deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-4323
Published: 2025-05-06
Description: A vulnerability, which was classified as problematic, has been found in MRCMS 3.1.2. Affected by this issue is some unknown functionality of the component Edit Article Page. The manipulation of the argument Title leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/bdkuzma/vuln/issues/3; https://vuldb.com/?ctiid.307424; https://vuldb.com/?id.307424
CVE: CVE-2025-4337
Published: 2025-05-06
Description: The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the aha_plugin_page() function. This makes it possible for unauthenticated attackers to delete AHA pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/ahathat/trunk/includes/class-aha-admin-menu.php#L42; https://www.wordfence.com/threat-intel/vulnerabilities/id/af15ae80-dbce-4899-9604-82fdca222bf5?source=cve
CVE: CVE-2025-4324
Published: 2025-05-06
Description: A vulnerability, which was classified as problematic, was found in MRCMS 3.1.2. This affects an unknown part of the file /admin/link/edit.do of the component External Link Management Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/bdkuzma/vuln/issues/4; https://vuldb.com/?ctiid.307425; https://vuldb.com/?id.307425
CVE: CVE-2025-4325
Published: 2025-05-06
Description: A vulnerability has been found in MRCMS 3.1.2 and classified as problematic. This vulnerability affects unknown code of the file /admin/category/add.do of the component Category Management Page. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/bdkuzma/vuln/issues/6; https://vuldb.com/?ctiid.307426; https://vuldb.com/?id.307426
CVE: CVE-2025-4326
Published: 2025-05-06
Description: A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects some unknown processing of the file /admin/chip/add.do of the component Add Fragment Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/bdkuzma/vuln/issues/7; https://vuldb.com/?ctiid.307427; https://vuldb.com/?id.307427
CVE: CVE-2025-46584
Published: 2025-05-06
Description: Vulnerability of improper authentication logic implementation in the file system module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.8 (HIGH)
CWE: CWE-280, CWE-755
References: https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE: CVE-2025-46585
Published: 2025-05-06
Description: Out-of-bounds array read/write vulnerability in the kernel module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE: CVE-2025-46586
Published: 2025-05-06
Description: Permission control vulnerability in the contacts module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-862, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE: CVE-2025-4327
Published: 2025-05-06
Description: A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints might be affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/bdkuzma/vuln/issues/8; https://vuldb.com/?ctiid.307428; https://vuldb.com/?id.307428
CVE: CVE-2025-4328
Published: 2025-05-06
Description: A vulnerability was found in fp2952 spring-cloud-base up to 7f050dc6db9afab82c5ce1d41cd74ed255ec9bfa. It has been declared as problematic. Affected by this vulnerability is the function sendBack of the file /spring-cloud-base-master/auth-center/auth-center-provider/src/main/java/com/peng/auth/provider/config/web/MvcController.java of the component HTTP Header Handler. The manipulation of the argument Referer leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 3.5 (LOW)
CWE: CWE-601
References: https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250423-01.md; https://vuldb.com/?ctiid.307429; https://vuldb.com/?id.307429
CVE: CVE-2025-4329
Published: 2025-05-06
Description: A vulnerability was found in 74CMS up to 3.33.0. It has been rated as problematic. Affected by this issue is the function index of the file /index.php/index/download/index. The manipulation of the argument url leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/Q16G/cve_detail/blob/main/74cms/fileRead.md; https://vuldb.com/?ctiid.307430; https://vuldb.com/?id.307430
CVE: CVE-2024-58252
Published: 2025-05-06
Description: Vulnerability of insufficient information protection in the media library module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE: CVE-2025-3020
Published: 2025-05-06
Description: An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cert.vde.com/en/advisories/VDE-2025-032
CVE: CVE-2025-3281
Published: 2025-05-06
Description: The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.1 via the create_stripe_subscription() function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that have registered through the plugin.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/user-registration/tags/4.1.3/modules/membership/includes/AJAX.php#L619; https://plugins.trac.wordpress.org/changeset/3287698/user-registration/trunk/modules/membership/includes/AJAX.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/30339ff6-b6bf-4c56-b6cd-db0b8a6ce8b6?source=cve
CVE: CVE-2025-46587
Published: 2025-05-06
Description: Permission control vulnerability in the media library module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE: CVE-2025-46588
Published: 2025-05-06
Description: Vulnerability of unauthorized access in the app lock module
Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE: CVE-2025-46589
Published: 2025-05-06
Description: Vulnerability of unauthorized access in the app lock module
Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE: CVE-2025-46590
Published: 2025-05-06
Description: Bypass vulnerability in the network search instruction authentication module
Impact: Successful exploitation of this vulnerability can bypass authentication and enable access to some network search functions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE: CVE-2025-46591
Published: 2025-05-06
Description: Out-of-bounds data read vulnerability in the authorization module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-602, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE: CVE-2025-46592
Published: 2025-05-06
Description: Null pointer dereference vulnerability in the USB HDI driver module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE: CVE-2025-46593
Published: 2025-05-06
Description: Process residence vulnerability in abnormal scenarios in the print module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-400
References: https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE: CVE-2025-4331
Published: 2025-05-06
Description: A vulnerability classified as critical was found in SourceCodester Online Student Clearance System 1.0. This vulnerability affects unknown code of the file /Admin/login.php. The manipulation of the argument id/username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/cybersharmaji/Online-Student-Clearance-System/blob/main/sql_injection_time.md; https://vuldb.com/?ctiid.307432; https://vuldb.com/?id.307432
CVE: CVE-2025-4332
Published: 2025-05-06
Description: A vulnerability was found in PHPGurukul Company Visitor Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /visitor-detail.php. The manipulation of the argument editid/remark leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ctf2868/pjwww/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.307436
CVE: CVE-2025-4333
Published: 2025-05-06
Description: A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm up to 0.0.1. It has been classified as critical. This affects the function uploadFile of the file src/main/java/com/megagao/production/ssm/service/impl/FileServiceImpl.java. The manipulation of the argument uploadFile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/Hao-Ni/CVE/issues/1; https://vuldb.com/?ctiid.307437; https://vuldb.com/?id.307437
CVE: CVE-2025-4340
Published: 2025-05-06
Description: A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03. Affected is the function sub_175C8 of the file /htdocs/soap.cgi. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/CH13hh/tmp_store_cc/blob/main/tt/1.md; https://vuldb.com/?ctiid.307458; https://vuldb.com/?id.307458
CVE: CVE-2024-45554
Published: 2025-05-06
Description: Memory corruption during concurrent SSR execution due to race condition on the global maps list.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45562
Published: 2025-05-06
Description: Memory corruption during concurrent access to server info object due to unprotected critical field.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45563
Published: 2025-05-06
Description: Memory corruption while handling schedule request in Camera Request Manager(CRM) due to invalid link count in the corresponding session.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45564
Published: 2025-05-06
Description: Memory corruption during concurrent access to server info object due to incorrect reference count update.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45565
Published: 2025-05-06
Description: Memory corruption when blob structure is modified by user-space after kernel verification.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45566
Published: 2025-05-06
Description: Memory corruption during concurrent buffer access due to modification of the reference count.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45567
Published: 2025-05-06
Description: Memory corruption while encoding JPEG format.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45568
Published: 2025-05-06
Description: Memory corruption due to improper bounds check while command handling in camera-kernel driver.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45570
Published: 2025-05-06
Description: Memory corruption may occur during IO configuration processing when the IO port count is invalid.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-823, CWE-119
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45574
Published: 2025-05-06
Description: Memory corruption during array access in Camera kernel due to invalid index from invalid command data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45575
Published: 2025-05-06
Description: Memory corruption Camera kernel when large number of devices are attached through userspace.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45576
Published: 2025-05-06
Description: Memory corruption while prociesing command buffer buffer in OPE module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45577
Published: 2025-05-06
Description: Memory corruption while invoking IOCTL calls from userspace to camera kernel driver to dump request information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45578
Published: 2025-05-06
Description: Memory corruption while acquire and update IOCTLs during IFE output resource ID validation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45579
Published: 2025-05-06
Description: Memory corruption may occur when invoking IOCTL calls from userspace to the camera kernel driver to dump request information, due to a missing memory requirement check.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45581
Published: 2025-05-06
Description: Memory corruption while sound model registration for voice activation with audio kernel driver.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-45583
Published: 2025-05-06
Description: Memory corruption while handling multiple IOCTL calls from userspace to operate DMA operations.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-49829
Published: 2025-05-06
Description: Memory corruption can occur during context user dumps due to inadequate checks on buffer length.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-49830
Published: 2025-05-06
Description: Memory corruption while processing an IOCTL call to set mixer controls.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-49835
Published: 2025-05-06
Description: Memory corruption while reading secure file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-49841
Published: 2025-05-06
Description: Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.
CVSS Score: 7.8 (HIGH)
CWE: CWE-390, CWE-755
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-49842
Published: 2025-05-06
Description: Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-49844
Published: 2025-05-06
Description: Memory corruption while triggering commands in the PlayReady Trusted application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-49845
Published: 2025-05-06
Description: Memory corruption during the FRS UDS generation process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-49846
Published: 2025-05-06
Description: Memory corruption while decoding of OTA messages from T3448 IE.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2024-49847
Published: 2025-05-06
Description: Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2025-21453
Published: 2025-05-06
Description: Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2025-21459
Published: 2025-05-06
Description: Transient DOS while parsing per STA profile in ML IE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2025-21460
Published: 2025-05-06
Description: Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2025-21462
Published: 2025-05-06
Description: Memory corruption while processing an IOCTL request, when buffer significantly exceeds the command argument limit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2025-21467
Published: 2025-05-06
Description: Memory corruption while reading the FW response from the shared queue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2025-21468
Published: 2025-05-06
Description: Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2025-21469
Published: 2025-05-06
Description: Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2025-21470
Published: 2025-05-06
Description: Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2025-21475
Published: 2025-05-06
Description: Memory corruption while processing escape code, when DisplayId is passed with large unsigned value.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE: CVE-2025-22886
Published: 2025-05-06
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.
CVSS Score: 3.3 (LOW)
CWE: CWE-401
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-05.md
CVE: CVE-2025-25052
Published: 2025-05-06
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through buffer overflow.
CVSS Score: 3.3 (LOW)
CWE: CWE-120
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-05.md
CVE: CVE-2025-25218
Published: 2025-05-06
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md
CVE: CVE-2025-27132
Published: 2025-05-06
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-05.md
CVE: CVE-2025-27241
Published: 2025-05-06
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-05.md