deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-34794
Published: 2021-10-27
Description: A vulnerability in the Simple Network Management Protocol version 3 (SNMPv3) access control functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to query SNMP data. This vulnerability is due to ineffective access control. An attacker could exploit this vulnerability by sending an SNMPv3 query to an affected device from a host that is not permitted by the SNMPv3 access control list. A successful exploit could allow the attacker to send an SNMP query to an affected device and retrieve information from the device. The attacker would need valid credentials to perform the SNMP query.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-snmpaccess-M6yOweq3; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-snmpaccess-M6yOweq3
CVE: CVE-2021-40114
Published: 2021-10-27
Description: Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-770, CWE-401
References: https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-dos-s2R7W9UU; https://www.debian.org/security/2023/dsa-5354
CVE: CVE-2021-40116
Published: 2021-10-27
Description: Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.The vulnerability is due to improper handling of the Block with Reset or Interactive Block with Reset actions if a rule is configured without proper constraints. An attacker could exploit this vulnerability by sending a crafted IP packet to the affected device. A successful exploit could allow the attacker to cause through traffic to be dropped. Note: Only products with Snort3 configured and either a rule with Block with Reset or Interactive Block with Reset actions configured are vulnerable. Products configured with Snort2 are not vulnerable.
CVSS Score: 8.6 (HIGH)
CWE: CWE-241
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-dos-RywH7ezM; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-dos-RywH7ezM
CVE: CVE-2021-40117
Published: 2021-10-27
Description: A vulnerability in SSL/TLS message handler for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because incoming SSL/TLS packets are not properly processed. An attacker could exploit this vulnerability by sending a crafted SSL/TLS packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119, CWE-400
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-dos-4ygzLKU9; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-dos-4ygzLKU9
CVE: CVE-2021-40118
Published: 2021-10-27
Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious HTTPS request to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-121, CWE-787
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asafdt-webvpn-dos-KSqJAKPA; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asafdt-webvpn-dos-KSqJAKPA
CVE: CVE-2021-40125
Published: 2021-10-27
Description: A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. This vulnerability is due to improper control of a resource. An attacker with the ability to spoof a trusted IKEv2 site-to-site VPN peer and in possession of valid IKEv2 credentials for that peer could exploit this vulnerability by sending malformed, authenticated IKEv2 messages to an affected device. A successful exploit could allow the attacker to trigger a reload of the device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-416, CWE-400
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ikev2-dos-g4cmrr7C; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ikev2-dos-g4cmrr7C
CVE: CVE-2020-21250
Published: 2021-10-27
Description: CSZ CMS v1.2.4 was discovered to contain an arbitrary file upload vulnerability in the component /core/MY_Security.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/cskaza/cszcms/issues/22; https://github.com/cskaza/cszcms/issues/22
CVE: CVE-2021-1115
Published: 2021-10-27
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs, where an attacker with local unprivileged system access may cause a NULL pointer dereference, which may lead to denial of service in a component beyond the vulnerable component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5230; https://nvidia.custhelp.com/app/answers/detail/a_id/5230
CVE: CVE-2021-1116
Published: 2021-10-27
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a NULL pointer dereference in the kernel, created within user mode code, may lead to a denial of service in the form of a system crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5230; https://nvidia.custhelp.com/app/answers/detail/a_id/5230
CVE: CVE-2021-1117
Published: 2021-10-27
Description: Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an attacker through specific configuration and with local unprivileged system access may cause improper input validation, which may lead to denial of service.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-129, CWE-129
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5230; https://nvidia.custhelp.com/app/answers/detail/a_id/5230
CVE: CVE-2021-25219
Published: 2021-10-27
Description: In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.
CVSS Score: 5.3 (MEDIUM)
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://kb.isc.org/v1/docs/cve-2021-25219; https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
CVE: CVE-2021-3901
Published: 2021-10-27
Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/firefly-iii/firefly-iii/commit/b42d8d1e305cad70d9b83b33cd8e0d7a4b2060c2; https://huntr.dev/bounties/62508fdc-c26b-4312-bf75-fd3a3f997464; https://github.com/firefly-iii/firefly-iii/commit/b42d8d1e305cad70d9b83b33cd8e0d7a4b2060c2
CVE: CVE-2021-3903
Published: 2021-10-27
Description: vim is vulnerable to Heap-based Buffer Overflow
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://www.openwall.com/lists/oss-security/2022/01/15/1; https://github.com/vim/vim/commit/777e7c21b7627be80961848ac560cb0a9978ff43; https://huntr.dev/bounties/35738a4f-55ce-446c-b836-2fb0b39625f8
CVE: CVE-2021-41191
Published: 2021-10-27
Description: Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add `@require_apikey` in `BOT/lib/cogs/website.py` under the route for `/v1/products`.
CVSS Score: 7.5 (HIGH)
CWE: CWE-116
References: https://github.com/Redon-Tech/Roblox-Purchasing-Hub/commit/58a22260eca40b1a0377daf61ccd8c4dc1440e03; https://github.com/Redon-Tech/Roblox-Purchasing-Hub/releases/tag/V1.0.2; https://github.com/Redon-Tech/Roblox-Purchasing-Hub/security/advisories/GHSA-76mx-6584-4v8q
CVE: CVE-2021-3904
Published: 2021-10-27
Description: grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/getgrav/grav/commit/afc69a3229bb6fe120b2c1ea27bc6f196ed7284d; https://huntr.dev/bounties/b1182515-d911-4da9-b4f7-b4c341a62a8d; https://github.com/getgrav/grav/commit/afc69a3229bb6fe120b2c1ea27bc6f196ed7284d
CVE: CVE-2021-3906
Published: 2021-10-27
Description: bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://github.com/bookstackapp/bookstack/commit/64937ab826b56d086af9ecea532510d37520ebc8; https://huntr.dev/bounties/f115bdf5-c06b-4627-a6fa-ba6904a43ba3; https://github.com/bookstackapp/bookstack/commit/64937ab826b56d086af9ecea532510d37520ebc8
CVE: CVE-2021-43056
Published: 2021-10-28
Description: An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to crash the host, when the host is running on Power8, due to an arch/powerpc/kvm/book3s_hv_rmhandlers.S implementation bug in the handling of the SRR1 register values.
CVSS Score: 5.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/10/28/1; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15; https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
CVE: CVE-2021-43057
Published: 2021-10-28
Description: An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka the SELinux handler for PTRACE_TRACEME) could be used by local attackers to cause memory corruption and escalate privileges, aka CID-a3727a8bac0a. This occurs because of an attempt to access the subjective credentials of another task.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=2229; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.8; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a3727a8bac0a9e77c70820655fd8715523ba3db7
CVE: CVE-2019-19810
Published: 2021-10-28
Description: Zoom Call Recording 6.3.1 from Eleveo is vulnerable to Java Deserialization attacks targeting the inbuilt RMI service. A remote unauthenticated attacker can exploit this vulnerability by sending crafted RMI requests to execute arbitrary code on the target host.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-502
References: https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-19810-Java%20RMI%20Deserialization-ZoomCallRecording; https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-19810-Java%20RMI%20Deserialization-ZoomCallRecording
CVE: CVE-2021-37748
Published: 2021-10-28
Description: Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary code as root via a crafted manage_if setting, thus bypassing the intended restrictions of this shell and taking full control of the device. There are default weak credentials that can be used to authenticate.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.grandstream.com/products/gateways-and-atas/analog-telephone-adaptors/product/ht801; https://github.com/SECFORCE/CVE-2021-37748; https://www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37915/
CVE: CVE-2021-37915
Published: 2021-10-28
Description: An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the malicious gdb_debug_server variable. As a result, after a reboot, the device downloads and executes malicious scripts from an attacker-defined host.
CVSS Score: 8.8 (HIGH)
References: http://firmware.grandstream.com/BETA/Release_Note_HT80x_1.0.29.8.pdf; http://www.grandstream.com/products/gateways-and-atas/analog-telephone-adaptors/product/ht801; https://www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37915/
CVE: CVE-2021-22278
Published: 2021-10-28
Description: A certificate validation vulnerability in PCM600 Update Manager allows attacker to get unwanted software packages to be installed on computer which has PCM600 installed.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://search.abb.com/library/Download.aspx?DocumentID=2NGA001142&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000056&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2NGA001142&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-22401
Published: 2021-10-28
Description: There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/7/; https://consumer.huawei.com/en/support/bulletin/2021/7/
CVE: CVE-2021-22402
Published: 2021-10-28
Description: There is a DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause DoS attacks.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/7/; https://consumer.huawei.com/en/support/bulletin/2021/7/
CVE: CVE-2021-22403
Published: 2021-10-28
Description: There is a vulnerability of hijacking unverified providers in Huawei Smartphone.Successful exploitation of this vulnerability may allow attackers to hijack the device and forge UIs to induce users to execute malicious commands.
CVSS Score: 9.8 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2021/7/; https://consumer.huawei.com/en/support/bulletin/2021/7/
CVE: CVE-2021-22404
Published: 2021-10-28
Description: There is a Directory traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://consumer.huawei.com/en/support/bulletin/2021/7/; https://consumer.huawei.com/en/support/bulletin/2021/7/
CVE: CVE-2021-22405
Published: 2021-10-28
Description: There is a Configuration defects in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/7/; https://consumer.huawei.com/en/support/bulletin/2021/7/
CVE: CVE-2021-22406
Published: 2021-10-28
Description: There is an Uncaught Exception vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the app to exit unexpectedly.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://consumer.huawei.com/en/support/bulletin/2021/7/; https://consumer.huawei.com/en/support/bulletin/2021/7/
CVE: CVE-2021-22407
Published: 2021-10-28
Description: There is a Configuration defects in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.3 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2021/7/; https://consumer.huawei.com/en/support/bulletin/2021/7/
CVE: CVE-2021-22436
Published: 2021-10-28
Description: There is a Logic Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service integrity and availability.
CVSS Score: 9.1 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2021/7/; https://consumer.huawei.com/en/support/bulletin/2021/7/
CVE: CVE-2021-22450
Published: 2021-10-28
Description: A component of the HarmonyOS has a Incomplete Cleanup vulnerability. Local attackers may exploit this vulnerability to cause memory exhaustion.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-459
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22451
Published: 2021-10-28
Description: A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulnerability to cause memory overwriting.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22452
Published: 2021-10-28
Description: A component of the HarmonyOS has a Improper Input Validation vulnerability. Local attackers may exploit this vulnerability to read at any address.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22453
Published: 2021-10-28
Description: A component of the HarmonyOS has a Improper Input Validation vulnerability. Local attackers may exploit this vulnerability to cause nearby process crash.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22454
Published: 2021-10-28
Description: A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to cause core dump.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22455
Published: 2021-10-28
Description: A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulnerability to cause the memory which is not released.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22456
Published: 2021-10-28
Description: A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit this vulnerability to cause Kernel System unavailable.
CVSS Score: 5.5 (MEDIUM)
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22457
Published: 2021-10-28
Description: A component of the HarmonyOS has a Improper Input Validation vulnerability. Local attackers may exploit this vulnerability to cause out-of-bounds write.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22458
Published: 2021-10-28
Description: A component of the HarmonyOS has a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. Local attackers may exploit this vulnerability to cause arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22459
Published: 2021-10-28
Description: A component of the HarmonyOS has a NULL Pointer Dereference vulnerability. Local attackers may exploit this vulnerability to cause System functions which are unavailable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22460
Published: 2021-10-28
Description: A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. Local attackers may exploit this vulnerability to bypass the control mechanism.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-345
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22461
Published: 2021-10-28
Description: A component of the HarmonyOS has a Allocation of Resources Without Limits or Throttling vulnerability. Local attackers may exploit this vulnerability to cause nearby process crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22462
Published: 2021-10-28
Description: A component of the HarmonyOS has a NULL Pointer Dereference vulnerability. Local attackers may exploit this vulnerability to cause kernel crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22463
Published: 2021-10-28
Description: A component of the HarmonyOS has a Use After Free vulnerability . Local attackers may exploit this vulnerability to cause Kernel Information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22464
Published: 2021-10-28
Description: A component of the HarmonyOS has a Out-of-bounds Read vulnerability. Local attackers may exploit this vulnerability to cause system Soft Restart.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]