alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2015-9179 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8974, lack of length checking in OEMCrypto_DeriveKeysFromSessionKey() could lead to a buffer overflow vulnerability.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: msm8974, msm8974_firmware
CVE-2015-9180 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, the response pointer passed from user space to SDMX_process is not checked before it is used. If the given response buffer length is smaller than 16 bytes, the response values will be written to a memory outside the buffer, possibly in the secure memory area.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9650, mdm9650_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450, sd_450_firmware, sd_600, sd_600_firmware, sd_615
CVE-2015-9181 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, in a crypto API function, a buffer over-read can occur.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450, sd_450_firmware, sd_615, sd_615_firmware, sd_616
CVE-2015-9182 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, lack of input validation in OEMCrypto_GenerateSignature() can cause buffer over read.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450
CVE-2015-9183 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 617, SD 650/52, SD 800, SD 808, and SD 810, in TQS QSEE application, while parsing "Set Certificates" command an integer overflow may result in buffer overflow.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_617, sd_617_firmware, sd_650, sd_650_firmware, sd_652, sd_652_firmware, sd_800, sd_800_firmware, sd_808, sd_808_firmware, sd_810, sd_810_firmware
CVE-2015-9184 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, lack of length checking in wv_dash_core_load_keys_v8() could lead to a buffer overflow vulnerability.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450, sd_450_firmware, sd_615, sd_615_firmware, sd_616
CVE-2015-9185 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, in multiple Secure DEMUX functions (e.g., SDMX_open_session, SDMX_close_session, SDMX_set_session_cfg), when parameter validation fails, an error code is written into a response buffer, without checking that response buffer length (rsplen) passed from HLOS is large enough to hold the response. If the buffer is at the end of a non-secure page followed by secured memory page, this can cause a secure memory corruption.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9650, mdm9650_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450, sd_450_firmware, sd_600, sd_600_firmware, sd_615
CVE-2015-9186 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, in a PlayReady API function, a buffer over-read can occur.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450
CVE-2015-9187 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, lack of buffer length validation in pvr_cmd_handler leads to unauthorized access to secure memory.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9650, mdm9650_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450, sd_450_firmware, sd_615, sd_615_firmware, sd_616
CVE-2015-9188 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, in Secure DEMUX command handler, when parameter validation fails, an error code is written into a response buffer without checking that response buffer length, passed from HLOS, which may result in memory corruption.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9650, mdm9650_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450, sd_450_firmware, sd_600, sd_600_firmware, sd_615
CVE-2015-9189 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 808, and SD 810, processing of TZ application command in tz_app_cmd_handler function could lead to potential content disclosure of secure memory.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: qualcomm
Affected products: ipq4019, ipq4019_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9615, mdm9615_firmware, mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412
CVE-2015-9190 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 808, and SD 810, if start_addr + size is too large in boot_clobber_check_local_address_range(), an integer overflow occurs, resulting in clobber protection check being bypassed and SBL memory corruption.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: qualcomm
Affected products: ipq4019, ipq4019_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9615, mdm9615_firmware, mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412
CVE-2015-9191 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 617, SD 650/52, SD 808, SD 810, and SDX20, in a QTEE syscall handler, an untrusted pointer dereference can occur.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9635m, mdm9635m_firmware, mdm9640, mdm9640_firmware, mdm9645, mdm9645_firmware, mdm9650, mdm9650_firmware, mdm9655, mdm9655_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410
CVE-2015-9192 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, out of bounds memory access vulnerability may occur in the content protection manager due to improper validation of incoming messages.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9650, mdm9650_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450, sd_450_firmware, sd_615
CVE-2015-9193 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, improper input validation could cause a memory overread and cause the app to crash.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450
CVE-2015-9194 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 845, and Snapdragon_High_Med_2016, during module load at TZ Startup, memory statically allocated by modules was not being properly set to zero first. Allowing the module to execute without reset gives it access to information from previous app thus leading to information exposure.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: qualcomm
Affected products: sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_425, sd_425_firmware, sd_427, sd_427_firmware, sd_430, sd_430_firmware, sd_435, sd_435_firmware, sd_450, sd_450_firmware, sd_617, sd_617_firmware, sd_625, sd_625_firmware, sd_650, sd_650_firmware, sd_652
CVE-2015-9195 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, MDM9650, MDM9655, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, SD 810, and SDX20, in a QTEE syscall handler, HLOS can cause a buffer overflow to occur.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, mdm9650, mdm9650_firmware, mdm9655, mdm9655_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_615, sd_615_firmware, sd_616, sd_616_firmware, sd_617, sd_617_firmware, sd_650, sd_650_firmware, sd_652
CVE-2015-9196 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Small Cell SoC FSM9055, MDM9635M, SD 400, and SD 800, improper input validation in tzbsp_ocmem can cause privilege escalation.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: fsm9055, fsm9055_firmware, mdm9635m, mdm9635m_firmware, sd_400, sd_400_firmware, sd_800, sd_800_firmware
CVE-2015-9197 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, when enabling XPUs for SMEM partitions, if configuration values are out of range, memory access outside the SMEM may occur and set incorrect XPU configurations.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-16
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9635m, mdm9635m_firmware, mdm9640, mdm9640_firmware, mdm9645, mdm9645_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415
CVE-2015-9198 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, integer underflow vulnerability in function qsee_register_log_buff may lead to arbitrary writing of secure memory.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-191
Affected vendors: qualcomm
Affected products: ipq4019, ipq4019_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, mdm9640, mdm9640_firmware, mdm9645, mdm9645_firmware, mdm9650, mdm9650_firmware, mdm9655, mdm9655_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212
CVE-2015-9199 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile IPQ4019, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, SD 808, SD 810, SD 820, and SD 820A, A non-secure region check is done while registering QSEE buffer address which is passed by HLOS but not while logging in the QSEE buffer, so corruption of dynamically protected secure region can occur if the non-secure buffer is changed between the time it's checked and when it's used.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: ipq4019, ipq4019_firmware, mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, mdm9655, mdm9655_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415
CVE-2015-9200 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, and SD 835, in some TrustZone API functions, untrusted pointers can be dereferenced.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9650, mdm9650_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450, sd_450_firmware, sd_625, sd_625_firmware, sd_650, sd_650_firmware, sd_652, sd_652_firmware, sd_835, sd_835_firmware
CVE-2015-9201 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, and SDX20, integer overflow in tzbsp can lead to privilege escalation.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, mdm9640, mdm9640_firmware, mdm9645, mdm9645_firmware, mdm9650, mdm9650_firmware, mdm9655, mdm9655_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400
CVE-2015-9202 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, while processing the content headers in the Playready module, a buffer overread may occur if the header count exceeds the expected value.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450, sd_450_firmware, sd_615
CVE-2015-9203 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, lack of input validation in playready_set_domainid could lead to a buffer overread.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450
CVE-2015-9204 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 808, and SD 810, if cchFriendlyName is greater than TZ_PR_MAX_NAME_LEN in function playready_leavedomain_generate_challenge(), a buffer overread occurs.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_615, sd_615_firmware, sd_616, sd_616_firmware, sd_808, sd_808_firmware, sd_810, sd_810_firmware
CVE-2015-9205 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 808, and SD 810, in a PlayReady API function, a buffer over-read can occur.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_615, sd_615_firmware, sd_616, sd_616_firmware, sd_808, sd_808_firmware, sd_810, sd_810_firmware
CVE-2015-9206 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, during XML encoding of a message in the Playready module, a buffer overread may occur if the message passed is large.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_615, sd_615_firmware, sd_616, sd_616_firmware, sd_617, sd_617_firmware, sd_650, sd_650_firmware, sd_652
CVE-2015-9207 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, and SD 810, lack of input validation in playready_getadditional_responsedata could lead to a buffer overread.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_615, sd_615_firmware, sd_616, sd_616_firmware, sd_617, sd_617_firmware, sd_650, sd_650_firmware, sd_652
CVE-2015-9208 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, and SD 810, the function tzbsp_pil_verify_sig() does not strictly check that the pointer to ELF and program headers and hash segment is within secure memory. It only checks that the address is not in non-secure memory. A given address range can overlap with both secure and non-secure regions - hence if such an address is passed in, it would not pass the non-secure range check, and would be considered valid by the function, even though that memory area could be modified by the non-secure side.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: ipq4019, ipq4019_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9635m, mdm9635m_firmware, mdm9640, mdm9640_firmware, mdm9645, mdm9645_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412
CVE-2015-9209 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, there is improper access control in a file storage API.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9615, mdm9615_firmware, mdm9635m, mdm9635m_firmware, mdm9640, mdm9640_firmware, mdm9645, mdm9645_firmware, mdm9650, mdm9650_firmware, mdm9655, mdm9655_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400
CVE-2015-9210 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, lack of input validation in playready_licacq_process_response() can lead to memory over read.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450
CVE-2015-9211 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, while provising the Playready module, a buffer overread may occur if the message passed is large.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_430, sd_430_firmware, sd_450
CVE-2015-9212 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, and SD 800, lack of input validation while processing TZ_PR_CMD_SAVE_KEY command could lead to a buffer overread.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_800, sd_800_firmware
CVE-2015-9213 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, the DIAG-EFS command EFS2_DIAG_DELTREE, which is handled by the function fs_diag_deltree_handler(), is used to delete files and directories only inside the /public folder.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-17
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9615, mdm9615_firmware, mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, mdm9640, mdm9640_firmware, mdm9645, mdm9645_firmware, mdm9650, mdm9650_firmware, mdm9655, mdm9655_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212
CVE-2015-9215 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, and SD 810, improper input validation can cause a null pointer dereference in USB bootloader find_ep() function.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: mdm9615, mdm9615_firmware, mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, sd_810, sd_810_firmware
CVE-2015-9216 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, and SD 810, improper handling of simultaneous interrupt in USB module during USB RESET and EP COMPLETE.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_415, sd_415_firmware, sd_425
CVE-2015-9217 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, certain malformed HVEC clips could cause an assertion to fail.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: qualcomm
Affected products: msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_425, sd_425_firmware, sd_427, sd_427_firmware, sd_430, sd_430_firmware, sd_435, sd_435_firmware, sd_450, sd_450_firmware, sd_625
CVE-2015-9218 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, when processing bad HEVC clips, the DPB fills, and with no error handling for DPB being full, a hang occurs.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-388
Affected vendors: qualcomm
Affected products: msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_425, sd_425_firmware, sd_427, sd_427_firmware, sd_430, sd_430_firmware, sd_435, sd_435_firmware, sd_450, sd_450_firmware, sd_625
CVE-2015-9219 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, an integer overflow to buffer overflow can occur in a DRM API.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: qualcomm
Affected products: sd_400, sd_400_firmware, sd_800, sd_800_firmware
CVE-2015-9220 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9558, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 625, SD 810, SD 820, and SDX20, integer overflow occurs when the size of the firmware section is incorrectly encoded in the firmware image.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: qualcomm
Affected products: ipq4019, ipq4019_firmware, ipq8064, ipq8064_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, qca4531, qca4531_firmware, qca6174a, qca6174a_firmware, qca6574au, qca6574au_firmware, qca6584, qca6584_firmware, qca6584au, qca6584au_firmware, qca9377, qca9377_firmware, qca9378
CVE-2015-9221 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400, SD 800, and SD 810, lack of validation of pointers passed by secure apps could lead to an untrusted pointer dereference.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: sd_400, sd_400_firmware, sd_800, sd_800_firmware, sd_810, sd_810_firmware
CVE-2015-9222 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, processing erroneous bitstreams may result in a HW freeze. FW should detect the HW freeze based on watchdog timer, but because the watchdog timer is not enabled, an infinite loop occurs, resulting in a device freeze.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-399
Affected vendors: qualcomm
Affected products: msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_400, sd_400_firmware, sd_410, sd_410_firmware, sd_412, sd_412_firmware, sd_425, sd_425_firmware, sd_427, sd_427_firmware, sd_430, sd_430_firmware, sd_435, sd_435_firmware, sd_450, sd_450_firmware, sd_625
CVE-2015-9223 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, SD 400, SD 600, and SD 800, a buffer overflow can occur when processing an audio buffer.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9615, mdm9615_firmware, mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, sd_400, sd_400_firmware, sd_600, sd_600_firmware, sd_800, sd_800_firmware
CVE-2015-9224 (published 2018-04-18)
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, lack of input Validation in QURTK_write() can cause potential buffer overflow.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: fsm9055, fsm9055_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9615, mdm9615_firmware, mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, mdm9640, mdm9640_firmware, mdm9645, mdm9645_firmware, mdm9650, mdm9650_firmware, mdm9655, mdm9655_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210
CVE-2015-9226 (published 2017-09-11)
Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download parameter in the (1) check_download and possibly (2) check_filename function in upload/admin2/model/products/model_admin_download.php or remote authenticated users with a valid Paypal transaction token to execute arbitrary SQL commands via the ref parameter in the (3) orderUpdate function in upload/catalog/extension/payment/paypal.php.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: alegrocart
Affected products: alegrocart
CVE-2015-9227 (published 2017-09-11)
PHP remote file inclusion vulnerability in the get_file function in upload/admin2/controller/report_logs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the file_path parameter to upload/admin2.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: alegrocart
Affected products: alegrocart
CVE-2015-9228 (published 2017-09-12)
In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: imagely
Affected products: nextgen_gallery
CVE-2015-9229 (published 2017-09-12)
In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images[1][alttext] parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: imagely
Affected products: nextgen_gallery
CVE-2015-9230 (published 2017-09-12)
In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticated administrators via the DBTablePrefix parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ait-pro
Affected products: bulletproof_security
CVE-2015-9231 (published 2017-09-20)
iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 version 3.0.0 (and unreleased 2.9.x versions such as 2.9.20150717) that resulted in a potential information disclosure. In an attempt to see whether the text under the cursor (or selected text) was a URL, the text would be sent as an unencrypted DNS query. This has the potential to result in passwords and other sensitive information being sent in cleartext without the user being aware.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: iterm2
Affected products: iterm2
CVE-2015-9232 (published 2017-09-20)
The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a com.good.gdgma substring. Consequently, an attacker could obtain access to intranet data. This issue is only relevant in cases where the user has already downloaded a malicious Android application.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-345
Affected vendors: good
Affected products: good_for_enterprise
CVE-2015-9233 (published 2017-09-30)
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: codepeople
Affected products: cp_contact_form_with_paypal
CVE-2015-9234 (published 2017-09-30)
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: cfpaypal
Affected products: cp_contact_form_with_paypal
CVE-2015-9235 (published 2018-05-29)
In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: auth0
Affected products: jsonwebtoken
CVE-2015-9236 (published 2018-05-31)
Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-284
Affected vendors: hapijs
Affected products: hapi
CVE-2015-9238 (published 2018-05-31)
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-697
Affected vendors: secure-compare_project
Affected products: secure-compare
CVE-2015-9239 (published 2018-05-31)
ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: ansi2html_project
Affected products: ansi2html
CVE-2015-9240 (published 2018-05-29)
Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-255
Affected vendors: keystonejs
Affected products: keystone
CVE-2015-9241 (published 2018-05-29)
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: hapijs
Affected products: hapi
CVE-2015-9242 (published 2018-05-29)
Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: ecstatic_project
Affected products: ecstatic
CVE-2015-9243 (published 2018-05-29)
When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-284
Affected vendors: hapijs
Affected products: hapi
CVE-2015-9244 (published 2018-05-29)
Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: mysqljs
Affected products: mysql
CVE-2015-9245 (published 2017-10-31)
Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via port 20931.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: progress
Affected products: openedge
CVE-2015-9246 (published 2018-01-12)
An issue was discovered in Skybox Platform before 7.5.201. Remote Unauthenticated Code Execution exists via a WAR archive containing a JSP file. The WAR file is sent to /skyboxview-softwareupdate/services/CollectorSoftwareUpdate and the JSP file is reached at /opt/skyboxview/thirdparty/jboss/server/web/work/jboss.web/localhost.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: skyboxsecurity
Affected products: skybox_platform