deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-20044
Published: 2021-12-08
Description: A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system commands in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
CVE: CVE-2021-20045
Published: 2021-12-08
Description: A buffer overflow vulnerability in SMA100 sonicfiles RAC_COPY_TO (RacNumber 36) method allows a remote unauthenticated attacker to potentially execute code as the 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
CVE: CVE-2021-20047
Published: 2021-12-08
Description: SonicWall Global VPN client version 4.10.6 (32-bit and 64-bit) and earlier have a DLL Search Order Hijacking vulnerability. Successful exploitation via a local attacker could result in remote code execution in the target system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0025; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0025
CVE: CVE-2021-26110
Published: 2021-12-08
Description: An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below and FortiProxy 2.0.1 and below, 1.2.9 and below may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a specific crafted configuration of fabric automation CLI script and auto-script features.
CVSS Score: 7.8 (HIGH)
References: https://fortiguard.com/advisory/FG-IR-20-131; https://fortiguard.com/advisory/FG-IR-20-131
CVE: CVE-2021-31850
Published: 2021-12-08
Description: A denial-of-service vulnerability in Database Security (DBS) prior to 4.8.4 allows a remote authenticated administrator to trigger a denial-of-service attack against the DBS server. The configuration of Archiving through the User interface incorrectly allowed the creation of directories and files in Windows system directories and other locations where sensitive data could be overwritten. The former could lead to a DoS, whilst the latter could lead to data destruction on the DBS server.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10358; https://www.zerodayinitiative.com/advisories/ZDI-21-1535/; https://kc.mcafee.com/corporate/index?page=content&id=SB10358
CVE: CVE-2021-36180
Published: 2021-12-08
Description: Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: https://fortiguard.com/advisory/FG-IR-21-120; https://fortiguard.com/advisory/FG-IR-21-120
CVE: CVE-2021-42757
Published: 2021-12-08
Description: A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://fortiguard.com/advisory/FG-IR-21-173; https://fortiguard.com/advisory/FG-IR-21-173
CVE: CVE-2021-42758
Published: 2021-12-08
Description: An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute any command as an admin user with full access rights via bypassing the GUI restrictions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://fortiguard.com/advisory/FG-IR-21-200; https://fortiguard.com/advisory/FG-IR-21-200
CVE: CVE-2021-4050
Published: 2021-12-08
Description: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/livehelperchat/livehelperchat/commit/0ce1dd2a13509747c240c8484228a5df8d6e03ec; https://huntr.dev/bounties/27eb39d7-7636-4c4b-922c-a2f8fbe1ba05; https://github.com/livehelperchat/livehelperchat/commit/0ce1dd2a13509747c240c8484228a5df8d6e03ec
CVE: CVE-2021-26103
Published: 2021-12-08
Description: An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2.0.3 and below, 1.2.11 and below and FortiGate verison 7.0.0, 6.4.6 and below, 6.2.9 and below of SSL VPN portal may allow a remote, unauthenticated attacker to conduct a cross-site request forgery (CSRF) attack . Only SSL VPN in web mode or full mode are impacted by this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-345
References: https://fortiguard.com/advisory/FG-IR-20-158; https://fortiguard.com/advisory/FG-IR-20-158
CVE: CVE-2021-32591
Published: 2021-12-08
Description: A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.
CVSS Score: 5.3 (MEDIUM)
References: https://fortiguard.com/advisory/FG-IR-20-222; https://fortiguard.com/advisory/FG-IR-20-222
CVE: CVE-2021-41029
Published: 2021-12-08
Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to store malicious javascript code in the device and trigger it via crafted HTTP requests
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-21-114; https://fortiguard.com/advisory/FG-IR-21-114
CVE: CVE-2021-42752
Published: 2021-12-08
Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute malicious javascript code on victim's host via crafted HTTP requests
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-21-111; https://fortiguard.com/advisory/FG-IR-21-111
CVE: CVE-2021-42760
Published: 2021-12-08
Description: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://fortiguard.com/advisory/FG-IR-21-129; https://fortiguard.com/advisory/FG-IR-21-129
CVE: CVE-2021-43067
Published: 2021-12-08
Description: A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows attacker to duplicate a target LDAP user 2 factors authentication token via crafted HTTP requests.
CVSS Score: 8.3 (HIGH)
CWE: CWE-200
References: https://fortiguard.com/advisory/FG-IR-21-211; https://fortiguard.com/advisory/FG-IR-21-211
CVE: CVE-2021-44556
Published: 2021-12-08
Description: National Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://github.com/KBNLresearch/digger; https://github.com/KBNLresearch/digger/pull/1; https://github.com/KBNLresearch/digger
CVE: CVE-2021-44557
Published: 2021-12-08
Description: National Library of the Netherlands multiNER <= c[PII_REDACTED]afc6e3d6b4903a7c05e666b94a3bc is affected by an XML External Entity (XXE) vulnerability in multiNER/ner.py. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://github.com/KBNLresearch/multiNER; https://github.com/KBNLresearch/multiNER/pull/3; https://github.com/KBNLresearch/multiNER
CVE: CVE-2021-26108
Published: 2021-12-08
Description: A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://fortiguard.com/advisory/FG-IR-21-051; https://fortiguard.com/advisory/FG-IR-21-051
CVE: CVE-2021-26109
Published: 2021-12-08
Description: An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap via specifically crafted requests to SSLVPN, resulting in potentially arbitrary code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-190
References: https://fortiguard.com/advisory/FG-IR-21-049; https://fortiguard.com/advisory/FG-IR-21-049
CVE: CVE-2021-36191
Published: 2021-12-08
Description: A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to use the device as proxy via crafted GET parameters in requests to error handlers
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-601
References: https://fortiguard.com/advisory/FG-IR-21-133; https://fortiguard.com/advisory/FG-IR-21-133
CVE: CVE-2021-41014
Published: 2021-12-08
Description: A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon unresponsive via huge HTTP packets
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://fortiguard.com/advisory/FG-IR-21-131; https://fortiguard.com/advisory/FG-IR-21-131
CVE: CVE-2021-41015
Published: 2021-12-08
Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to SAML login handler
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-21-139; https://fortiguard.com/advisory/FG-IR-21-139
CVE: CVE-2021-41024
Published: 2021-12-08
Description: A relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://fortiguard.com/advisory/FG-IR-21-181; https://fortiguard.com/advisory/FG-IR-21-181
CVE: CVE-2021-41027
Published: 2021-12-08
Description: A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, allows an authenticated attacker to execute unauthorized code or commands via crafted certificates loaded into the device.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://fortiguard.com/advisory/FG-IR-21-134; https://fortiguard.com/advisory/FG-IR-21-134
CVE: CVE-2021-43064
Published: 2021-12-08
Description: A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to use the device as a proxy and reach external or protected hosts via redirection handlers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://fortiguard.com/advisory/FG-IR-21-168; https://fortiguard.com/advisory/FG-IR-21-168
CVE: CVE-2021-36190
Published: 2021-12-08
Description: A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts via crafted HTTP requests.
CVSS Score: 5.5 (MEDIUM)
References: https://fortiguard.com/advisory/FG-IR-21-123; https://fortiguard.com/advisory/FG-IR-21-123
CVE: CVE-2021-43063
Published: 2021-12-08
Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-21-122; https://fortiguard.com/advisory/FG-IR-21-122
CVE: CVE-2021-25510
Published: 2021-12-08
Description: An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows local arbitrary code execution.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12
CVE: CVE-2021-25511
Published: 2021-12-08
Description: An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows attackers to write arbitrary files via a path traversal vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-22
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12
CVE: CVE-2021-25512
Published: 2021-12-08
Description: An improper validation vulnerability in telephony prior to SMR Dec-2021 Release 1 allows attackers to launch certain activities.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12
CVE: CVE-2021-25513
Published: 2021-12-08
Description: An improper privilege management vulnerability in Apps Edge application prior to SMR Dec-2021 Release 1 allows unauthorized access to some device data on the lockscreen.
CVSS Score: 2.4 (LOW)
CWE: CWE-269, CWE-269
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12
CVE: CVE-2021-25514
Published: 2021-12-08
Description: An improper intent redirection handling in Tags prior to SMR Dec-2021 Release 1 allows attackers to access sensitive information.
CVSS Score: 3.3 (LOW)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12
CVE: CVE-2021-25515
Published: 2021-12-08
Description: An improper usage of implicit intent in SemRewardManager prior to SMR Dec-2021 Release 1 allows attackers to access BSSID.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-269, CWE-668
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12
CVE: CVE-2021-25516
Published: 2021-12-08
Description: An improper check or handling of exceptional conditions in Exynos baseband prior to SMR Dec-2021 Release 1 allows attackers to track locations.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-703, CWE-755
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12
CVE: CVE-2021-25517
Published: 2021-12-08
Description: An improper input validation vulnerability in LDFW prior to SMR Dec-2021 Release 1 allows attackers to perform arbitrary code execution.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12
CVE: CVE-2021-25518
Published: 2021-12-08
Description: An improper boundary check in secure_log of LDFW and BL31 prior to SMR Dec-2021 Release 1 allows arbitrary memory write and code execution.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12
CVE: CVE-2021-25519
Published: 2021-12-08
Description: An improper access control vulnerability in CPLC prior to SMR Dec-2021 Release 1 allows local attackers to access CPLC information without permission.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=12
CVE: CVE-2021-25520
Published: 2021-12-08
Description: Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to execute script codes in Samsung Internet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12
CVE: CVE-2021-25521
Published: 2021-12-08
Description: Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get current tab URL in Samsung Internet.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-285, CWE-552
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12
CVE: CVE-2021-25522
Published: 2021-12-08
Description: Insecure storage of sensitive information vulnerability in Smart Capture prior to version 4.8.02.10 allows attacker to access victim's captured images without permission.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-922
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12
CVE: CVE-2021-25523
Published: 2021-12-08
Description: Insecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows attacker to get Samsung Account ID.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12
CVE: CVE-2021-25524
Published: 2021-12-08
Description: Insecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to get Samsung Account ID.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12
CVE: CVE-2021-25525
Published: 2021-12-08
Description: Improper check or handling of exception conditions vulnerability in Samsung Pay (US only) prior to version 4.0.65 allows attacker to use NFC without user recognition.
CVSS Score: 2.0 (LOW)
CWE: CWE-703, CWE-754
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12
CVE: CVE-2021-25526
Published: 2021-12-08
Description: Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-926
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12
CVE: CVE-2021-25527
Published: 2021-12-08
Description: Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to access Bill Pay and Recharge menu without authentication.
CVSS Score: 3.8 (LOW)
CWE: CWE-926
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12
CVE: CVE-2021-37037
Published: 2021-12-08
Description: There is an Invalid address access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the device to restart.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/9/
CVE: CVE-2021-37039
Published: 2021-12-08
Description: There is an Input verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Bluetooth DoS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2021/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/9/
CVE: CVE-2021-37040
Published: 2021-12-08
Description: There is a Parameter injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause privilege escalation of files after CIFS share mounting.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: https://consumer.huawei.com/en/support/bulletin/2021/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/9/
CVE: CVE-2021-37044
Published: 2021-12-08
Description: There is a Permission control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281
References: https://consumer.huawei.com/en/support/bulletin/2021/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/9/
CVE: CVE-2021-37045
Published: 2021-12-08
Description: There is an UAF vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the device to restart unexpectedly and the kernel-mode code to be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2021/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/9/
CVE: CVE-2021-37049
Published: 2021-12-08
Description: There is a Heap-based buffer overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may rewrite the memory of adjacent objects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2021/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/9/
CVE: CVE-2021-37050
Published: 2021-12-08
Description: There is a Missing sensitive data encryption vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: https://consumer.huawei.com/en/support/bulletin/2021/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/9/
CVE: CVE-2021-37051
Published: 2021-12-08
Description: There is an Out-of-bounds read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause out-of-bounds memory access.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2021/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/10/
CVE: CVE-2021-37052
Published: 2021-12-08
Description: There is an Exception log vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause address information leakage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://consumer.huawei.com/en/support/bulletin/2021/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/9/