deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-30351
Published: 2022-01-03
Description: An out of bound memory access can occur due to improper validation of number of frames being passed during music playback in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-35093
Published: 2022-01-03
Description: Possible memory corruption in BT controller when it receives an oversized LMP packet over 2-DH1 link and leads to denial of service in BlueCore
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-44158
Published: 2022-01-03
Description: ASUS RT-AX56U Wi-Fi Router is vulnerable to stack-based buffer overflow due to improper validation for httpd parameter length. An authenticated local area network attacker can launch arbitrary code execution to control the system or disrupt service.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121, CWE-1284
References: https://www.twcert.org.tw/tw/cp-132-5431-d23be-1.html; https://www.twcert.org.tw/tw/cp-132-5431-d23be-1.html
CVE: CVE-2021-45916
Published: 2022-01-03
Description: The programming function of Shockwall system has an improper input validation vulnerability. An authenticated attacker within the local area network can send malicious response to the server to disrupt the service partially.
CVSS Score: 3.5 (LOW)
CWE: CWE-20, CWE-20
References: https://www.twcert.org.tw/tw/cp-132-5432-b9074-1.html; https://www.twcert.org.tw/tw/cp-132-5432-b9074-1.html
CVE: CVE-2021-45917
Published: 2022-01-03
Description: The server-request receiver function of Shockwall system has an improper authentication vulnerability. An authenticated attacker of an agent computer within the local area network can use the local registry information to launch server-side request forgery (SSRF) attack on another agent computer, resulting in arbitrary code execution for controlling the system or disrupting service.
CVSS Score: 8.0 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.twcert.org.tw/tw/cp-132-5433-77f6f-1.html; https://www.twcert.org.tw/tw/cp-132-5433-77f6f-1.html
CVE: CVE-2021-24680
Published: 2022-01-03
Description: The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/30f2a0d5-7959-436c-9[PII_REDACTED]e82d3; https://wpscan.com/vulnerability/30f2a0d5-7959-436c-9[PII_REDACTED]e82d3
CVE: CVE-2021-24786
Published: 2022-01-03
Description: The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/a6571f16-66d2-449e-af83-1c6ddd56edfa; https://wpscan.com/vulnerability/a6571f16-66d2-449e-af83-1c6ddd56edfa
CVE: CVE-2021-24828
Published: 2022-01-03
Description: The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/6f9d1ee5-7ed7-4304-96a2-611b2f0081d2; https://wpscan.com/vulnerability/6f9d1ee5-7ed7-4304-96a2-611b2f0081d2
CVE: CVE-2021-24831
Published: 2022-01-03
Description: All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-425
References: https://wpscan.com/vulnerability/75ed9f5f-e091-4372-a6cb-57958ad5f900; https://wpscan.com/vulnerability/75ed9f5f-e091-4372-a6cb-57958ad5f900
CVE: CVE-2021-24893
Published: 2022-01-03
Description: The Stars Rating WordPress plugin before 3.5.1 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the comments section, or pending comment dashboard depending if the user sent it as unauthenticated or authenticated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-20
References: https://wpscan.com/vulnerability/05d3af69-20b4-499a-8322-2b53674d6a58; https://wpscan.com/vulnerability/05d3af69-20b4-499a-8322-2b53674d6a58
CVE: CVE-2021-24963
Published: 2022-01-03
Description: The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2634373; https://wpscan.com/vulnerability/7f8b4275-7586-4e04-afd9-d12bdab6ba9b; https://plugins.trac.wordpress.org/changeset/2634373
CVE: CVE-2021-24964
Published: 2022-01-03
Description: The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/e9966b3e-2eb9-4d70-8c18-6a829b4827cc; https://wpscan.com/vulnerability/e9966b3e-2eb9-4d70-8c18-6a829b4827cc
CVE: CVE-2021-24973
Published: 2022-01-03
Description: The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2629821; https://wpscan.com/vulnerability/0118f245-0e6f-44c1-9bdb-5b3a5d2403d6; https://plugins.trac.wordpress.org/changeset/2629821
CVE: CVE-2021-24991
Published: 2022-01-03
Description: The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section parameters before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in the admin dashboard
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/88e706df-ae03-4665-94a3-db226e1f31a9; https://wpscan.com/vulnerability/88e706df-ae03-4665-94a3-db226e1f31a9
CVE: CVE-2021-24999
Published: 2022-01-03
Description: The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/8527f4fe-312f-45c1-ae4c-7e799702fc26; https://wpscan.com/vulnerability/8527f4fe-312f-45c1-ae4c-7e799702fc26
CVE: CVE-2021-25000
Published: 2022-01-03
Description: The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/bc167b3a-24ee-4988-9934-189b6216ce40; https://wpscan.com/vulnerability/bc167b3a-24ee-4988-9934-189b6216ce40
CVE: CVE-2021-25001
Published: 2022-01-03
Description: The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/76f0257d-aae7-4054-9b3d-ba10b4005cf1; https://wpscan.com/vulnerability/76f0257d-aae7-4054-9b3d-ba10b4005cf1
CVE: CVE-2021-25016
Published: 2022-01-03
Description: The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/b5[PII_REDACTED]-4fc6-bc45-1e8016e5c4c0; https://wpscan.com/vulnerability/b5[PII_REDACTED]-4fc6-bc45-1e8016e5c4c0
CVE: CVE-2021-25020
Published: 2022-01-03
Description: The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://wpscan.com/vulnerability/67398332-b93e-46ae-8[PII_REDACTED]9a124; https://wpscan.com/vulnerability/67398332-b93e-46ae-8[PII_REDACTED]9a124
CVE: CVE-2021-25021
Published: 2022-01-03
Description: The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://wpscan.com/vulnerability/92db763c-ca6b-43cf-87ff-c1678cf4ade5; https://wpscan.com/vulnerability/92db763c-ca6b-43cf-87ff-c1678cf4ade5
CVE: CVE-2021-25022
Published: 2022-01-03
Description: The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2635585/updraftplus; https://plugins.trac.wordpress.org/changeset/2637112/updraftplus; https://wpscan.com/vulnerability/1801c7ae-2b5c-493f-969d-4bb19a9feb15
CVE: CVE-2021-25023
Published: 2022-01-03
Description: The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related table, leading to an SQL injection
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/4a27d374-f690-4a8a-987a-9e0f56bbe143; https://wpscan.com/vulnerability/4a27d374-f690-4a8a-987a-9e0f56bbe143
CVE: CVE-2021-25027
Published: 2022-01-03
Description: The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2638073; https://wpscan.com/vulnerability/48612c44-151d-4438-b91c-c27e96174270; https://plugins.trac.wordpress.org/changeset/2638073
CVE: CVE-2021-25030
Published: 2022-01-03
Description: The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/bc7058b1-ca93-4c45-9ced-7848c7ae4150; https://wpscan.com/vulnerability/bc7058b1-ca93-4c45-9ced-7848c7ae4150
CVE: CVE-2021-25040
Published: 2022-01-03
Description: The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/3ed821a6-c3e2-4964-86f8-d14c4a54708a; https://wpscan.com/vulnerability/3ed821a6-c3e2-4964-86f8-d14c4a54708a
CVE: CVE-2021-44674
Published: 2022-01-03
Description: An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0. The vulnerability allows an authenticated attacker to read file outside of the restricted directory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://open-audit.com; http://opmantek.com; https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v4.3.0
CVE: CVE-2021-45428
Published: 2022-01-03
Description: TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: http://packetstormsecurity.com/files/167101/TLR-2005KSH-Arbitrary-File-Upload.html; https://drive.google.com/file/d/1wM1SPOfB9mH2SES7cAmlysuI9fOpFB3F/view?usp=sharing; http://packetstormsecurity.com/files/167101/TLR-2005KSH-Arbitrary-File-Upload.html
CVE: CVE-2021-3837
Published: 2022-01-03
Description: openwhyd is vulnerable to Improper Authorization
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-285
References: https://github.com/openwhyd/openwhyd/commit/102a97bb082edc831cf35d27f9e5c4f55f10ae85; https://huntr.dev/bounties/d66f90d6-1b5f-440d-8be6-cdffc9d4587e; https://github.com/openwhyd/openwhyd/commit/102a97bb082edc831cf35d27f9e5c4f55f10ae85
CVE: CVE-2021-46109
Published: 2022-01-03
Description: Invalid input sanitizing leads to reflected Cross Site Scripting (XSS) in ASUS RT-AC52U_B1 3.0.0.4.380.10931 can lead to a user session hijack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/drive/folders/1GAOuZwPB-upkpjPgjB8qLIKl9Mh3IVfl?usp=sharing; https://drive.google.com/drive/folders/1GAOuZwPB-upkpjPgjB8qLIKl9Mh3IVfl?usp=sharing
CVE: CVE-2021-45817
Published: 2022-01-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-11689. Reason: This candidate is a duplicate of CVE-2018-11689. Notes: All CVE users should reference CVE-2018-11689 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-23026
Published: 2022-01-03
Description: A NULL pointer dereference in the main() function dhry_1.c of dhrystone 2.1 causes a denial of service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://fossies.org/linux/privat/old/dhrystone-2.1.tar.gz/dhry_1.c; https://fossies.org/linux/privat/old/dhrystone-2.1.tar.gz/dhry_1.c
CVE: CVE-2021-20147
Published: 2022-01-03
Description: ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://www.tenable.com/security/research/tra-2021-52; https://www.tenable.com/security/research/tra-2021-52
CVE: CVE-2021-20148
Published: 2022-01-03
Description: ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain by authenticating to the service and then sending a request specifying the password policy file of the other domain.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-552
References: https://www.tenable.com/security/research/tra-2021-52; https://www.tenable.com/security/research/tra-2021-52
CVE: CVE-2021-37098
Published: 2022-01-03
Description: Hilinksvc service exists a Data Processing Errors vulnerability .Successful exploitation of this vulnerability may cause application crash.
CVSS Score: 7.5 (HIGH)
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-37110
Published: 2022-01-03
Description: There is a Timing design defects in Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/11/
CVE: CVE-2021-37111
Published: 2022-01-03
Description: There is a Memory leakage vulnerability in Smartphone.Successful exploitation of this vulnerability may cause memory exhaustion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://consumer.huawei.com/en/support/bulletin/2021/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/10/
CVE: CVE-2021-37112
Published: 2022-01-03
Description: Hisuite module has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability may lead to Firmware leak.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]
CVE: CVE-2021-37113
Published: 2022-01-03
Description: There is a Privilege escalation vulnerability with the file system component in Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/10/
CVE: CVE-2021-37114
Published: 2022-01-03
Description: There is an Out-of-bounds read vulnerability in Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2021/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/10/
CVE: CVE-2021-37116
Published: 2022-01-03
Description: PCManager has a Weaknesses Introduced During Design vulnerability .Successful exploitation of this vulnerability may cause that the PIN of the subscriber is changed.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-37117
Published: 2022-01-03
Description: There is a Service logic vulnerability in Smartphone.Successful exploitation of this vulnerability may cause WLAN DoS.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/10/
CVE: CVE-2021-37118
Published: 2022-01-03
Description: The HwNearbyMain module has a Improper Handling of Exceptional Conditions vulnerability.Successful exploitation of this vulnerability may lead to message leak.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-755
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]
CVE: CVE-2021-37119
Published: 2022-01-03
Description: There is a Service logic vulnerability in Smartphone.Successful exploitation of this vulnerability may cause WLAN DoS.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/10/
CVE: CVE-2021-37120
Published: 2022-01-03
Description: There is a Double free vulnerability in Smartphone.Successful exploitation of this vulnerability may cause a kernel crash or privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://consumer.huawei.com/en/support/bulletin/2021/10/; https://consumer.huawei.com/en/support/bulletin/2021/10/
CVE: CVE-2021-37121
Published: 2022-01-03
Description: There is a Configuration defects in Smartphone.Successful exploitation of this vulnerability may elevate the MEID (IMEI) permission.
CVSS Score: 9.8 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2021/10/; https://consumer.huawei.com/en/support/bulletin/2021/10/
CVE: CVE-2021-37125
Published: 2022-01-03
Description: Arbitrary file has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability .Successful exploitation of this vulnerability may cause confidentiality is affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-37126
Published: 2022-01-03
Description: Arbitrary file has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability .Successful exploitation of this vulnerability may cause the directory is traversed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-37128
Published: 2022-01-03
Description: HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may write any file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-37132
Published: 2022-01-03
Description: PackageManagerService has a Permissions, Privileges, and Access Controls vulnerability .Successful exploitation of this vulnerability may cause that Third-party apps can obtain the complete list of Harmony apps without permission.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-37133
Published: 2022-01-03
Description: There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/11/