nor RCU read lock, which means the descriptor can be freed between mt_find() and the dereference: CPU0 CPU1 desc = mt_find() delayed_free_desc(desc) irq_desc_get_irq(desc) The use-after-free is reported by KASAN: Call trace: irq_get_next_irq+0x58/0x84 show_stat+0x638/0x824 seq_
get_irq(desc) The use-after-free is reported by KASAN: Call trace: irq_get_next_irq+0x58/0x84 show_stat+0x638/0x824 seq_read_iter+0x158/0x4ec proc_reg_read_iter+0x94/0x12c vfs_read+0x1e0/0x2c8 Freed by task 4471: slab_free_freelist_hook+0x174/0x1e0 __kmem_cache_free+0xa4/0x1dc kfree+0x64/0x128 irq_kobj_release+0x28/0x3c kobject_put+0xcc/0x1e0 delayed_free_desc+0x14/0x2c rcu_do_batch+0x214/0x720 Guard the access with a RCU read lock section. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1c7891812d85500ae2ca4051fa5683fcf29930d8 - https://git.kernel.org/stable/c/d084aa022f84319f8079e30882cbcbc026af9f21 - https://git.ker
00ae2ca4051fa5683fcf29930d8 - https://git.kernel.org/stable/c/d084aa022f84319f8079e30882cbcbc026af9f21 - https://git.kernel.org/stable/c/b84a8aba806261d2f759ccedf4a2a6a80a5e55ba
CVE ID: CVE-2024-38386 State: PUBLISHED Published: 2024-09-02T03:25:00.908Z Last Updated: 2024-09-03T14:55:51.237Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-787 Description: in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md
CVE ID: CVE-2024-38387 State: PUBLISHED Published: 2024-11-13T21:11:47.000Z Last Updated: 2024-11-14T19:43:32.038Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Graphics Driver installers Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in the Intel(R) Graphics Driver installers for versions 15.40 and 15.45 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01191.html
CVE ID: CVE-2024-38388 State: PUBLISHED Published: 2024-06-21T10:18:12.995Z Last Updated: 2025-05-04T09:13:30.195Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup Use the control private_free callback to free the associated data block. This ensures that the memory won't leak, whatever way the control gets destroyed. The original implementation didn't actually remove the ALSA controls in hda_cs_dsp_control_remove(). It only freed the internal tracking structure. This meant it was possible to remove/unload the amp driver while leaving its ALSA controls still present in the
ructure. This meant it was possible to remove/unload the amp driver while leaving its ALSA controls still present in the soundcard. Obviously attempting to access them could cause segfaults or at least dereferencing stale pointers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/191dc1b2ff0fb35e7aff15a53224837637df8bff - https://git.kernel.org/stable/c/6e359be4975006ff72818e79dad8fe48293f2eb2 - https://git.kernel.org/stable/c/3291486af5636540980ea55bae985f3eaa5b0740 - https://git.kernel.org/stable/c/172811e3a557d8681a5e2d0f871dc04a2d17eb13
CVE ID: CVE-2024-38389 State: PUBLISHED Published: 2024-11-28T02:11:04.326Z Last Updated: 2024-11-29T20:50:07.652Z Vendors: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Products: TELLUS, TELLUS Lite Problem Types: CWE-125 Description: There is an Out-of-bounds read vulnerability in TELLUS (v4.0.19.0 and earlier) and TELLUS Lite (v4.0.19.0 and earlier). If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU97531313/
CVE ID: CVE-2024-38390 State: PUBLISHED Published: 2024-06-21T10:18:13.639Z Last Updated: 2025-05-04T12:56:41.038Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails Calling a6xx_destroy() before adreno_gpu_init() leads to a null pointer dereference on: msm_gpu_cleanup() : platform_set_drvdata(gpu->pdev, NULL); as gpu->pdev is only assigned in: a6xx_gpu_init() |_ adreno_gpu_init |_ msm_gpu_init() Instead of relying on handwavy null checks down the cleanup chain, explicitly de-allocate the LLC data and free a6xx_gpu instead. Patchwork: https://patchwork.freedeskto
he cleanup chain, explicitly de-allocate the LLC data and free a6xx_gpu instead. Patchwork: https://patchwork.freedesktop.org/patch/588919/ Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/247849eeb3fd88f8990ed73e33af70d5c10f9aec - https://git.kernel.org/stable/c/a1955a6df91355fef72a3a254700acd3cc1fec0d - https://git.kernel.org/stable/c/617e3d1680504a3f9d88e1582892c68be155498f - https://git.kernel.org/stable/c/46d4efcccc688cbacdd70a238bedca510acaa8e4
CVE ID: CVE-2024-38391 State: REJECTED Published: 2024-06-21T10:18:14.299Z Last Updated: 2024-07-02T19:16:26.621Z Description: No description available.
CVE ID: CVE-2024-38392 State: PUBLISHED Published: 2025-04-02T00:00:00.000Z Last Updated: 2025-04-03T13:20:55.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity Connect before 1.13.0 lacks sufficient authenticity checks during the loading of resources, and thus remote attackers can cause the application to run untrusted code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.pexip.com/admin/security_bulletins.htm
CVE ID: CVE-2024-38394 State: PUBLISHED Published: 2024-06-15T00:00:00 Last Updated: 2024-11-12T20:55:53.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
GSD would be in the context of "a new feature, not a CVE." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pulsesecurity.co.nz/advisories/usbguard-bypass - https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780 - https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780#note_2047914 - https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/tags
CVE ID: CVE-2024-38395 State: PUBLISHED Published: 2024-06-16T00:00:00 Last Updated: 2024-08-02T04:12:24.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://iterm2.com/downloads.html - https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219 - https://www.openwall.com/lists/oss-security/2024/06/15/1 - https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2 - http://www.openwall.com/lists/oss-security
ss-security/2024/06/15/1 - https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2 - http://www.openwall.com/lists/oss-security/2024/06/17/1
CVE ID: CVE-2024-38396 State: PUBLISHED Published: 2024-06-16T00:00:00 Last Updated: 2024-08-02T04:12:24.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux integration feature (enabled by default), allows an attacker to inject arbitrary code into the terminal, a different vulnerability than CVE-2024-38395. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://iterm2.com/downloads.html - https://vin01.github.io/piptagole/escape-sequences/iterm2/rce/2024/06/16/iterm2-rce-window-title-t
.com/downloads.html - https://vin01.github.io/piptagole/escape-sequences/iterm2/rce/2024/06/16/iterm2-rce-window-title-tmux-integration.html - https://gitlab.com/gnachman/iterm2/-/commit/fc60236a914d63fb70a5c632e211203a4f1bd4dd - http://www.openwall.com/lists/oss-security/2024/06/17/1
CVE ID: CVE-2024-38397 State: PUBLISHED Published: 2024-10-07T12:58:58.120Z Last Updated: 2024-10-07T13:10:33.347Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Transient DOS while parsing probe response and assoc response frame. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE ID: CVE-2024-38399 State: PUBLISHED Published: 2024-10-07T12:58:59.102Z Last Updated: 2024-10-07T13:09:46.180Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while processing user packets to generate page faults. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE ID: CVE-2024-38401 State: PUBLISHED Published: 2024-09-02T10:22:47.276Z Last Updated: 2024-09-05T03:56:14.061Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while processing concurrent IOCTL calls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE ID: CVE-2024-38402 State: PUBLISHED Published: 2024-09-02T10:22:48.204Z Last Updated: 2024-09-06T16:19:57.498Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while processing IOCTL call for getting group info. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE ID: CVE-2024-38403 State: PUBLISHED Published: 2024-11-04T10:04:44.792Z Last Updated: 2024-11-04T14:26:39.787Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Transient DOS while parsing BTM ML IE when per STA profile is not included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE ID: CVE-2024-38404 State: PUBLISHED Published: 2025-02-03T16:51:13.417Z Last Updated: 2025-02-03T17:44:19.048Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE ID: CVE-2024-38405 State: PUBLISHED Published: 2024-11-04T10:04:46.138Z Last Updated: 2024-11-04T14:57:51.030Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Transient DOS while processing the CU information from RNR IE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE ID: CVE-2024-38406 State: PUBLISHED Published: 2024-11-04T10:04:47.459Z Last Updated: 2024-11-16T04:55:21.871Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-367 Description: Memory corruption while handling IOCTL calls in JPEG Encoder driver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE ID: CVE-2024-38407 State: PUBLISHED Published: 2024-11-04T10:04:48.761Z Last Updated: 2024-11-16T04:55:23.328Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-367 Description: Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE ID: CVE-2024-38408 State: PUBLISHED Published: 2024-11-04T10:04:50.376Z Last Updated: 2024-11-04T14:56:33.847Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-310 Description: Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE ID: CVE-2024-38409 State: PUBLISHED Published: 2024-11-04T10:04:51.957Z Last Updated: 2024-11-16T04:55:24.570Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-120 Description: Memory corruption while station LL statistic handling. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE ID: CVE-2024-38410 State: PUBLISHED Published: 2024-11-04T10:04:53.283Z Last Updated: 2024-11-16T04:55:25.671Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-121 Description: Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE ID: CVE-2024-38411 State: PUBLISHED Published: 2025-02-03T16:51:14.753Z Last Updated: 2025-02-03T17:43:58.609Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE ID: CVE-2024-38412 State: PUBLISHED Published: 2025-02-03T16:51:15.999Z Last Updated: 2025-02-03T17:43:30.713Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html