alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2021-30233 (published 2021-04-29)
The api/ZRIptv/setIptvInfo interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iptv_vlan parameter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: chinamobile
Affected products: an_lianbao_wf-1, an_lianbao_wf-1_firmware
CVE-2021-30234 (published 2021-04-29)
The api/ZRIGMP/set_MLD_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the MLD_PROXY_WAN_CONNECT parameter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: chinamobile
Affected products: an_lianbao_wf-1, an_lianbao_wf-1_firmware
CVE-2021-3024 (published 2021-02-01)
HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected vendors: hashicorp
Affected products: vault
CVE-2021-30245 (published 2021-04-15)
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-610
Affected vendors: apache
Affected products: openoffice
CVE-2021-30246 (published 2021-04-07)
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-347
Affected vendors: kjur
Affected products: jsrsasign
CVE-2021-3025 (published 2021-01-08)
Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the GETindex() method in applications/downloads/api/files.php).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: invisioncommunity
Affected products: ips_community_suite
CVE-2021-30254 (published 2021-11-12)
Possible buffer overflow due to improper input validation in factory calibration and test DIAG command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8037, apq8037_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, csr6030, csr6030_firmware, mdm8207, mdm8207_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, mdm9206
CVE-2021-30255 (published 2021-11-12)
Possible buffer overflow due to improper input validation in PDM DIAG command in FTM in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8037, apq8037_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, csr6030, csr6030_firmware, csrb31024, csrb31024_firmware, fsm10056, fsm10056_firmware, mdm8207, mdm8207_firmware, mdm9150
CVE-2021-30256 (published 2021-10-20)
Possible stack overflow due to improper validation of camera name length before copying the name in VR Service in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: apq8017, apq8017_firmware, apq8053, apq8053_firmware, aqt1000, aqt1000_firmware, msm8917, msm8917_firmware, msm8953, msm8953_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6426, qca6426_firmware, qca6430, qca6430_firmware, qca6436, qca6436_firmware, qcm2290, qcm2290_firmware, qcm4290
CVE-2021-30257 (published 2021-10-20)
Possible out of bound read or write in VR service due to lack of validation of DSP selection values in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: apq8017, apq8017_firmware, apq8053, apq8053_firmware, aqt1000, aqt1000_firmware, msm8917, msm8917_firmware, msm8953, msm8953_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6426, qca6426_firmware, qca6430, qca6430_firmware, qca6436, qca6436_firmware, qcm2290, qcm2290_firmware, qcm4290
CVE-2021-30258 (published 2021-10-20)
Possible buffer overflow due to improper size calculation of payload received in VR service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8064au, apq8064au_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, msm8917, msm8917_firmware, msm8953, msm8953_firmware, msm8996au, msm8996au_firmware, qca6310, qca6310_firmware, qca6320, qca6320_firmware, qca6335, qca6335_firmware, qca6390, qca6390_firmware, qca6391
CVE-2021-30259 (published 2021-11-12)
Possible out of bound access due to improper validation of function table entries in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, mdm9250, mdm9250_firmware, mdm9650, mdm9650_firmware, mdm9655, mdm9655_firmware, qca4004, qca4004_firmware, qca6174a
CVE-2021-3026 (published 2021-01-05)
Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: invisioncommunity
Affected products: ips_community_suite
CVE-2021-30260 (published 2021-09-17)
Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extscan hostlist configuration command is received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8064au, apq8064au_firmware, apq8076, apq8076_firmware, apq8092, apq8092_firmware, apq8094, apq8094_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, ar9380, ar9380_firmware, csr6030
CVE-2021-30261 (published 2021-09-17)
Possible integer and heap overflow due to lack of input command size validation while handling beacon template update command from HLOS in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8037, apq8037_firmware, apq8053, apq8053_firmware, apq8084, apq8084_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar6003, ar6003_firmware, csr6030, csr6030_firmware, csrb31024, csrb31024_firmware, mdm8207, mdm8207_firmware, mdm8215
CVE-2021-30262 (published 2022-01-03)
Improper validation of a socket state when socket events are being sent to clients can lead to invalid access of memory in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: apq8009w, apq8009w_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, mdm9150, mdm9150_firmware, mdm9640, mdm9640_firmware, msm8909w, msm8909w_firmware, qca6174a
CVE-2021-30263 (published 2021-11-12)
Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concurrently in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6430, qca6430_firmware, qca8337, qca8337_firmware, qcm6125, qcm6125_firmware, qcs405, qcs405_firmware, qcs6125, qcs6125_firmware, sd855
CVE-2021-30264 (published 2021-11-12)
Possible use after free due improper validation of reference from call back to internal store table in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, ar9380, ar9380_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, ipq4018
CVE-2021-30265 (published 2021-11-12)
Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing Filter and Route statistics in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: apq8053, apq8053_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, mdm9150, mdm9150_firmware, msm8953, msm8953_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420
CVE-2021-30266 (published 2021-11-12)
Possible use after free due to improper memory validation when initializing new interface via Interface add command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, ar9380, ar9380_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, ipq4018, ipq4018_firmware, ipq4019
CVE-2021-30267 (published 2022-01-03)
Possible integer overflow to buffer overflow due to improper input validation in FTM ARA commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, mdm9150, mdm9150_firmware, mdm9250, mdm9250_firmware, mdm9650, mdm9650_firmware, qca6174a, qca6174a_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6426
CVE-2021-30268 (published 2022-01-03)
Possible heap Memory Corruption Issue due to lack of input validation when sending HWTC IQ Capture command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar6003, ar6003_firmware, ar8035, ar8035_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, mdm8207, mdm8207_firmware, mdm8215, mdm8215_firmware, mdm8215m, mdm8215m_firmware, mdm8615m
CVE-2021-30269 (published 2022-01-03)
Possible null pointer dereference due to lack of TLB validation for user provided address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, qca2066, qca2066_firmware, qca4004, qca4004_firmware, qca6174a, qca6174a_firmware, qca6390
CVE-2021-3027 (published 2021-03-26)
app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided search filter because user input gets no sanitization.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-74
Affected vendors: librit
Affected products: passhport
CVE-2021-30270 (published 2022-01-03)
Possible null pointer dereference in thread profile trap handler due to lack of thread ID validation before dereferencing it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8064au, apq8064au_firmware, apq8096au, apq8096au_firmware, ar6003, ar6003_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, ipq8070
CVE-2021-30271 (published 2022-01-03)
Possible null pointer dereference in trap handler due to lack of thread ID validation before dereferencing it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8096au, apq8096au_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, ipq5010, ipq5010_firmware, ipq5018
CVE-2021-30272 (published 2022-01-03)
Possible null pointer dereference in thread cache operation handler due to lack of validation of user provided input in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8096au, apq8096au_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, ipq5010, ipq5010_firmware, ipq5018
CVE-2021-30273 (published 2022-01-03)
Possible assertion due to improper handling of IPV6 packet with invalid length in destination options header in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: qualcomm
Affected products: apq8009w, apq8009w_firmware, apq8096au, apq8096au_firmware, ar6003, ar6003_firmware, csrb31024, csrb31024_firmware, mdm8207, mdm8207_firmware, mdm9205, mdm9205_firmware, mdm9206, mdm9206_firmware, mdm9207, mdm9207_firmware, mdm9215, mdm9215_firmware, mdm9250, mdm9250_firmware, mdm9607, mdm9607_firmware, mdm9615, mdm9615_firmware, mdm9628
CVE-2021-30274 (published 2022-01-03)
Possible integer overflow in access control initialization interface due to lack and size and address validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: qualcomm
Affected products: ar8031, ar8031_firmware, ar8035, ar8035_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, ipq6000, ipq6000_firmware, ipq6005, ipq6005_firmware, ipq6010, ipq6010_firmware, ipq6018, ipq6018_firmware, ipq6028
CVE-2021-30275 (published 2022-01-03)
Possible integer overflow in page alignment interface due to lack of address and size validation before alignment in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: qualcomm
Affected products: ar8031, ar8031_firmware, ar8035, ar8035_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, ipq6000, ipq6000_firmware, ipq6005, ipq6005_firmware, ipq6010, ipq6010_firmware, ipq6018, ipq6018_firmware, ipq6028
CVE-2021-30276 (published 2022-01-03)
Improper access control while doing XPU re-configuration dynamically can lead to unauthorized access to a secure resource in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6426, qca6426_firmware, qca6436, qca6436_firmware, qca8337, qca8337_firmware, qca9984, qca9984_firmware, qcm2290, qcm2290_firmware, qcm4290, qcm4290_firmware, qcm6490, qcm6490_firmware, qcs2290, qcs2290_firmware, qcs405, qcs405_firmware, qcs4290
CVE-2021-30278 (published 2022-01-03)
Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: ar8031, ar8031_firmware, ar8035, ar8035_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, ipq6000, ipq6000_firmware, ipq6005, ipq6005_firmware, ipq6010, ipq6010_firmware, ipq6018, ipq6018_firmware, ipq6028
CVE-2021-30279 (published 2022-01-03)
Possible access control violation while setting current permission for VMIDs due to improper permission masking in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-281
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6426, qca6426_firmware, qca6436, qca6436_firmware, qca8337, qca8337_firmware, qca9984, qca9984_firmware, qcm2290, qcm2290_firmware, qcm4290, qcm4290_firmware, qcm6490, qcm6490_firmware, qcs2290, qcs2290_firmware, qcs405, qcs405_firmware, qcs4290
CVE-2021-3028 (published 2021-01-13)
git-big-picture before 1.0.0 mishandles ' characters in a branch name, leading to code execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: git-big-picture_project
Affected products: git-big-picture
CVE-2021-30281 (published 2022-06-14)
Possible unauthorized access to secure space due to improper check of data allowed while flashing the no access control device configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, ipq6000, ipq6000_firmware, ipq6005, ipq6005_firmware, ipq6010, ipq6010_firmware, ipq6018
CVE-2021-30282 (published 2022-01-03)
Possible out of bound write in RAM partition table due to improper validation on number of partitions provided in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: qualcomm
Affected products: ar8031, ar8031_firmware, ar8035, ar8035_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, ipq6000, ipq6000_firmware, ipq6005, ipq6005_firmware, ipq6010, ipq6010_firmware, ipq6018, ipq6018_firmware, ipq6028
CVE-2021-30283 (published 2022-01-03)
Possible denial of service due to improper handling of debug register trap from user applications in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-755
Affected vendors: qualcomm
Affected products: qca6391, qca6391_firmware, qcm6490, qcm6490_firmware, qcs6490, qcs6490_firmware, qrb5165, qrb5165_firmware, qrb5165n, qrb5165n_firmware, sd778g, sd778g_firmware, sd888_5g, sd888_5g_firmware, sm7325p, sm7325p_firmware, wcd9370, wcd9370_firmware, wcd9375, wcd9375_firmware, wcd9380, wcd9380_firmware, wcd9385, wcd9385_firmware, wcn6750
CVE-2021-30284 (published 2021-11-12)
Possible information exposure and denial of service due to NAS not dropping messages when integrity check fails in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-200
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8037, apq8037_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar6003, ar6003_firmware, csr6030, csr6030_firmware, mdm8207, mdm8207_firmware, mdm8215, mdm8215_firmware, mdm8215m, mdm8215m_firmware, mdm8615m
CVE-2021-30285 (published 2022-01-13)
Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, qca4004, qca4004_firmware, qca6174a, qca6174a_firmware, qca6390, qca6390_firmware, qca6391
CVE-2021-30287 (published 2022-01-13)
Possible assertion due to improper validation of symbols configured for PDCCH monitoring in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6426, qca6426_firmware, qca6436, qca6436_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, qcx315, qcx315_firmware, sa515m
CVE-2021-30288 (published 2021-10-20)
Possible stack overflow due to improper length check of TLV while copying the TLV to a local stack variable in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, ipq5010, ipq5010_firmware, ipq5018, ipq5018_firmware, ipq5028
CVE-2021-30289 (published 2022-01-03)
Possible buffer overflow due to lack of range check while processing a DIAG command for COEX management in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, mdm8207, mdm8207_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, mdm9206, mdm9206_firmware, mdm9207, mdm9207_firmware, mdm9250
CVE-2021-3029 (published 2021-01-07)
EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter "file" on the webpage /showfile.php can be exploited to gain root access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: evolucare
Affected products: ecs_imaging
CVE-2021-30290 (published 2021-09-09)
Possible null pointer dereference due to race condition between timeline fence signal and time line fence destroy in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: qualcomm
Affected products: qca6174a, qca6174a_firmware, qca6574, qca6574_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca9377, qca9377_firmware, qcm6490, qcm6490_firmware, qcs6490, qcs6490_firmware, sa6145p, sa6145p_firmware, sa6150p, sa6150p_firmware, sa6155, sa6155_firmware, sa6155p
CVE-2021-30291 (published 2021-10-20)
Possible memory corruption due to lack of validation of client data used for memory allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8064au, apq8064au_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, msm8917, msm8917_firmware, msm8953, msm8953_firmware, msm8996au, msm8996au_firmware, qca6310, qca6310_firmware, qca6320, qca6320_firmware, qca6335, qca6335_firmware, qca6390, qca6390_firmware, qca6391
CVE-2021-30292 (published 2021-10-20)
Possible memory corruption due to lack of validation of client data used for memory allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8064au, apq8064au_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, msm8917, msm8917_firmware, msm8953, msm8953_firmware, msm8996au, msm8996au_firmware, qca6310, qca6310_firmware, qca6320, qca6320_firmware, qca6335, qca6335_firmware, qca6390, qca6390_firmware, qca6391
CVE-2021-30293 (published 2022-01-03)
Possible assertion due to lack of input validation in PUSCH configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: qualcomm
Affected products: ar6003, ar6003_firmware, ar8035, ar8035_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, mdm9215, mdm9215_firmware, mdm9607, mdm9607_firmware, mdm9615, mdm9615_firmware, mdm9628, mdm9628_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8996au, msm8996au_firmware, qca6174a, qca6174a_firmware, qca6390
CVE-2021-30294 (published 2021-09-09)
Potential null pointer dereference in KGSL GPU auxiliary command due to improper validation of user input in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: qca6174a, qca6174a_firmware, qca6574, qca6574_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca9377, qca9377_firmware, qcm6490, qcm6490_firmware, qcs6490, qcs6490_firmware, sa6145p, sa6145p_firmware, sa6150p, sa6150p_firmware, sa6155, sa6155_firmware, sa6155p
CVE-2021-30295 (published 2021-09-09)
Possible heap overflow due to improper validation of local variable while storing current task information locally in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: apq8017, apq8017_firmware, apq8053, apq8053_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, mdm9150, mdm9150_firmware, msm8917, msm8917_firmware, msm8953, msm8953_firmware, qca6174a
CVE-2021-30297 (published 2021-10-20)
Possible out of bound read due to improper validation of packet length while handling data transfer in VR service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, msm8917, msm8917_firmware, msm8953, msm8953_firmware, msm8996au, msm8996au_firmware, qca6310, qca6310_firmware, qca6320, qca6320_firmware, qca6335, qca6335_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420
CVE-2021-30298 (published 2022-01-03)
Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interface in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, ipq8072a, ipq8072a_firmware, ipq8074a, ipq8074a_firmware, ipq8076a, ipq8076a_firmware, mdm9150, mdm9150_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6574au
CVE-2021-30299 (published 2024-11-22)
Possible out of bound access in audio module due to lack of validation of user provided input.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: apq8096au, apq8096au_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, mdm9150, mdm9150_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6426, qca6426_firmware, qca6436, qca6436_firmware, qca6564, qca6564_firmware, qca6564a, qca6564a_firmware, qca6564au
CVE-2021-30300 (published 2022-01-13)
Possible denial of service due to incorrectly decoding hex data for the SIB2 OTA message and assigning a garbage value to choice when processing the SRS configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-704
Affected vendors: qualcomm
Affected products: apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8096au, apq8096au_firmware, ar8035, ar8035_firmware, csrb31024, csrb31024_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, mdm8207, mdm8207_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, mdm9206, mdm9206_firmware, mdm9207, mdm9207_firmware, mdm9607
CVE-2021-30301 (published 2022-01-13)
Possible denial of service due to out of memory while processing RRC and NAS OTA message in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6574a, qca6574a_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, qcx315, qcx315_firmware, sa515m, sa515m_firmware, sd480, sd480_firmware, sd675, sd675_firmware, sd678
CVE-2021-30302 (published 2021-10-20)
Improper authentication of EAP WAPI EAPOL frames from unauthenticated user can lead to information disclosure in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-287
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, ar9380, ar9380_firmware, csr8811, csr8811_firmware, ipq4018, ipq4018_firmware, ipq4028, ipq4028_firmware, ipq4029, ipq4029_firmware, ipq5010, ipq5010_firmware, ipq5018, ipq5018_firmware, ipq5028, ipq5028_firmware, ipq6000, ipq6000_firmware, ipq6005, ipq6005_firmware, ipq6010
CVE-2021-30303 (published 2022-01-03)
Possible buffer overflow due to lack of buffer length check when segmented WMI command is received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8017, apq8017_firmware, apq8064au, apq8064au_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar7420, ar7420_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, ar9380, ar9380_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024
CVE-2021-30304 (published 2021-10-20)
Possible buffer out of bound read can occur due to improper validation of TBTT count and length while parsing the beacon response in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: qca2062, qca2062_firmware, qca2064, qca2064_firmware, qca2065, qca2065_firmware, qca2066, qca2066_firmware, sc8280xp, sc8280xp_firmware, wcd9380, wcd9380_firmware, wcd9385, wcd9385_firmware, wcn6850, wcn6850_firmware, wcn6851, wcn6851_firmware, wcn6855, wcn6855_firmware, wcn6856, wcn6856_firmware, wsa8830, wsa8830_firmware, wsa8835
CVE-2021-30305 (published 2021-10-20)
Possible out of bound access due to lack of validation of page offset before page is inserted in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: qca6174a, qca6174a_firmware, qca6391, qca6391_firmware, qca6574, qca6574_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca9377, qca9377_firmware, qcm6490, qcm6490_firmware, qcs6490, qcs6490_firmware, sa6145p, sa6145p_firmware, sa6150p, sa6150p_firmware, sa6155
CVE-2021-30306 (published 2021-10-20)
Possible buffer over read due to improper buffer allocation for file length passed from user space in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: apq8053, apq8053_firmware, msm8953, msm8953_firmware, qca6174a, qca6174a_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6426, qca6426_firmware, qca6574, qca6574_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca9377, qca9377_firmware, qcm6490
CVE-2021-30307 (published 2022-01-13)
Possible denial of service due to improper validation of DNS response when DNS client requests with PTR, NAPTR or SRV query type in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, csrb31024, csrb31024_firmware, qca6174a, qca6174a_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6426, qca6426_firmware, qca6436, qca6436_firmware, qca6564au, qca6564au_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca8081
CVE-2021-30308 (published 2022-01-13)
Possible buffer overflow while printing the HARQ memory partition detail due to improper validation of buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, csrb31024, csrb31024_firmware, fsm10056, fsm10056_firmware, mdm9150, mdm9150_firmware, mdm9250, mdm9250_firmware, mdm9650, mdm9650_firmware, qca6174a, qca6174a_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6426, qca6426_firmware, qca6430
CVE-2021-30309 (published 2022-02-11)
Improper size validation of QXDM commands can lead to memory corruption in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: mdm9650, mdm9650_firmware, qca6174a, qca6174a_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca9377, qca9377_firmware, qcm6125, qcm6125_firmware, qcs410, qcs410_firmware, qcs603, qcs603_firmware, qcs605, qcs605_firmware, qcs610, qcs610_firmware, qcs6125, qcs6125_firmware, sd660, sd660_firmware, sd665
CVE-2021-3031 (published 2021-01-13)
Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount of random information from the firewall memory into the Ethernet packets. An attacker on the same Ethernet subnet as the PAN-OS firewall is able to collect potentially sensitive information from these packets. This issue is also known as Etherleak and is detected by security scanners as CVE-2003-0001. This issue impacts: PAN-OS 8.1 version earlier than PAN-OS 8.1.18; PAN-OS 9.0 versions earlier than PAN-OS 9.0.12; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: paloaltonetworks
Affected products: pa-200, pa-2020, pa-2050, pa-220, pa-3020, pa-3050, pa-3060, pa-3220, pa-3250, pa-3260, pa-500, pa-5200, pa-800, pan-os
CVE-2021-30310 (published 2021-10-20)
Possible buffer overflow due to Improper validation of received CF-ACK and CF-Poll data frames in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, csrb31024, csrb31024_firmware, mdm9206, mdm9206_firmware, mdm9250, mdm9250_firmware, mdm9607, mdm9607_firmware, mdm9626, mdm9626_firmware, mdm9628, mdm9628_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, mdm9655
CVE-2021-30311 (published 2022-01-13)
Possible heap overflow due to lack of index validation before allocating and writing to heap buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6426, qca6426_firmware, qca6436, qca6436_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, qcm6490, qcm6490_firmware, qcs6490
CVE-2021-30312 (published 2021-10-20)
Improper authentication of sub-frames of a multicast AMSDU frame can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-287
Affected vendors: qualcomm
Affected products: apq8053, apq8053_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, ar9380, ar9380_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, fsm10055, fsm10055_firmware, fsm10056, fsm10056_firmware, ipq4018, ipq4018_firmware, ipq4019, ipq4019_firmware, ipq4028