deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3122
Published: 2024-07-01
Description: CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-23
References: https://www.twcert.org.tw/en/cp-139-7912-4c800-2.html; https://www.twcert.org.tw/tw/cp-132-7911-0962e-1.html; https://www.twcert.org.tw/en/cp-139-7912-4c800-2.html
CVE: CVE-2024-3123
Published: 2024-07-01
Description: CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with  administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-7914-33fbb-2.html; https://www.twcert.org.tw/tw/cp-132-7913-6528e-1.html; https://www.twcert.org.tw/en/cp-139-7914-33fbb-2.html
CVE: CVE-2024-4934
Published: 2024-07-01
Description: The Quiz and Survey Master (QSM)  WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a2270ee1-3211-4b16-b3d7-6cdd732f7155/; https://wpscan.com/vulnerability/a2270ee1-3211-4b16-b3d7-6cdd732f7155/
CVE: CVE-2024-6130
Published: 2024-07-01
Description: The Form Maker by 10Web  WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bbed2968-4bd6-49ae-bd61-8a1f751e7041/; https://wpscan.com/vulnerability/bbed2968-4bd6-49ae-bd61-8a1f751e7041/
CVE: CVE-2024-0153
Published: 2024-07-01
Description: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Valhall GPU Firmware, Arm Ltd Arm 5th Gen GPU Architecture Firmware allows a local non-privileged user to make improper GPU processing operations to access a limited amount outside of buffer bounds. If the operations are carefully prepared, then this in turn could give them access to all system memory. This issue affects Valhall GPU Firmware: from r29p0 through r46p0; Arm 5th Gen GPU Architecture Firmware: from r41p0 through r46p0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2024-39427
Published: 2024-07-01
Description: In trusty service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]77525762; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]77525762
CVE: CVE-2024-39428
Published: 2024-07-01
Description: In trusty service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]77525762; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]77525762
CVE: CVE-2024-39429
Published: 2024-07-01
Description: In faceid servive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]77525762; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]77525762
CVE: CVE-2024-39430
Published: 2024-07-01
Description: In faceid servive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]77525762; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]77525762
CVE: CVE-2024-38987
Published: 2024-07-01
Description: aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/29636943e6989e67f38251580cbcea73; https://github.com/AgeOfLearning/aofl/issues/35; https://gist.github.com/mestrtee/29636943e6989e67f38251580cbcea73
CVE: CVE-2024-38990
Published: 2024-07-01
Description: Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://gist.github.com/mestrtee/ae5f6b0d8f5d7de716e6af6d189b2169; https://gist.github.com/mestrtee/ae5f6b0d8f5d7de716e6af6d189b2169
CVE: CVE-2024-38991
Published: 2024-07-01
Description: akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/8851413e3b33a96f191f0e9c81706532; https://gist.github.com/mestrtee/8851413e3b33a96f191f0e9c81706532
CVE: CVE-2024-38992
Published: 2024-07-01
Description: airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/10c88b[PII_REDACTED]ac7e52e0efc98055; https://gist.github.com/mestrtee/10c88b[PII_REDACTED]ac7e52e0efc98055
CVE: CVE-2024-38993
Published: 2024-07-01
Description: rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/mestrtee/9a2b522d59c53f31f45c1edb96459693; https://gist.github.com/mestrtee/9a2b522d59c53f31f45c1edb96459693
CVE: CVE-2024-38994
Published: 2024-07-01
Description: amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/02091aa86c6c14c29b[PII_REDACTED]dd03; https://gist.github.com/mestrtee/02091aa86c6c14c29b[PII_REDACTED]dd03
CVE: CVE-2024-38996
Published: 2024-07-01
Description: ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa; https://gist.github.com/mestrtee/c[PII_REDACTED]44f25e86ba1bf240844b; https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b
CVE: CVE-2024-38997
Published: 2024-07-01
Description: adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/840f5d160aab4151bd0451cfb822e6b5; https://gist.github.com/mestrtee/840f5d160aab4151bd0451cfb822e6b5
CVE: CVE-2024-38998
Published: 2024-07-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-38999
Published: 2024-07-01
Description: jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a; https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a
CVE: CVE-2024-39000
Published: 2024-07-01
Description: adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/840f5d160aab4151bd0451cfb822e6b5; https://gist.github.com/mestrtee/840f5d160aab4151bd0451cfb822e6b5
CVE: CVE-2024-39001
Published: 2024-07-01
Description: ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa; https://gist.github.com/mestrtee/c[PII_REDACTED]44f25e86ba1bf240844b; https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b
CVE: CVE-2024-39002
Published: 2024-07-01
Description: rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function util.clone. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://gist.github.com/mestrtee/9a2b522d59c53f31f45c1edb96459693; https://gist.github.com/mestrtee/9a2b522d59c53f31f45c1edb96459693
CVE: CVE-2024-39003
Published: 2024-07-01
Description: amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/02091aa86c6c14c29b[PII_REDACTED]dd03; https://gist.github.com/mestrtee/02091aa86c6c14c29b[PII_REDACTED]dd03
CVE: CVE-2024-39008
Published: 2024-07-01
Description: robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/f09a507c8d59fbbb7fd40880cd9b87ed; https://gist.github.com/mestrtee/f09a507c8d59fbbb7fd40880cd9b87ed
CVE: CVE-2024-39013
Published: 2024-07-01
Description: 2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/a2be744675af5ece3240c19fd04fc5e1; https://gist.github.com/mestrtee/a2be744675af5ece3240c19fd04fc5e1
CVE: CVE-2024-39014
Published: 2024-07-01
Description: ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/0501db31c1a6864a169e47097f26ac57; https://gist.github.com/mestrtee/0501db31c1a6864a169e47097f26ac57
CVE: CVE-2024-39015
Published: 2024-07-01
Description: cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/mestrtee/7ab061d9eb901cc89652e7666ca3ef52; https://gist.github.com/mestrtee/7ab061d9eb901cc89652e7666ca3ef52
CVE: CVE-2024-39016
Published: 2024-07-01
Description: che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/865a957857a096221fe6f8b258b282ac; https://gist.github.com/mestrtee/865a957857a096221fe6f8b258b282ac
CVE: CVE-2024-39017
Published: 2024-07-01
Description: agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/mestrtee/039e3e337642e6bb7f36aeddfde41b8b; https://gist.github.com/mestrtee/039e3e337642e6bb7f36aeddfde41b8b
CVE: CVE-2024-39018
Published: 2024-07-01
Description: harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/be75c60307b2292884cc03cebd361f3f; https://gist.github.com/mestrtee/be75c60307b2292884cc03cebd361f3f
CVE: CVE-2024-39853
Published: 2024-07-01
Description: adolph_dudu ratio-swiper 0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/840f5d160aab4151bd0451cfb822e6b5; https://gist.github.com/mestrtee/840f5d160aab4151bd0451cfb822e6b5
CVE: CVE-2024-4007
Published: 2024-07-01
Description: Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1392
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A6101&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A6101&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-6387
Published: 2024-07-01
Description: A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
CVSS Score: 8.1 (HIGH)
CWE: CWE-364, CWE-362
References: https://access.redhat.com/errata/RHSA-2024:4312; https://access.redhat.com/errata/RHSA-2024:4340; https://access.redhat.com/errata/RHSA-2024:4389
CVE: CVE-2024-6424
Published: 2024-07-01
Description: External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated attacker to exploit the endpoint "/api/Proxy/Post?userName=&password=&uri=<FILE|INTERNAL URL|IP/HOST" or "/api/Proxy/Get?userName=&password=&uri=<ARCHIVO|URL INTERNA|IP/HOST" to read the source code of web files, read internal files or access network resources.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-918
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook
CVE: CVE-2024-6425
Published: 2024-07-01
Description: Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route "/account/Register/" and in the parameters "UserName=<RANDOMUSER>&Password=<PASSWORD>&ConfirmPassword=<PASSWORD-REPEAT>".
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-684
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook
CVE: CVE-2024-24749
Published: 2024-07-01
Description: GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer is deployed in the Windows operating system using an Apache Tomcat web application server, it is possible to bypass existing input validation in the GeoWebCache ByteStreamController class and read arbitrary classpath resources with specific file name extensions. If GeoServer is also deployed as a web archive using the data directory embedded in the `geoserver.war` file (rather than an external data directory), it will likely be possible to read specific resources to gain administrator privileges. However, it is very unlikely that production environments will be using the embedded data directory since, depending on how GeoServer is deployed, it will be erased and re-installed (which would also reset to the default password) either every time the server restarts or every time a new GeoServer WAR is installed and is therefore difficult to maintain. An external data directory will always be used if GeoServer is running in standalone mode (via an installer or a binary). Versions 2.23.5 and 2.24.3 contain a patch for the issue. Some workarounds are available. One may change from a Windows environment to a Linux environment; or change from Apache Tomcat to Jetty application server. One may also disable anonymous access to the embeded GeoWebCache administration and status pages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/GeoWebCache/geowebcache/commit/c7f76bd8a1d67c3b986146e7a5e0b14dd64a8fef; https://github.com/GeoWebCache/geowebcache/pull/1211; https://github.com/geoserver/geoserver/security/advisories/GHSA-jhqx-5v5g-mpf3
CVE: CVE-2024-38953
Published: 2024-07-01
Description: phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/qinggan/phpok/issues/17; https://github.com/qinggan/phpok/issues/17
CVE: CVE-2024-6050
Published: 2024-07-01
Description: Improper Neutralization of Input During Web Page Generation vulnerability in SOKRATES-software SOWA OPAC allows a Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. This issue affects SOWA OPAC software in versions from 4.0 before 4.9.10, from 5.0 before 6.2.12.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cert.pl/en/posts/2024/07/CVE-2024-6050/; https://cert.pl/posts/2024/07/CVE-2024-6050/; https://cert.pl/en/posts/2024/07/CVE-2024-6050/
CVE: CVE-2023-43554
Published: 2024-07-01
Description: Memory corruption while processing IOCTL handler in FastRPC.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html
CVE: CVE-2024-21456
Published: 2024-07-01
Description: Information Disclosure while parsing beacon frame in STA.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html
CVE: CVE-2024-21457
Published: 2024-07-01
Description: INformation disclosure while handling Multi-link IE in beacon frame.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html
CVE: CVE-2024-21458
Published: 2024-07-01
Description: Information disclosure while handling SA query action frame.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html
CVE: CVE-2024-21460
Published: 2024-07-01
Description: Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space.
CVSS Score: 7.1 (HIGH)
CWE: CWE-330, CWE-330
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html
CVE: CVE-2024-21461
Published: 2024-07-01
Description: Memory corruption while performing finish HMAC operation when context is freed by keymaster.
CVSS Score: 8.4 (HIGH)
CWE: CWE-415, CWE-415
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html
CVE: CVE-2024-21462
Published: 2024-07-01
Description: Transient DOS while loading the TA ELF file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html
CVE: CVE-2024-21465
Published: 2024-07-01
Description: Memory corruption while processing key blob passed by the user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html
CVE: CVE-2024-21466
Published: 2024-07-01
Description: Information disclosure while parsing sub-IE length during new IE generation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-191, CWE-191
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html
CVE: CVE-2024-21469
Published: 2024-07-01
Description: Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html
CVE: CVE-2024-21482
Published: 2024-07-01
Description: Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html