deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-33174
Published: 2022-06-13
Description: Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://gynvael.coldwind.pl/?lang=en&id=748; https://gynvael.coldwind.pl/?lang=en&id=748
CVE: CVE-2022-33175
Published: 2022-06-13
Description: Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/get_param.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrators. The session id can then be reused to act as the administrator, allowing reading of the cleartext password, or reconfiguring the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://gynvael.coldwind.pl/?lang=en&id=748; https://gynvael.coldwind.pl/?lang=en&id=748
CVE: CVE-2022-22259
Published: 2022-06-13
Description: There is an improper authentication vulnerability in FLMG-10 10.0.1.0(H100SP22C00). Successful exploitation of this vulnerability may lead to a control of the victim device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220406-01-bdb62b17-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220406-01-bdb62b17-en
CVE: CVE-2022-29797
Published: 2022-06-13
Description: There is a buffer overflow vulnerability in CV81-WDM FW 01.70.49.29.46. Successful exploitation of this vulnerability may lead to privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220427-01-e9a493e2-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220427-01-e9a493e2-en
CVE: CVE-2022-29798
Published: 2022-06-13
Description: There is a denial of service vulnerability in CV81-WDM FW versions 01.70.49.29.46. Successful exploitation could cause denial of service.
CVSS Score: 7.5 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220601-01-f75b152f-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220601-01-f75b152f-en
CVE: CVE-2022-31053
Published: 2022-06-13
Description: Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. There are no known workarounds for this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://eprint.iacr.org/2020/1484; https://github.com/biscuit-auth/biscuit/security/advisories/GHSA-75rw-34q6-72cr; https://eprint.iacr.org/2020/1484
CVE: CVE-2022-31054
Published: 2022-06-13
Description: Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-787
References: https://github.com/argoproj/argo-events/commit/eaabcb6d65022fc34a0cc9ea7f00681abd326b35; https://github.com/argoproj/argo-events/issues/1946; https://github.com/argoproj/argo-events/pull/1966
CVE: CVE-2022-29247
Published: 2022-06-13
Description: Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.
CVSS Score: 2.2 (LOW)
CWE: CWE-668
References: https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7; https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7
CVE: CVE-2022-32193
Published: 2022-06-13
Description: Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://www.couchbase.com/alerts; https://docs.couchbase.com/server/current/release-notes/relnotes.html
CVE: CVE-2022-32558
Published: 2022-06-13
Description: An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading may leak internal user passwords during a failure.
CVSS Score: 7.5 (HIGH)
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts
CVE: CVE-2022-32560
Published: 2022-06-13
Description: An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts
CVE: CVE-2022-32564
Published: 2022-06-13
Description: An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie.
CVSS Score: 7.5 (HIGH)
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts
CVE: CVE-2022-29257
Published: 2022-06-13
Description: Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components. This kind of attack would require significant privileges in a potential victim's own auto updating infrastructure and the ease of that attack entirely depends on the potential victim's infrastructure security. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. There are no known workarounds.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20
References: https://github.com/electron/electron/security/advisories/GHSA-77xc-hjv8-ww97; https://github.com/electron/electron/security/advisories/GHSA-77xc-hjv8-ww97
CVE: CVE-2022-32278
Published: 2022-06-13
Description: XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server.
CVSS Score: 8.8 (HIGH)
References: https://gitlab.xfce.org/xfce/exo/-/commit/c71c04ff5882b2866a0d8506fb460d4ef796de9f; https://lists.debian.org/debian-lts-announce/2022/06/msg00018.html; https://www.debian.org/security/2022/dsa-5164
CVE: CVE-2021-41661
Published: 2022-06-13
Description: Church Management System version 1.0 is affected by a SQL anjection vulnerability through creating a user with a PHP file as an avatar image, which is accessible through the /uploads directory. This can lead to RCE on the web server by uploading a PHP webshell.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/janikwehrli1/0dayHunt/blob/main/Church_Managementv1.0_RCE.py; https://github.com/janikwehrli1/0dayHunt/blob/main/Church_Managementv1.0_RCE.py
CVE: CVE-2021-41662
Published: 2022-06-13
Description: The South Gate Inn Online Reservation System v1.0 contains an SQL injection vulnerability that can be chained with a malicious PHP file upload, which is caused by improper file handling in the editImg function. This vulnerability leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/janikwehrli1/0dayHunt/blob/main/SouthGateInn_RCE.py; https://github.com/janikwehrli1/0dayHunt/blob/main/SouthGateInn_RCE.py
CVE: CVE-2022-32192
Published: 2022-06-13
Description: Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://www.couchbase.com/alerts; https://docs.couchbase.com/server/current/release-notes/relnotes.html
CVE: CVE-2022-32562
Published: 2022-06-13
Description: An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts
CVE: CVE-2022-32565
Published: 2022-06-13
Description: An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts
CVE: CVE-2022-31415
Published: 2022-06-14
Description: Online Fire Reporting System v1.0 was discovered to contain a SQL injection vulnerability via the GET parameter in /report/list.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://researchinthebin.org/posts/ofrs-sql-injection/; https://researchinthebin.org/posts/ofrs-sql-injection/
CVE: CVE-2022-31446
Published: 2022-06-14
Description: Tenda AC18 router V15.03.05.19 and V15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter at ip/goform/WriteFacMac.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/wshidamowang/Router/blob/main/Tenda/AC18/RCE_1.md; https://github.com/wshidamowang/Router/blob/main/Tenda/AC18/RCE_1.md
CVE: CVE-2022-31447
Published: 2022-06-14
Description: An XML external entity (XXE) injection vulnerability in Magicpin v3.4 allows attackers to access sensitive database information via a crafted SVG file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://gist.github.com/Mr-Akuma/4f6261007fcfbd96fa2c2d8ad4a5e1ca; https://magicpin.in/; https://gist.github.com/Mr-Akuma/4f6261007fcfbd96fa2c2d8ad4a5e1ca
CVE: CVE-2022-25167
Published: 2022-06-14
Description: Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-74
References: http://www.openwall.com/lists/oss-security/2022/06/14/1; https://issues.apache.org/jira/browse/FLUME-3416; https://lists.apache.org/thread/16nf6b81zjpdc4y93ho99oxo83ddbsvg
CVE: CVE-2022-2076
Published: 2022-06-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-2077
Published: 2022-06-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-26302
Published: 2022-06-14
Description: Heap-based buffer overflow exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU99188133/index.html; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php; https://jvn.jp/en/vu/JVNVU99188133/index.html
CVE: CVE-2022-27176
Published: 2022-06-14
Description: Incomplete filtering of special elements vulnerability exists in RevoWorks SCVX using 'File Sanitization Library' 1.043 and prior versions, RevoWorks Browser 2.2.67 and prior versions (when using 'File Sanitization Option'), and RevoWorks Desktop 2.1.84 and prior versions (when using 'File Sanitization Option'), which may allow an attacker to execute a malicious macro by having a user to download, import, and open a specially crafted file in the local environment.
CVSS Score: 7.8 (HIGH)
References: https://jscom.jp/news-20220527/; https://jvn.jp/en/jp/JVN27256219/index.html; https://jscom.jp/news-20220527/
CVE: CVE-2022-29482
Published: 2022-06-14
Description: 'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack.
CVSS Score: 3.7 (LOW)
CWE: CWE-295
References: https://jvn.jp/en/jp/JVN13878856/index.html; https://jvn.jp/en/jp/JVN13878856/index.html
CVE: CVE-2022-29485
Published: 2022-06-14
Description: Cross-site scripting vulnerability in SHIRASAGI v1.0.0 to v1.14.2, and v1.15.0 allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/shirasagi/shirasagi; https://jvn.jp/en/jp/JVN32962443/index.html; https://www.ss-proj.org/
CVE: CVE-2022-29506
Published: 2022-06-14
Description: Out-of-bounds read vulnerability exist in the simulator module contained in the graphic editor 'V-SFT' v6.1.3.0 and earlier, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU93134398/index.html; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php; https://monitouch.fujielectric.com/site/download-eu/03tellus_inf/index.php
CVE: CVE-2022-29509
Published: 2022-06-14
Description: Directory traversal vulnerability in T&D Data Server (Japanese Edition) Ver.2.22 and earlier, T&D Data Server (English Edition) Ver.2.30 and earlier, THERMO RECORDER DATA SERVER (Japanese Edition) Ver.2.13 and earlier, and THERMO RECORDER DATA SERVER (English Edition) Ver.2.13 and earlier allows a remote attacker to view an arbitrary file on the server via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN28659051/index.html; https://tandd.com/news/detail.html?id=696; https://www.tandd.co.jp/news/detail.html?id=522
CVE: CVE-2022-29522
Published: 2022-06-14
Description: Use after free vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://jvn.jp/en/vu/JVNVU99188133/index.html; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php; https://jvn.jp/en/vu/JVNVU99188133/index.html
CVE: CVE-2022-29524
Published: 2022-06-14
Description: Out-of-bounds write vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU93134398/index.html; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php; https://monitouch.fujielectric.com/site/download-eu/03tellus_inf/index.php
CVE: CVE-2022-29925
Published: 2022-06-14
Description: Access of uninitialized pointer vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://jvn.jp/en/vu/JVNVU99188133/index.html; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php; https://jvn.jp/en/vu/JVNVU99188133/index.html
CVE: CVE-2022-2079
Published: 2022-06-14
Description: Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nocodb/nocodb/commit/362f8f0869989bc13bdcd66c6fc9c86ac79b9992; https://huntr.dev/bounties/2615adf2-ff40-4623-97fb-2e4a3800202a; https://github.com/nocodb/nocodb/commit/362f8f0869989bc13bdcd66c6fc9c86ac79b9992
CVE: CVE-2021-30281
Published: 2022-06-14
Description: Possible unauthorized access to secure space due to improper check of data allowed while flashing the no access control device configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.4 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin
CVE: CVE-2021-30327
Published: 2022-06-14
Description: Buffer overflow in sahara protocol while processing commands leads to overwrite of secure configuration data in Snapdragon Mobile, Snapdragon Compute, Snapdragon Auto, Snapdragon IOT, Snapdragon Connectivity, Snapdragon Voice & Music
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin
CVE: CVE-2021-30334
Published: 2022-06-14
Description: Possible use after free due to lack of null check of DRM file status after file structure is freed in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin
CVE: CVE-2021-30338
Published: 2022-06-14
Description: Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Compute
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin
CVE: CVE-2021-30339
Published: 2022-06-14
Description: Reading PRNG output may lead to improper key generation due to lack of buffer validation in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.0 (CRITICAL)
References: https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin
CVE: CVE-2021-30340
Published: 2022-06-14
Description: Reachable assertion due to improper validation of coreset in PDCCH configuration in SA mode in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin
CVE: CVE-2021-30341
Published: 2022-06-14
Description: Improper buffer size validation of DSM packet received can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin
CVE: CVE-2021-30342
Published: 2022-06-14
Description: Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-367
References: https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin
CVE: CVE-2021-30343
Published: 2022-06-14
Description: Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-367
References: https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin
CVE: CVE-2021-30344
Published: 2022-06-14
Description: Improper authorization of a replayed LTE security mode command can lead to a denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin
CVE: CVE-2021-30345
Published: 2022-06-14
Description: RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.5 (MEDIUM)
References: https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin
CVE: CVE-2021-30346
Published: 2022-06-14
Description: RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.5 (MEDIUM)
References: https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin