alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2021-35075 (published 2022-02-11)
Possible null pointer dereference due to lack of WDOG structure validation during registration in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6174a, qca6174a_firmware, qca6391, qca6391_firmware, qca6574, qca6574_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, qca9377, qca9377_firmware, qcm6490, qcm6490_firmware, qcs6490
CVE-2021-35076 (published 2022-06-14)
Possible null pointer dereference due to improper validation of RRC connection reconfiguration message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6421, qca6421_firmware, qca6426, qca6426_firmware, qca6431, qca6431_firmware, qca6436, qca6436_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca8081, qca8081_firmware, qca8337
CVE-2021-35077 (published 2022-02-11)
Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6174a, qca6174a_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6574, qca6574_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, qca9377, qca9377_firmware, qcm2290
CVE-2021-35078 (published 2022-06-14)
Possible memory leak due to improper validation of certificate chain length while parsing server certificate chain in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-401
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, csrb31024, csrb31024_firmware, qca6174a, qca6174a_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6421, qca6421_firmware, qca6426, qca6426_firmware, qca6430, qca6430_firmware, qca6431, qca6431_firmware, qca6436, qca6436_firmware, qca6564au
CVE-2021-35079 (published 2022-06-14)
Improper validation of permissions for third party application accessing Telephony service API can lead to information disclosure in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-281
Affected vendors: qualcomm
Affected products: apq8053, apq8053_firmware, aqt1000, aqt1000_firmware, msm8953, msm8953_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6426, qca6426_firmware, qca6430, qca6430_firmware, qca6436, qca6436_firmware, qcm4290, qcm4290_firmware, qcs4290, qcs4290_firmware, qcs603, qcs603_firmware, qcs605
CVE-2021-3508 (published 2021-04-28)
A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via a crafted PDF file.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: pdfresurrect_project
Affected products: pdfresurrect
CVE-2021-35080 (published 2022-06-14)
Disabled SMMU from secure side while RPM is assigned a secure stream can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: qualcomm
Affected products: qcm2290, qcm2290_firmware, qcm4290, qcm4290_firmware, qcs2290, qcs2290_firmware, qcs4290, qcs4290_firmware, sd460, sd460_firmware, sd480, sd480_firmware, sd662, sd662_firmware, sd680, sd680_firmware, sd695, sd695_firmware, sm4125, sm4125_firmware, sw5100, sw5100_firmware, sw5100p, sw5100p_firmware, wcd9370
CVE-2021-35081 (published 2022-06-14)
Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6564, qca6564_firmware, qca6564au, qca6564au_firmware, qca6574a, qca6574a_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, qcm2290, qcm2290_firmware, qcm4290, qcm4290_firmware, qcm6125, qcm6125_firmware, qcm6490
CVE-2021-35082 (published 2022-06-14)
Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has been received in Snapdragon Industrial IOT
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, qca9367, qca9367_firmware, qca9377, qca9377_firmware
CVE-2021-35083 (published 2022-06-14)
Possible out of bound read due to improper validation of certificate chain in SSL or Internet key exchange in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8037, apq8037_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, mdm9150
CVE-2021-35084 (published 2022-06-14)
Possible out of bound read due to lack of length check of data length for a DIAG event in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, qca6174a, qca6174a_firmware, qca6175a, qca6175a_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6426, qca6426_firmware, qca6430
CVE-2021-35085 (published 2022-06-14)
Possible buffer overflow due to lack of buffer length check during management frame Rx handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, csrb31024, csrb31024_firmware, qca6175a, qca6175a_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6426, qca6426_firmware, qca6430, qca6430_firmware, qca6436, qca6436_firmware, qca6564au, qca6564au_firmware, qca6574, qca6574_firmware, qca6574a
CVE-2021-35086 (published 2022-06-14)
Possible buffer over read due to improper validation of SIB type when processing a NR system Information message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6421, qca6421_firmware, qca6426, qca6426_firmware, qca6431, qca6431_firmware, qca6436, qca6436_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca8081, qca8081_firmware, qca8337
CVE-2021-35087 (published 2022-06-14)
Possible null pointer access due to improper validation of system information message to be processed in Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, qcm6490, qcm6490_firmware, qcs6490, qcs6490_firmware, sd480, sd480_firmware, sd690_5g, sd690_5g_firmware, sd695, sd695_firmware, sd765, sd765_firmware, sd765g, sd765g_firmware, sd768g
CVE-2021-35088 (published 2022-04-01)
Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, ar9380, ar9380_firmware, csr8811, csr8811_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, ipq4018, ipq4018_firmware, ipq4019, ipq4019_firmware, ipq4028, ipq4028_firmware, ipq4029, ipq4029_firmware, ipq5010, ipq5010_firmware, ipq5018
CVE-2021-35089 (published 2022-04-01)
Possible buffer overflow due to lack of input IB amount validation while processing the user command in Snapdragon Auto
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: qca6574au, qca6574au_firmware, qca6696, qca6696_firmware, sa8155p, sa8155p_firmware
CVE-2021-3509 (published 2021-05-27)
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: redhat
Affected products: ceph_storage
CVE-2021-35090 (published 2022-06-14)
Possible hypervisor memory corruption due to TOC TOU race condition when updating address mappings in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6421, qca6421_firmware, qca6426, qca6426_firmware, qca6430, qca6430_firmware, qca6431, qca6431_firmware, qca6436, qca6436_firmware, qcm6490, qcm6490_firmware, qcs6490, qcs6490_firmware, qrb5165, qrb5165_firmware, qrb5165m
CVE-2021-35091 (published 2022-06-14)
Possible out of bounds read due to improper typecasting while handling page fault for global memory in Snapdragon Connectivity, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-704
Affected vendors: qualcomm
Affected products: sd_8_gen1_5g_firmware, sm8475, wcd9380, wcd9380_firmware, wcn6855, wcn6855_firmware, wcn6856, wcn6856_firmware, wsa8830, wsa8830_firmware, wsa8835, wsa8835_firmware
CVE-2021-35092 (published 2022-06-14)
Processing DCB/AVB algorithm with an invalid queue index from IOCTL request could lead to arbitrary address modification in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, mdm9150, mdm9150_firmware, mdm9650, mdm9650_firmware, msm8953, msm8953_firmware, qca6174a, qca6174a_firmware, qca6390, qca6390_firmware, qca6391
CVE-2021-35093 (published 2022-01-03)
Possible memory corruption in BT controller when it receives an oversized LMP packet over 2-DH1 link and leads to denial of service in BlueCore
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: csr8510_a10, csr8510_a10_firmware, csr8811_a12, csr8811_a12_firmware
CVE-2021-35094 (published 2022-06-14)
Improper verification of timeout-based authentication in identity credential can lead to invalid authorization in HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6421, qca6421_firmware, qca6426, qca6426_firmware, qca6430, qca6430_firmware, qca6431, qca6431_firmware, qca6436, qca6436_firmware, qca6574, qca6574_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au
CVE-2021-35095 (published 2022-06-14)
Improper serialization of message queue client registration can lead to race condition allowing multiple gunyah message clients to register with same label in Snapdragon Connectivity, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, sd_8_gen1_5g_firmware, sdx65, sdx65_firmware, sm8475, wcd9380, wcd9380_firmware, wcn6855, wcn6855_firmware, wcn6856, wcn6856_firmware, wsa8830, wsa8830_firmware, wsa8835, wsa8835_firmware
CVE-2021-35096 (published 2022-06-14)
Improper memory allocation during counter check DLM handling can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6421, qca6421_firmware, qca6426, qca6426_firmware, qca6431, qca6431_firmware, qca6436, qca6436_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca8081, qca8081_firmware, qca8337
CVE-2021-35097 (published 2022-09-02)
Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-347
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, mdm9150, mdm9150_firmware, qca6174a, qca6174a_firmware, qca6175a, qca6175a_firmware, qca6310, qca6310_firmware, qca6335, qca6335_firmware, qca6390, qca6390_firmware, qca6391
CVE-2021-35098 (published 2022-06-14)
Improper validation of session id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, mdm9150, mdm9150_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8953, msm8953_firmware, qca6174a, qca6174a_firmware, qca6390, qca6390_firmware, qca6391
CVE-2021-3510 (published 2021-10-05)
Zephyr JSON decoder incorrectly decodes array of array. Zephyr versions >= >1.14.0, >= >2.5.0 contain Attempt to Access Child of a Non-structure Pointer (CWE-588). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-289f-7mw3-2qf4
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-588
Affected vendors: zephyrproject
Affected products: zephyr
CVE-2021-35100 (published 2022-06-14)
Possible buffer over read due to improper calculation of string length while parsing Id3 tag in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8064au, apq8064au_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, mdm9206, mdm9206_firmware, mdm9250, mdm9250_firmware, mdm9607
CVE-2021-35101 (published 2022-06-14)
Improper handling of writes to virtual GICR control can lead to assertion failure in the hypervisor in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6421, qca6421_firmware, qca6426, qca6426_firmware, qca6430, qca6430_firmware, qca6431, qca6431_firmware, qca6436, qca6436_firmware, sa8540p, sa8540p_firmware, sa9000p, sa9000p_firmware, sd865_5g, sd865_5g_firmware, sd870
CVE-2021-35102 (published 2022-06-14)
Possible buffer overflow due to lack of validation for the length of NAI string read from EFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6421, qca6421_firmware, qca6426, qca6426_firmware, qca6431, qca6431_firmware, qca6436, qca6436_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca8081, qca8081_firmware, qca8337
CVE-2021-35103 (published 2022-04-01)
Possible out of bound write due to improper validation of number of timer values received from firmware while syncing timers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, ar9380, ar9380_firmware, csr8811, csr8811_firmware, csrb31024, csrb31024_firmware, ipq4018, ipq4018_firmware, ipq4019, ipq4019_firmware, ipq4028, ipq4028_firmware, ipq4029, ipq4029_firmware, ipq5010, ipq5010_firmware, ipq5018, ipq5018_firmware, ipq5028, ipq5028_firmware, ipq6010, ipq6010_firmware, ipq6018
CVE-2021-35104 (published 2022-06-14)
Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8064au, apq8064au_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056
CVE-2021-35105 (published 2022-04-01)
Possible out of bounds access due to improper input validation during graphics profiling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-704
Affected vendors: qualcomm
Affected products: apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, mdm9150
CVE-2021-35106 (published 2022-04-01)
Possible out of bound read due to improper length calculation of WMI message. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, qca6175a, qca6175a_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6426, qca6426_firmware, qca6436
CVE-2021-35108 (published 2022-09-02)
Improper checking of AP-S lock bit while verifying the secure resource group permissions can lead to non secure read and write access in Snapdragon Connectivity, Snapdragon Mobile
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-754
Affected vendors: qualcomm
Affected products: sd_8_gen1_5g_firmware, sm7450, sm7450_firmware, sm8475, sm8475_firmware, sm8475p, sm8475p_firmware, wcd9370, wcd9370_firmware, wcd9375, wcd9375_firmware, wcd9380, wcd9380_firmware, wcd9385, wcd9385_firmware, wcn6750, wcn6750_firmware, wcn6855, wcn6855_firmware, wcn6856, wcn6856_firmware, wcn7851, wcn7851_firmware, wsa8830, wsa8830_firmware
CVE-2021-35109 (published 2022-09-02)
Possible address manipulation from APP-NS while APP-S is configuring an RG where it tries to merge the address ranges in Snapdragon Connectivity, Snapdragon Mobile
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: sd_8_gen1_5g_firmware, sm7450, sm7450_firmware, sm8475, sm8475_firmware, sm8475p, sm8475p_firmware, wcd9370, wcd9370_firmware, wcd9375, wcd9375_firmware, wcd9380, wcd9380_firmware, wcd9385, wcd9385_firmware, wcn6750, wcn6750_firmware, wcn6855, wcn6855_firmware, wcn6856, wcn6856_firmware, wcn7851, wcn7851_firmware, wsa8830, wsa8830_firmware
CVE-2021-3511 (published 2021-04-28)
Disclosure of sensitive information to an unauthorized user vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 and prior, HW-450HP-ZWE firmware Ver.1.99 and prior, WHR-300HP firmware Ver.1.99 and prior, WHR-300 firmware Ver.1.99 and prior, WHR-G301N firmware Ver.1.86 and prior, WHR-HP-G300N firmware Ver.1.99 and prior, WHR-HP-GN firmware Ver.1.86 and prior, WPL-05G300 firmware Ver.1.87 and prior, WZR-450HP-CWT firmware Ver.1.99 and prior, WZR-450HP-UB firmware Ver.1.99 and prior, WZR-HP-AG300H firmware Ver.1.75 and prior, WZR-HP-G300NH firmware Ver.1.83 and prior, WZR-HP-G301NH firmware Ver.1.83 and prior, WZR-HP-G302H firmware Ver.1.85 and prior, WZR-HP-G450H firmware Ver.1.89 and prior, WZR-300HP firmware Ver.1.99 and prior, WZR-450HP firmware Ver.1.99 and prior, WZR-600DHP firmware Ver.1.99 and prior, WZR-D1100H firmware Ver.1.99 and prior, FS-HP-G300N firmware Ver.3.32 and prior, FS-600DHP firmware Ver.3.38 and prior, FS-R600DHP firmware Ver.3.39 and prior, and FS-G300N firmware Ver.3.13 and prior) allows remote unauthenticated attackers to obtain information such as configuration via unspecified vectors.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected vendors: buffalo
Affected products: bhr-4grv, bhr-4grv_firmware, dwr-hp-g300nh, dwr-hp-g300nh_firmware, fs-600dhp, fs-600dhp_firmware, fs-g300n, fs-g300n_firmware, fs-hp-g300n, fs-hp-g300n_firmware, fs-r600dhp, fs-r600dhp_firmware, hw-450hp-zwe, hw-450hp-zwe_firmware, whr-300, whr-300_firmware, whr-300hp, whr-300hp_firmware, whr-g301n, whr-g301n_firmware, whr-hp-g300n, whr-hp-g300n_firmware, whr-hp-gn, whr-hp-gn_firmware, wpl-05g300
CVE-2021-35110 (published 2022-04-01)
Possible buffer overflow to improper validation of hash segment of file while allocating memory in Snapdragon Connectivity, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-704
Affected vendors: qualcomm
Affected products: sd_8_gen1_5g_firmware, sm8475, wcd9380, wcd9380_firmware, wcn6855, wcn6855_firmware, wcn6856, wcn6856_firmware, wsa8830, wsa8830_firmware, wsa8835, wsa8835_firmware
CVE-2021-35111 (published 2022-06-14)
Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon Mobile
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, sd765, sd765_firmware, sd765g, sd765g_firmware, sd768g, sd768g_firmware, sd778g, sd778g_firmware, sd865_5g, sd865_5g_firmware, sd870, sd870_firmware, sd888_5g, sd888_5g_firmware, sd_8_gen1_5g_firmware
CVE-2021-35112 (published 2022-06-14)
A user with user level permission can access graphics protected region due to improper access control in register configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-863
Affected vendors: qualcomm
Affected products: apq8009w, apq8009w_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, mdm9150, mdm9150_firmware, msm8909w, msm8909w_firmware, qam8295p, qam8295p_firmware, qca6174a, qca6174a_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6426
CVE-2021-35113 (published 2022-09-02)
Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-347
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, csrb31024, csrb31024_firmware, qca6174a, qca6174a_firmware, qca6310, qca6310_firmware, qca6335, qca6335_firmware, qca6420, qca6420_firmware, qca6430, qca6430_firmware, qca6564au, qca6564au_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca9377, qca9377_firmware, qcs410
CVE-2021-35114 (published 2022-06-14)
Improper buffer initialization on the backend driver can lead to buffer overflow in Snapdragon Auto
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: sa8540p, sa8540p_firmware, sa9000p, sa9000p_firmware
CVE-2021-35115 (published 2022-04-01)
Improper handling of multiple session supported by PVM backend can lead to use after free in Snapdragon Auto, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: apq8096au, apq8096au_firmware, ar6003, ar6003_firmware, mdm8215, mdm8215_firmware, mdm8215m, mdm8215m_firmware, mdm8615m, mdm8615m_firmware, mdm9215, mdm9215_firmware, mdm9310, mdm9310_firmware, mdm9615, mdm9615_firmware, mdm9615m, mdm9615m_firmware, msm8996au, msm8996au_firmware, qca6564a, qca6564a_firmware, qca6564au, qca6564au_firmware, qca6574a
CVE-2021-35116 (published 2022-06-14)
APK can load a crafted model into the CDSP which can lead to a compromise of CDSP and other APK`s data executing there in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8009w, apq8009w_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, csrb31024, csrb31024_firmware, mdm9607, mdm9607_firmware, mdm9626, mdm9626_firmware, mdm9628, mdm9628_firmware, mdm9640, mdm9640_firmware, msm8909w, msm8909w_firmware, msm8937, msm8937_firmware, msm8996au, msm8996au_firmware, pm8937
CVE-2021-35117 (published 2022-04-01)
An Out of Bounds read may potentially occur while processing an IBSS beacon, in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, msm8996au, msm8996au_firmware, qca6175a, qca6175a_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6426, qca6426_firmware, qca6436
CVE-2021-35118 (published 2022-06-14)
An out-of-bounds write can occur due to an incorrect input check in the camera driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: apq8053, apq8053_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, mdm9150, mdm9150_firmware, msm8953, msm8953_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6426, qca6426_firmware, qca6430
CVE-2021-35119 (published 2022-06-14)
Potential out of Bounds read in FIPS event processing due to improper validation of the length from the firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, csrb31024, csrb31024_firmware, qca6175a, qca6175a_firmware, qca6310, qca6310_firmware, qca6320, qca6320_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6426, qca6426_firmware, qca6430, qca6430_firmware, qca6436, qca6436_firmware, qca6564au
CVE-2021-3512 (published 2021-04-28)
Improper access control vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 and prior, HW-450HP-ZWE firmware Ver.1.99 and prior, WHR-300HP firmware Ver.1.99 and prior, WHR-300 firmware Ver.1.99 and prior, WHR-G301N firmware Ver.1.86 and prior, WHR-HP-G300N firmware Ver.1.99 and prior, WHR-HP-GN firmware Ver.1.86 and prior, WPL-05G300 firmware Ver.1.87 and prior, WZR-450HP-CWT firmware Ver.1.99 and prior, WZR-450HP-UB firmware Ver.1.99 and prior, WZR-HP-AG300H firmware Ver.1.75 and prior, WZR-HP-G300NH firmware Ver.1.83 and prior, WZR-HP-G301NH firmware Ver.1.83 and prior, WZR-HP-G302H firmware Ver.1.85 and prior, WZR-HP-G450H firmware Ver.1.89 and prior, WZR-300HP firmware Ver.1.99 and prior, WZR-450HP firmware Ver.1.99 and prior, WZR-600DHP firmware Ver.1.99 and prior, WZR-D1100H firmware Ver.1.99 and prior, FS-HP-G300N firmware Ver.3.32 and prior, FS-600DHP firmware Ver.3.38 and prior, FS-R600DHP firmware Ver.3.39 and prior, and FS-G300N firmware Ver.3.13 and prior) allows remote unauthenticated attackers to bypass access restriction and to start telnet service and execute arbitrary OS commands with root privileges via unspecified vectors.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: buffalo
Affected products: bhr-4grv, bhr-4grv_firmware, dwr-hp-g300nh, dwr-hp-g300nh_firmware, fs-600dhp, fs-600dhp_firmware, fs-g300n, fs-g300n_firmware, fs-hp-g300n, fs-hp-g300n_firmware, fs-r600dhp, fs-r600dhp_firmware, hw-450hp-zwe, hw-450hp-zwe_firmware, whr-300, whr-300_firmware, whr-300hp, whr-300hp_firmware, whr-g301n, whr-g301n_firmware, whr-hp-g300n, whr-hp-g300n_firmware, whr-hp-gn, whr-hp-gn_firmware, wpl-05g300
CVE-2021-35120 (published 2022-06-14)
Improper handling between export and release functions on the same handle from client can lead to use after free in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: apq8053, apq8053_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, mdm9150, mdm9150_firmware, msm8953, msm8953_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6426, qca6426_firmware, qca6430
CVE-2021-35121 (published 2022-06-14)
An array index is improperly used to lock and unlock a mutex which can lead to a Use After Free condition In the Synx driver in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: qualcomm
Affected products: apq8053, apq8053_firmware, msm8953, msm8953_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6426, qca6426_firmware, qca6436, qca6436_firmware, qcm2290, qcm2290_firmware, qcm4290, qcm4290_firmware, qcs2290, qcs2290_firmware, qcs4290, qcs4290_firmware, qrb5165, qrb5165_firmware, qrb5165m, qrb5165m_firmware, qrb5165n
CVE-2021-35122 (published 2022-09-02)
Non-secure region can try modifying RG permissions of IO space xPUs due to improper input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6421, qca6421_firmware, qca6426, qca6426_firmware, qca6430, qca6430_firmware, qca6431, qca6431_firmware, qca6436, qca6436_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au
CVE-2021-35123 (published 2022-06-14)
Buffer copy in GATT multi notification due to improper length check for the data coming over-the-air in Snapdragon Connectivity, Snapdragon Industrial IOT
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, sd480, sd480_firmware, sd660, sd660_firmware, sd778g, sd778g_firmware, sd780g, sd780g_firmware, sd855, sd855_firmware, sd865_5g, sd865_5g_firmware, sd870, sd870_firmware, sd888_5g, sd888_5g_firmware, sd_8_gen1_5g_firmware, sdx55m, sdx55m_firmware
CVE-2021-35126 (published 2022-06-14)
Memory corruption in DSP service due to improper validation of input parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: qualcomm
Affected products: qam8295p, qam8295p_firmware, qca6391, qca6391_firmware, qca6696, qca6696_firmware, qcm6490, qcm6490_firmware, qcs6490, qcs6490_firmware, sa8295p, sa8295p_firmware, sd778g, sd778g_firmware, sd780g, sd780g_firmware, sd888, sd888_5g, sd888_5g_firmware, sd888_firmware, sd_8_gen1_5g_firmware, sd_8cx_gen3, sd_8cx_gen3_firmware, sm7315, sm7315_firmware
CVE-2021-35129 (published 2022-06-14)
Memory corruption in BT controller due to improper length check while processing vendor specific commands in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, ipq5010, ipq5010_firmware, ipq5018, ipq5018_firmware, ipq5028, ipq5028_firmware, qca2062, qca2062_firmware, qca2064, qca2064_firmware, qca2065, qca2065_firmware, qca2066, qca2066_firmware, qca6391, qca6391_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, qcc710, qcc710_firmware, qcm6490
CVE-2021-3513 (published 2022-08-22)
A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-522
Affected vendors: redhat
Affected products: keycloak
CVE-2021-35130 (published 2022-06-14)
Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qam8295p, qam8295p_firmware, qca6174a, qca6174a_firmware, qca6391, qca6391_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, qca9377, qca9377_firmware, qcm6490, qcm6490_firmware, qcs410, qcs410_firmware, qcs610
CVE-2021-35132 (published 2022-09-02)
Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1284
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6421, qca6421_firmware, qca6426, qca6426_firmware, qca6430, qca6430_firmware, qca6431, qca6431_firmware, qca6436, qca6436_firmware, qca6574, qca6574_firmware, qca6574a, qca6574a_firmware, qca6574au
CVE-2021-35133 (published 2022-09-02)
Use after free in the synx driver issue while performing other functions during multiple invocation of synx release calls in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6174a, qca6174a_firmware, qca6391, qca6391_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, qca9377, qca9377_firmware, qcm6490, qcm6490_firmware, qcs6490, qcs6490_firmware, sd480, sd480_firmware, sd780g, sd780g_firmware, sd888_5g, sd888_5g_firmware, sd_8_gen1_5g_firmware, sdx12, sdx12_firmware
CVE-2021-35134 (published 2022-09-02)
Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-131
Affected vendors: qualcomm
Affected products: qca6391, qca6391_firmware, qcm6490, qcm6490_firmware, qcs6490, qcs6490_firmware, qsm8350, qsm8350_firmware, sd778g, sd778g_firmware, sd780g, sd780g_firmware, sd888, sd888_5g, sd888_5g_firmware, sd888_firmware, sd_8_gen1_5g_firmware, sm7315, sm7315_firmware, sm7325p, sm7325p_firmware, sm7450, sm7450_firmware, sm8475, sm8475_firmware
CVE-2021-35135 (published 2022-09-02)
A null pointer dereference may potentially occur during RSA key import in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: apq8017, apq8017_firmware, apq8037, apq8037_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, mdm9150, mdm9150_firmware, mdm9640, mdm9640_firmware, mdm9650
CVE-2021-3514 (published 2021-05-28)
When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: redhat
Affected products: 389_directory_server
CVE-2021-3515 (published 2021-06-01)
A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. An attacker with CREATEDB privileges on a PostgreSQL server can craft a database name that allows execution of shell commands as the postgresql user when calling pglogical.create_subscription().
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: 2ndquadrant
Affected products: pglogical
CVE-2021-3516 (published 2021-06-01)
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, netapp, oracle, redhat, xmlsoft
Affected products: clustered_data_ontap, clustered_data_ontap_antivirus_connector, debian_linux, enterprise_linux, fedora, jboss_core_services, ontap_select_deploy_administration_utility, xmllint, zfs_storage_appliance_kit
CVE-2021-3517 (published 2021-05-19)
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, netapp, oracle, redhat, xmlsoft
Affected products: active_iq_unified_manager, clustered_data_ontap, clustered_data_ontap_antivirus_connector, communications_cloud_native_core_network_function_cloud_native_environment, debian_linux, e-series_santricity_os_controller, e-series_santricity_storage_manager, e-series_santricity_web_services, enterprise_linux, enterprise_manager_base_platform, fedora, hci_h410c, hci_h410c_firmware, hci_management_node, jboss_core_services, libxml2, manageability_software_development_kit, mysql_workbench, oncommand_insight, oncommand_workflow_automation, ontap_select_deploy_administration_utility, openjdk, peoplesoft_enterprise_peopletools, real_user_experience_insight, santricity_unified_manager
CVE-2021-3518 (published 2021-05-18)
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, netapp, oracle, redhat, xmlsoft
Affected products: active_iq_unified_manager, clustered_data_ontap, clustered_data_ontap_antivirus_connector, communications_cloud_native_core_network_function_cloud_native_environment, debian_linux, enterprise_linux, enterprise_manager_base_platform, enterprise_manager_ops_center, fedora, hci_h410c, hci_h410c_firmware, jboss_core_services, libxml2, manageability_software_development_kit, mysql_workbench, ontap_select_deploy_administration_utility, peoplesoft_enterprise_peopletools, real_user_experience_insight, snapdrive
CVE-2021-3519 (published 2021-11-12)
A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: lenovo, microsoft
Affected products: ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_310s-08igm, ideacentre_310s-08igm_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_510a-15arr, ideacentre_510a-15arr_firmware, ideacentre_510s-07icb, ideacentre_510s-07icb_firmware, ideacentre_510s-07ick, ideacentre_510s-07ick_firmware, ideacentre_c5-14mb05, ideacentre_c5-14mb05_firmware, ideacentre_creator_5-14iob6, ideacentre_creator_5-14iob6_firmware, ideacentre_g5-14imb05, ideacentre_g5-14imb05_firmware, ideacentre_gaming_5-14iob6, ideacentre_gaming_5-14iob6_firmware, thinkcentre_e75_t\/s, thinkcentre_e75_t\/s_firmware, thinkcentre_m60e_tiny