deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-33658
Published: 2022-03-11
Description: atune before 0.3-0.8 log in as a local user and run the curl command to access the local atune url interface to escalate the local privilege or modify any file. Authentication is not forcibly enabled in the default configuration.
CVSS Score: 7.8 (HIGH)
CWE: CWE-306
References: https://www.openeuler.org/zh/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1541; https://www.openeuler.org/zh/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1541
CVE: CVE-2022-0001
Published: 2022-03-11
Description: Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/03/18/2; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00598.html
CVE: CVE-2022-0002
Published: 2022-03-11
Description: Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/03/18/2; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00598.html
CVE: CVE-2022-0853
Published: 2022-03-11
Description: A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=2060725; https://github.com/ByteHackr/CVE-2022-0853; https://bugzilla.redhat.com/show_bug.cgi?id=2060725
CVE: CVE-2022-0907
Published: 2022-03-11
Description: Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f2b656e2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-252
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0907.json; https://gitlab.com/libtiff/libtiff/-/issues/392; https://gitlab.com/libtiff/libtiff/-/merge_requests/314
CVE: CVE-2022-0908
Published: 2022-03-11
Description: Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
CVSS Score: 7.7 (HIGH)
CWE: CWE-476
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0908.json; https://gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f86faf93e85; https://gitlab.com/libtiff/libtiff/-/issues/383
CVE: CVE-2022-0909
Published: 2022-03-11
Description: Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0909.json; https://gitlab.com/libtiff/libtiff/-/issues/393; https://gitlab.com/libtiff/libtiff/-/merge_requests/310
CVE: CVE-2022-0921
Published: 2022-03-11
Description: Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-94, CWE-434
References: https://github.com/microweber/microweber/commit/867bdda1b4660b0795ad7f87ab5abe9e44b2b318; https://huntr.dev/bounties/e368be37-1cb4-4292-8d48-07132725f622; https://github.com/microweber/microweber/commit/867bdda1b4660b0795ad7f87ab5abe9e44b2b318
CVE: CVE-2022-0924
Published: 2022-03-11
Description: Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0924.json; https://gitlab.com/libtiff/libtiff/-/issues/278; https://gitlab.com/libtiff/libtiff/-/merge_requests/311
CVE: CVE-2022-23187
Published: 2022-03-11
Description: Adobe Illustrator version 26.0.3 (and earlier) is affected by a buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file in Illustrator.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://helpx.adobe.com/security/products/illustrator/apsb22-15.html; https://helpx.adobe.com/security/products/illustrator/apsb22-15.html
CVE: CVE-2022-23625
Published: 2022-03-11
Description: Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifiers may render the iOS Wire Client completely unusable by causing it to repeatedly crash on launch. These malformed resource identifiers can be generated and sent between Wire users. The root cause lies in [wireapp/wire-ios-transport](https://github.com/wireapp/wire-ios-transport), where code responsible for removing sensible tokens before logging may fail and lead to a crash (Swift exception) of the application. This causes undesirable behavior, however the (greater) Wire system is still functional. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://github.com/wireapp/wire-ios-transport/commit/02e90aa45edaf7eb2d8b97fa2377cd[PII_REDACTED]; https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-3xvh-x964-572h; https://github.com/wireapp/wire-ios/security/advisories/GHSA-rq36-8qfp-79mc
CVE: CVE-2022-23730
Published: 2022-03-11
Description: The public API error causes for the attacker to be able to bypass API access control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://lgsecurity.lge.com/bulletins/tv; https://lgsecurity.lge.com/bulletins/tv
CVE: CVE-2022-23731
Published: 2022-03-11
Description: V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://lgsecurity.lge.com/bulletins/tv; https://lgsecurity.lge.com/bulletins/tv
CVE: CVE-2022-23924
Published: 2022-03-11
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
CVSS Score: 8.2 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16
CVE: CVE-2022-23925
Published: 2022-03-11
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
CVSS Score: 8.2 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16
CVE: CVE-2022-23926
Published: 2022-03-11
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
CVSS Score: 8.2 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16
CVE: CVE-2022-23927
Published: 2022-03-11
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
CVSS Score: 8.2 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16
CVE: CVE-2022-23928
Published: 2022-03-11
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
CVSS Score: 8.2 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16
CVE: CVE-2022-23929
Published: 2022-03-11
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
CVSS Score: 8.2 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16
CVE: CVE-2022-23930
Published: 2022-03-11
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
CVSS Score: 8.2 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16
CVE: CVE-2022-23931
Published: 2022-03-11
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
CVSS Score: 8.2 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16
CVE: CVE-2022-23932
Published: 2022-03-11
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
CVSS Score: 8.2 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16
CVE: CVE-2022-23933
Published: 2022-03-11
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
CVSS Score: 8.2 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16
CVE: CVE-2022-23934
Published: 2022-03-11
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
CVSS Score: 8.2 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]896-16
CVE: CVE-2022-24090
Published: 2022-03-11
Description: Adobe Photoshop versions 23.1.1 (and earlier) and 22.5.5 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/photoshop/apsb22-14.html; https://helpx.adobe.com/security/products/photoshop/apsb22-14.html
CVE: CVE-2022-24094
Published: 2022-03-11
Description: Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb22-17.html; https://helpx.adobe.com/security/products/after_effects/apsb22-17.html
CVE: CVE-2022-24095
Published: 2022-03-11
Description: Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb22-17.html; https://helpx.adobe.com/security/products/after_effects/apsb22-17.html
CVE: CVE-2022-24096
Published: 2022-03-11
Description: Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by an Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb22-17.html; https://helpx.adobe.com/security/products/after_effects/apsb22-17.html
CVE: CVE-2022-24097
Published: 2022-03-11
Description: Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb22-17.html; https://helpx.adobe.com/security/products/after_effects/apsb22-17.html
CVE: CVE-2022-25216
Published: 2022-03-11
Description: An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access, by means of an HTTP GET request to http://<IP_ADDRESS>:32080/download/<URL_ENCODED_PATH>.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.tenable.com/security/research/tra-2022-07; https://www.tenable.com/security/research/tra-2022-07
CVE: CVE-2022-25600
Published: 2022-03-11
Description: Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7CR6VGITIB2TXXZ6B5QRRWPU5S4BXQPD/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJX6NVXSRN3RX3YUVEJQ4WUTQSDL3DSR/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZQCIZQI267YHVYSFB3CRKNK3F4ASPLK/
CVE: CVE-2022-25601
Published: 2022-03-11
Description: Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7CR6VGITIB2TXXZ6B5QRRWPU5S4BXQPD/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJX6NVXSRN3RX3YUVEJQ4WUTQSDL3DSR/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZQCIZQI267YHVYSFB3CRKNK3F4ASPLK/
CVE: CVE-2022-25621
Published: 2022-03-11
Description: UUNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIVERGE WA 1512 Ver8.2.11 and prior, UNIVERGE WA 2020 Ver8.2.11 and prior, UNIVERGE WA 2021 Ver8.2.11 and prior, UNIVERGE WA 2610-AP Ver8.2.11 and prior, UNIVERGE WA 2611-AP Ver8.2.11 and prior, UNIVERGE WA 2611E-AP Ver8.2.11 and prior, UNIVERGE WA WA2612-AP Ver8.2.11 and prior allows a remote attacker to execute arbitrary OS commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv22-004_en.html; https://jpn.nec.com/security-info/secinfo/nv22-004_en.html
CVE: CVE-2021-44667
Published: 2022-03-11
Description: A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/alibaba/nacos/issues/7359; https://github.com/alibaba/nacos/issues/7359
CVE: CVE-2022-24754
Published: 2022-03-11
Description: PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to check that the hashed digest data length must be equal to `PJSIP_MD5STRLEN` before passing to PJSIP.
CVSS Score: 8.5 (HIGH)
CWE: CWE-120, CWE-1284
References: https://github.com/pjsip/pjproject/commit/d27f79da11df7bc8bb56c2f291d71e54df8d2c47; https://github.com/pjsip/pjproject/security/advisories/GHSA-73f7-48m9-w662; https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
CVE: CVE-2022-25839
Published: 2022-03-11
Description: The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/duzun/URL.js/commit/9dc9fcc99baa4cbda24403d81a589e9b0f4121d0; https://snyk.io/vuln/SNYK-JS-URLJS-2414030; https://github.com/duzun/URL.js/commit/9dc9fcc99baa4cbda24403d81a589e9b0f4121d0
CVE: CVE-2022-24415
Published: 2022-03-11
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000197057/dsa-2022-053; https://www.dell.com/support/kbdoc/en-us/000197057/dsa-2022-053
CVE: CVE-2022-24416
Published: 2022-03-11
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000197057/dsa-2022-053; https://www.dell.com/support/kbdoc/en-us/000197057/dsa-2022-053
CVE: CVE-2022-24419
Published: 2022-03-11
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000197057/dsa-2022-053; https://www.dell.com/support/kbdoc/en-us/000197057/dsa-2022-053
CVE: CVE-2022-24420
Published: 2022-03-11
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000197057/dsa-2022-053; https://www.dell.com/support/kbdoc/en-us/000197057/dsa-2022-053
CVE: CVE-2022-24421
Published: 2022-03-11
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000197057/dsa-2022-053; https://www.dell.com/support/kbdoc/en-us/000197057/dsa-2022-053
CVE: CVE-2021-41848
Published: 2022-03-11
Description: An issue was discovered in Luna Simo PPR1.180610.011/[PII_REDACTED]30. It mishandles software updates such that local third-party apps can provide a spoofed software update file that contains an arbitrary shell script and arbitrary ARM binary, where both will be executed as the root user with an SELinux domain named osi. To exploit this vulnerability, a local third-party app needs to have write access to external storage to write the spoofed update at the expected path. The vulnerable system binary (i.e., /system/bin/osi_bin) does not perform any authentication of the update file beyond ensuring that it is encrypted with an AES key (that is hard-coded in the vulnerable system binary). Processes executing with the osi SELinux domain can programmatically perform the following actions: install apps, grant runtime permissions to apps (including permissions with protection levels of dangerous and development), access extensive Personally Identifiable Information (PII) using the programmatically grant permissions, uninstall apps, set the default launcher app to a malicious launcher app that spoofs other apps, set a network proxy to intercept network traffic, unload kernel modules, set the default keyboard to a keyboard that has keylogging functionality, examine notification contents, send text messages, and more. The spoofed update can optionally contain an arbitrary ARM binary that will be locally stored in internal storage and executed at system startup to achieve persistent code execution as the root user with the osi SELinux domain. This ARM binary will continue to execute at startup even if the app that provided the spoofed update is uninstalled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://athack.com/session-details/401; https://simowireless.com/; https://www.kryptowire.com/android-firmware-2022/
CVE: CVE-2021-41849
Published: 2022-03-11
Description: An issue was discovered in Luna Simo PPR1.180610.011/[PII_REDACTED]30. It sends the following Personally Identifiable Information (PII) in plaintext using HTTP to servers located in China: user's list of installed apps and device International Mobile Equipment Identity (IMEI). This PII is transmitted to log.skyroam.com.cn using HTTP, independent of whether the user uses the Simo software.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-319
References: https://athack.com/session-details/401; https://simowireless.com/; https://www.kryptowire.com/android-firmware-2022/
CVE: CVE-2021-41850
Published: 2022-03-11
Description: An issue was discovered in Luna Simo PPR1.180610.011/[PII_REDACTED]30. A pre-installed app with a package name of com.skyroam.silverhelper writes three IMEI values to system properties at system startup. The system property values can be obtained via getprop by all third-party applications co-located on the device, even those with no permissions granted, exposing the IMEI values to processes without enforcing any access control.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: https://athack.com/session-details/401; https://simowireless.com/; https://www.kryptowire.com/android-firmware-2022/