alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2019-2303 (published 2019-11-21)
SNDCP module may access array out side its boundary when it receives malformed XID message. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8976, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, Snapdragon_High_Med_2016, SXR1130, SXR2130
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, apq8098, apq8098_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9615, mdm9615_firmware, mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, mdm9640
CVE-2019-2304 (published 2019-12-18)
Integer overflow to buffer overflow due to lack of validation of event arguments received from firmware. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9607, MSM8917, MSM8920, MSM8937, MSM8940, QCN7605, QCS405, QCS605, SDA845, SDM660, SDM845, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: ipq4019, ipq4019_firmware, ipq8064, ipq8064_firmware, ipq8074, ipq8074_firmware, mdm9607, mdm9607_firmware, msm8917, msm8917_firmware, msm8920, msm8920_firmware, msm8937, msm8937_firmware, msm8940, msm8940_firmware, qcn7605, qcn7605_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, sda845, sda845_firmware, sdm660
CVE-2019-2305 (published 2019-07-25)
Out of bound access when reason code is extracted from frame data without validating the frame length in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8996au, msm8996au_firmware, qca6174a, qca6174a_firmware, qca6574au, qca6574au_firmware, qca9377, qca9377_firmware, qca9379, qca9379_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, sd_425
CVE-2019-2306 (published 2019-07-25)
Improper casting of structure while handling the buffer leads to out of bound read in display in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_415
CVE-2019-2307 (published 2019-07-25)
Possible integer underflow due to lack of validation before calculation of data length in 802.11 Rx management configuration in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660, SDX20, SDX24
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8996au, msm8996au_firmware, qca6174a, qca6174a_firmware, qca6574au, qca6574au_firmware, qca9377, qca9377_firmware, qca9379, qca9379_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, sd_205
CVE-2019-2308 (published 2019-07-25)
User application could potentially make RPC call to the fastrpc driver and the driver will allow the message to go through to the remote subsystem in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9607, mdm9607_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_425, sd_425_firmware, sd_427, sd_427_firmware, sd_429, sd_429_firmware, sd_430, sd_430_firmware, sd_435
CVE-2019-2309 (published 2019-07-25)
While storing calibrated data from firmware in cache, An integer overflow may occur since data length received may exceed real data length. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 845 / SD 850, SDM660, SDX20
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8996au, msm8996au_firmware, qca6174a, qca6174a_firmware, qca6574au, qca6574au_firmware, qca9377, qca9377_firmware, qca9379, qca9379_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212
CVE-2019-2310 (published 2019-12-12)
Out of bound read would occur while trying to read action category and action ID without validating the action length of the Rx Frame body in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS605, SDA660, SDA845, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM8150
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, apq8098, apq8098_firmware, mdm9206, mdm9206_firmware, mdm9207c, mdm9207c_firmware, mdm9607, mdm9607_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8909, msm8909_firmware, msm8917, msm8917_firmware, msm8920
CVE-2019-2311 (published 2020-03-05)
Possible buffer overflow in WLAN handler due to lack of validation of destination buffer size before copying it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8996, MSM8996AU, MSM8998, QCA6174A, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA8081, QCA9377, QCA9379, QCA9886, QCS605, SA6155P, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8096, apq8096_firmware, apq8096au, apq8096au_firmware, apq8098, apq8098_firmware, ipq8074, ipq8074_firmware, mdm9206, mdm9206_firmware, mdm9207c, mdm9207c_firmware, mdm9607, mdm9607_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8996
CVE-2019-2312 (published 2019-07-25)
When handling the vendor command there exists a potential buffer overflow due to lack of input validation of data buffer received in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, MDM9640, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660, SDX24
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9607, mdm9607_firmware, mdm9640, mdm9640_firmware, msm8996au, msm8996au_firmware, qca6174a, qca6174a_firmware, qca6574au, qca6574au_firmware, qca9377, qca9377_firmware, qca9379, qca9379_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_425
CVE-2019-2314 (published 2019-07-25)
Possible race condition that will cause a use-after-free when writing to two sysfs entries at nearly the same time in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, QCS405, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855, SDM439, SDM660, SDX20, SDX24
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: qualcomm
Affected products: msm8909w, msm8909w_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_425, sd_425_firmware, sd_429, sd_429_firmware, sd_439, sd_439_firmware, sd_450, sd_450_firmware, sd_625, sd_625_firmware, sd_632, sd_632_firmware, sd_636, sd_636_firmware, sd_665, sd_665_firmware, sd_670
CVE-2019-2315 (published 2019-11-21)
While invoking the API to copy from fd or local buffer to the secure buffer, Parameters being populated are from non secure environment. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9650, MSM8905, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, QCS404, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, Snapdragon_High_Med_2016, SXR1130, SXR2130
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8096, apq8096_firmware, apq8096au, apq8096au_firmware, apq8098, apq8098_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9650, mdm9650_firmware, msm8905, msm8905_firmware, msm8909
CVE-2019-2316 (published 2019-07-25)
When computing the digest a local variable is used after going out of scope in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9640, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855, SDM660, SDX24
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: mdm9640, mdm9640_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, sd_425, sd_425_firmware, sd_427, sd_427_firmware, sd_430, sd_430_firmware, sd_435, sd_435_firmware, sd_450, sd_450_firmware, sd_625, sd_625_firmware, sd_636, sd_636_firmware, sd_665, sd_665_firmware, sd_670, sd_670_firmware, sd_675
CVE-2019-2317 (published 2020-03-05)
The secret key used to make the Initial Sequence Number in the TCP SYN packet could be brute forced and therefore can be predicted in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8905, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, Nicobar, QCM2150, QM215, SC8180X, SDM429, SDM439, SDM450, SDM632, SDX24, SDX55, SM6150, SM7150, SM8150
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-330
Affected vendors: qualcomm
Affected products: msm8905, msm8905_firmware, msm8909, msm8909_firmware, msm8917, msm8917_firmware, msm8920, msm8920_firmware, msm8937, msm8937_firmware, msm8940, msm8940_firmware, msm8953, msm8953_firmware, nicobar, nicobar_firmware, qcm2150, qcm2150_firmware, qm215, qm215_firmware, sc8180x, sc8180x_firmware, sdm429, sdm429_firmware, sdm439
CVE-2019-2318 (published 2019-11-21)
Non Secure Kernel can cause Trustzone to do an arbitrary memory read which will result into DOS in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8017, APQ8053, APQ8096, APQ8096AU, IPQ8074, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, QCA8081, QM215, SDM429, SDM439, SDM450, SDM632, Snapdragon_High_Med_2016
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8096, apq8096_firmware, apq8096au, apq8096au_firmware, ipq8074, ipq8074_firmware, msm8917, msm8917_firmware, msm8920, msm8920_firmware, msm8937, msm8937_firmware, msm8940, msm8940_firmware, msm8953, msm8953_firmware, msm8996, msm8996_firmware, msm8996au, msm8996au_firmware, qca8081
CVE-2019-2319 (published 2019-12-12)
HLOS could corrupt CPZ page table memory for S1 managed VMs in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SXR1130, SXR2130
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: mdm9205, mdm9205_firmware, qcs404, qcs404_firmware, qcs605, qcs605_firmware, sda845, sda845_firmware, sdm670, sdm670_firmware, sdm710, sdm710_firmware, sdm845, sdm845_firmware, sdm850, sdm850_firmware, sm6150, sm6150_firmware, sm7150, sm7150_firmware, sm8150, sm8150_firmware, sxr1130, sxr1130_firmware, sxr2130
CVE-2019-2320 (published 2019-12-12)
Possible out of bounds write in a MT SMS/SS scenario due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8976, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, Snapdragon_High_Med_2016, SXR1130, SXR2130
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, apq8098, apq8098_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9615, mdm9615_firmware, mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, mdm9640
CVE-2019-2321 (published 2019-12-12)
Incorrect length used while validating the qsee log buffer sent from HLOS which could then lead to remap conflict in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, IPQ4019, IPQ8074, MDM9150, MDM9205, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, QCA8081, QCS404, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SM6150, SM7150, SM8150, Snapdragon_High_Med_2016, SXR1130, SXR2130
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8096, apq8096_firmware, apq8096au, apq8096au_firmware, apq8098, apq8098_firmware, ipq4019, ipq4019_firmware, ipq8074, ipq8074_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, mdm9206, mdm9206_firmware, mdm9207c, mdm9207c_firmware, mdm9607
CVE-2019-2322 (published 2019-07-25)
Buffer overflow can occur when playing specific clip which is non-standard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_415
CVE-2019-2323 (published 2019-11-06)
Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1187
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212
CVE-2019-2324 (published 2019-11-06)
When ADSP is compromised, the audio port index that`s returned from ADSP might be out of the valid range and leads to out of boundary access in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDX20, SDX24
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9615, mdm9615_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_427
CVE-2019-2325 (published 2019-11-06)
Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212
CVE-2019-2326 (published 2019-07-25)
Data token is received from ADSP and is used without validation as an index into the array leads to out of bound access in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212
CVE-2019-2327 (published 2019-07-25)
Possible buffer overflow can occur when playing clip with incorrect element size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9650, mdm9650_firmware, msm8909, msm8909_firmware, msm8996au, msm8996au_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_415
CVE-2019-2328 (published 2019-07-25)
Possible buffer overflow when number of channels passed is more than size of channel mapping array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212
CVE-2019-2329 (published 2019-11-21)
Use after free issue in cleanup routine due to missing pointer sanitization for a failed start of a trusted application. in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SDX55, SM6150, SM7150, SM8150, SXR1130, SXR2130
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: mdm9205, mdm9205_firmware, qcs404, qcs404_firmware, qcs605, qcs605_firmware, sda845, sda845_firmware, sdm670, sdm670_firmware, sdm710, sdm710_firmware, sdm845, sdm845_firmware, sdx55, sdx55_firmware, sm6150, sm6150_firmware, sm7150, sm7150_firmware, sm8150, sm8150_firmware, sxr1130, sxr1130_firmware, sxr2130
CVE-2019-2330 (published 2019-07-25)
improper input validation in allocation request for secure allocations can lead to page fault. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: ipq4019, ipq4019_firmware, ipq8064, ipq8064_firmware, ipq8074, ipq8074_firmware, mdm9150, mdm9150_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_425, sd_425_firmware, sd_427
CVE-2019-2331 (published 2019-11-06)
Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9615, mdm9615_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_205, sd_205_firmware, sd_210
CVE-2019-2332 (published 2019-11-06)
Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9615, mdm9615_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_205, sd_205_firmware, sd_210
CVE-2019-2333 (published 2019-09-30)
Buffer overflow due to improper validation of buffer size while IPA driver processing to perform read operation in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9607, mdm9607_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_425, sd_425_firmware, sd_427, sd_427_firmware, sd_429
CVE-2019-2334 (published 2019-07-25)
Null pointer dereferencing can happen when playing the clip with wrong block group id in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_415
CVE-2019-2335 (published 2019-11-21)
While processing Attach Reject message, Valid exit condition is not met resulting into an infinite loop in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8976, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX55, SM6150, SM7150, SM8150, SM8250, Snapdragon_High_Med_2016, SXR1130, SXR2130
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8017, apq8017_firmware, apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, apq8098, apq8098_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9615, mdm9615_firmware, mdm9625, mdm9625_firmware, mdm9635m, mdm9635m_firmware, mdm9640
CVE-2019-2336 (published 2019-11-21)
Subsequent use of the CBO listener may result in further memory corruption due to use after free issue. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, SDX55, SM6150, SM7150, SM8150, SXR2130
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: mdm9205, mdm9205_firmware, qcs404, qcs404_firmware, sdx55, sdx55_firmware, sm6150, sm6150_firmware, sm7150, sm7150_firmware, sm8150, sm8150_firmware, sxr2130, sxr2130_firmware
CVE-2019-2337 (published 2019-12-12)
While Skipping unknown IES, EMM is reading the buffer even if the no of bytes to read are more than message length which may cause device to shutdown in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8976, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, Snapdragon_High_Med_2016, SXR1130, SXR2130
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: apq8053, apq8053_firmware, apq8096au, apq8096au_firmware, apq8098, apq8098_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, mdm9206, mdm9206_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, mdm9655, mdm9655_firmware, msm8905, msm8905_firmware, msm8909, msm8909_firmware, msm8909w, msm8909w_firmware, msm8917
CVE-2019-2338 (published 2019-12-12)
Crafted image that has a valid signature from a non-QC entity can be loaded which can read/write memory that belongs to the secure world in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, MSM8998, QCS404, QCS605, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SM6150, SM7150, SM8150, SXR1130, SXR2130
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Affected vendors: qualcomm
Affected products: mdm9205, mdm9205_firmware, msm8998, msm8998_firmware, qcs404, qcs404_firmware, qcs605, qcs605_firmware, sda660, sda660_firmware, sda845, sda845_firmware, sdm630, sdm630_firmware, sdm636, sdm636_firmware, sdm660, sdm660_firmware, sdm670, sdm670_firmware, sdm710, sdm710_firmware, sdm845, sdm845_firmware, sdm850
CVE-2019-2339 (published 2019-11-21)
Out of bound access due to lack of check of whiltelist array size while reading the image elf segments. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130, SXR2130
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: qualcomm
Affected products: mdm9205, mdm9205_firmware, qcs404, qcs404_firmware, qcs605, qcs605_firmware, sda845, sda845_firmware, sdm670, sdm670_firmware, sdm710, sdm710_firmware, sdm845, sdm845_firmware, sdm850, sdm850_firmware, sdx24, sdx24_firmware, sdx55, sdx55_firmware, sm6150, sm6150_firmware, sm7150, sm7150_firmware, sm8150
CVE-2019-2341 (published 2019-09-30)
Buffer overflow when the audio buffer size provided by user is larger than the maximum allowable audio buffer size. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: mdm9150, mdm9150_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212
CVE-2019-2343 (published 2019-07-25)
Out of bound read and information disclosure in firmware due to insufficient checking of an embedded structure that can be sent from a kernel driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs605, qcs605_firmware, qualcomm_215, qualcomm_215_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_425, sd_425_firmware, sd_427, sd_427_firmware, sd_429, sd_429_firmware, sd_430, sd_430_firmware, sd_435, sd_435_firmware, sd_439
CVE-2019-2345 (published 2019-07-25)
Race condition while accessing DMA buffer in jpeg driver in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM660, SDX20, SDX24
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: qualcomm
Affected products: msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, qcs605, qcs605_firmware, sd_425, sd_425_firmware, sd_427, sd_427_firmware, sd_430, sd_430_firmware, sd_435, sd_435_firmware, sd_450, sd_450_firmware, sd_625, sd_625_firmware, sd_636, sd_636_firmware, sd_670, sd_670_firmware, sd_710, sd_710_firmware, sd_712
CVE-2019-2346 (published 2019-07-25)
Firmware is getting into loop of overwriting memory when scan command is given from host because of improper validation. in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ8074, QCA8081, QCS404, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: qualcomm
Affected products: ipq8074, ipq8074_firmware, qca8081, qca8081_firmware, qcs404, qcs404_firmware, qcs405, qcs405_firmware, qcs605, qcs605_firmware, sd_425, sd_425_firmware, sd_427, sd_427_firmware, sd_430, sd_430_firmware, sd_435, sd_435_firmware, sd_450, sd_450_firmware, sd_625, sd_625_firmware, sd_636, sd_636_firmware, sd_670
CVE-2019-2386 (published 2019-08-06)
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9; MongoDB Server v3.6 versions prior to 3.6.13 and MongoDB Server v3.4 versions prior to 3.4.22.

Workaround: 
After deleting one or more users, restart any nodes which may have had active user authorization sessions.

Refrain from creating user accounts with the same name as previously deleted accounts.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-285
Affected vendors: mongodb
Affected products: mongodb
CVE-2019-2388 (published 2020-05-13)
In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-425
Affected vendors: mongodb
Affected products: ops_manager
CVE-2019-2389 (published 2019-08-30)
Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-732
Affected vendors: mongodb
Affected products: mongodb
CVE-2019-2390 (published 2019-08-30)
An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: microsoft, mongodb
Affected products: mongodb, windows
CVE-2019-2391 (published 2020-03-31)
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-502
Affected vendors: mongodb
Affected products: js-bson
CVE-2019-2392 (published 2020-11-23)
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negative values. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9; v4.0 versions prior to 4.0.20; v3.6 versions prior to 3.6.20.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: mongodb
Affected products: mongodb
CVE-2019-2393 (published 2020-11-23)
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use $lookup and collations. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13 and MongoDB Server v3.6 versions prior to 3.6.15.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-416
Affected vendors: mongodb
Affected products: mongodb
CVE-2019-2395 (published 2019-01-16)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). The supported version that is affected is 10.3.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 5.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Affected vendors: oracle
Affected products: weblogic_server