Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-56404 State: PUBLISHED Published: 2025-01-24T00:00:00.000Z Last Updated: 2025-01-24T19:43:57.848Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: OneIdentity Products: Identity Manager Problem Types: CWE-302 Description: In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. Only On-Premise installations are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oneidentity.com/community/identity-manager/ - https://support.oneidentity.com/technical-documents/identity-manager/9.3/release-notes/ - https://support.oneidentity.com/pr
s://support.oneidentity.com/technical-documents/identity-manager/9.3/release-notes/ - https://support.oneidentity.com/product-notification/noti-00001678
CVE ID: CVE-2024-56406 State: PUBLISHED Published: 2025-04-13T13:16:09.841Z Last Updated: 2025-10-16T14:04:20.393Z Vendors: perl Products: perl Problem Types: CWE-122, CWE-787 Description: A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on p
ore dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch - https://metacpan.org/release/SHAY/perl-5.38.4/changes - https://metacpan.org/release/SHAY/perl-5.40.2/changes
CVE ID: CVE-2024-56408 State: PUBLISHED Published: 2025-01-03T16:05:22.944Z Last Updated: 2025-05-20T18:30:55.096Z Vendors: PHPOffice Products: PhpSpreadsheet Problem Types: CWE-79 Description: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-x8
st Notes: - CISA ADP Vulnrichment: References: - https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-x88g-h956-m5xg - https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4 - https://github.com/PHPOffice/PhpSpreadsheet/commit/9b9a55c7154daa7cd4095f618933c240508ba3c1 - https://github.com/PHPOffice/PhpSpreadsheet/commit/a50ebfe118b3ae0ddaea1c48ac19dc38692f4abc - https://github.com/PHPOffice/PhpSpreadsheet/commit/b8fac55aa5cb7a3d514c7308378bb37bb711b25e
CVE ID: CVE-2024-56409 State: PUBLISHED Published: 2025-01-03T17:05:43.272Z Last Updated: 2025-01-03T18:14:49.852Z Vendors: PHPOffice Products: PhpSpreadsheet Problem Types: CWE-79 Description: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Currency.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
, 2.1.6, and 1.29.7 contain a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-j2xg-cjcx-4677 - https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4
CVE ID: CVE-2024-56410 State: PUBLISHED Published: 2025-01-03T17:17:52.596Z Last Updated: 2025-01-03T20:11:13.518Z Vendors: PHPOffice Products: PhpSpreadsheet Problem Types: CWE-79 Description: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wv23-996v-q229 - https://github.com/PHPOff
ences: - https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wv23-996v-q229 - https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e
CVE ID: CVE-2024-56411 State: PUBLISHED Published: 2025-01-03T17:19:00.339Z Last Updated: 2025-01-03T17:37:25.986Z Vendors: PHPOffice Products: PhpSpreadsheet Problem Types: CWE-79 Description: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability of the hyperlink base in the HTML page header. The HTML page is formed without sanitizing the hyperlink base. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hwcp-2h35-p66w -
A ADP Vulnrichment: References: - https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hwcp-2h35-p66w - https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e
CVE ID: CVE-2024-56412 State: PUBLISHED Published: 2025-01-03T17:20:51.827Z Last Updated: 2025-01-03T17:35:43.196Z Vendors: PHPOffice Products: PhpSpreadsheet Problem Types: CWE-79 Description: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichm
. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-q9jv-mm3r-j47r - https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e
CVE ID: CVE-2024-56413 State: PUBLISHED Published: 2025-01-02T15:26:00.507Z Last Updated: 2025-01-02T17:09:09.822Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-613 Description: Missing session invalidation after user deletion. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-7612
CVE ID: CVE-2024-56414 State: PUBLISHED Published: 2025-01-02T15:26:10.784Z Last Updated: 2025-01-02T17:08:22.194Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-328 Description: Web installer integrity check used weak hash algorithm. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-1911
CVE ID: CVE-2024-56426 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-04T21:25:22.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, W920, W930, W1000. The lack of a length check leads to out-of-bounds writes via malformed USB packets to the target. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-56426/
CVE ID: CVE-2024-56427 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-27T18:12:22.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. The lack of a length check leads to out-of-bounds access via malformed RRC packets to the target. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-secur
port/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-56427/
CVE ID: CVE-2024-56428 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T19:45:07.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the CONFIGS table) for their servers configured in the client. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://itech-gmbh.de/#ueber-itech - https://github.com/lisa-2905/CVE-2024-56428
CVE ID: CVE-2024-56429 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T13:44:17.085Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: itech Products: iLabClient Problem Types: CWE-321 Description: itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users to read or write to the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://itech-gmbh.de/produkte/ - https://github.com/lisa-2905/CVE-2024-56429
CVE ID: CVE-2024-56430 State: PUBLISHED Published: 2024-12-25T00:00:00.000Z Last Updated: 2025-08-27T21:43:05.726Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenFHE Products: OpenFHE Problem Types: CWE-476 Description: OpenFHE through 1.2.3 has a NULL pointer dereference in BinFHEContext::EvalFloor in lib/binfhe-base-scheme.cpp. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/openfheorg/openfhe-development/releases/tag/v1.2.3 - https://github.com/UnionTech-Software/openfhe-PoC - https://github.com/openfheorg/openfhe-development/blob/7b8346f4eac27121543e36c17237b919e03ec058/src/binfhe/lib/binfhe-
- https://github.com/openfheorg/openfhe-development/blob/7b8346f4eac27121543e36c17237b919e03ec058/src/binfhe/lib/binfhe-base-scheme.cpp#L307-L308
CVE ID: CVE-2024-56431 State: PUBLISHED Published: 2024-12-25T00:00:00.000Z Last Updated: 2025-05-07T19:45:58.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/xiph/theora/issues/17#issuecomment-2480630603 - https://github.com/xiph/theora/blob/7180717276af1ebc7da15c83162d6c5d6203aabf/lib/huffdec.c#L193 - https://github.com/UnionTech-S
github.com/xiph/theora/blob/7180717276af1ebc7da15c83162d6c5d6203aabf/lib/huffdec.c#L193 - https://github.com/UnionTech-Software/libtheora-CVE-2024-56431-PoC - https://www.openwall.com/lists/oss-security/2025/04/25/6
CVE ID: CVE-2024-56433 State: PUBLISHED Published: 2024-12-26T00:00:00 Last Updated: 2024-12-27T14:48:48.272Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: shadow-maint Products: shadow-utils Problem Types: CWE-1188 Description: shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). N
or access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shadow-maint/shadow/issues/1157 - https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241 - https://github.com/shadow-maint/shadow/releases/tag/4.4
CVE ID: CVE-2024-56434 State: PUBLISHED Published: 2025-01-08T01:32:32.297Z Last Updated: 2025-09-18T06:39:02.935Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-416 Description: UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerability may cause service exceptions of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56435 State: PUBLISHED Published: 2025-01-08T01:33:41.726Z Last Updated: 2025-09-18T06:46:10.006Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-1021 Description: Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56436 State: PUBLISHED Published: 2025-01-08T01:46:26.175Z Last Updated: 2025-09-18T06:39:24.925Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-1021 Description: Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56437 State: PUBLISHED Published: 2025-01-08T02:01:27.893Z Last Updated: 2025-01-08T15:30:45.304Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-20 Description: Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56438 State: PUBLISHED Published: 2025-01-08T02:04:06.730Z Last Updated: 2025-09-18T06:39:47.591Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-119 Description: Vulnerability of improper memory address protection in the HUKS module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56439 State: PUBLISHED Published: 2025-01-08T02:05:13.262Z Last Updated: 2025-09-18T06:46:30.612Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-311 Description: Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56440 State: PUBLISHED Published: 2025-01-08T02:08:46.885Z Last Updated: 2025-01-08T15:28:04.629Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-264 Description: Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56441 State: PUBLISHED Published: 2025-01-08T02:12:46.961Z Last Updated: 2025-01-08T15:18:46.112Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-362 Description: Race condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56442 State: PUBLISHED Published: 2025-01-08T02:20:03.579Z Last Updated: 2025-01-08T15:18:05.304Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-227 Description: Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56443 State: PUBLISHED Published: 2025-01-08T02:37:31.730Z Last Updated: 2025-01-08T14:41:31.832Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-200 Description: Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56444 State: PUBLISHED Published: 2025-01-08T02:44:26.370Z Last Updated: 2025-01-08T14:40:33.203Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-264 Description: Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56445 State: PUBLISHED Published: 2025-01-08T03:00:46.813Z Last Updated: 2025-01-08T14:47:17.261Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-287 Description: Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56446 State: PUBLISHED Published: 2025-01-08T03:01:49.820Z Last Updated: 2025-01-08T14:46:53.161Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-457 Description: Vulnerability of variables not being initialized in the notification module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56447 State: PUBLISHED Published: 2025-01-08T03:03:11.490Z Last Updated: 2025-01-08T14:45:43.328Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-269 Description: Vulnerability of improper permission control in the window management module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56448 State: PUBLISHED Published: 2025-01-08T03:11:56.159Z Last Updated: 2025-01-08T14:44:56.350Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-94 Description: Vulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56449 State: PUBLISHED Published: 2025-01-08T03:13:25.971Z Last Updated: 2025-01-08T15:17:42.154Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-840 Description: Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56450 State: PUBLISHED Published: 2025-01-08T03:14:51.159Z Last Updated: 2025-01-08T15:17:21.576Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-120 Description: Buffer overflow vulnerability in the component driver module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56451 State: PUBLISHED Published: 2025-01-08T03:16:10.615Z Last Updated: 2025-01-08T15:14:01.909Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-680 Description: Integer overflow vulnerability during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2024-56452 State: PUBLISHED Published: 2025-01-08T03:17:19.704Z Last Updated: 2025-01-08T15:13:35.092Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-120 Description: Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/