deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-42737
Published: 2021-11-22
Description: Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/prelude/apsb21-96.html; https://helpx.adobe.com/security/products/prelude/apsb21-96.html
CVE: CVE-2021-42738
Published: 2021-11-22
Description: Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious MXF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/prelude/apsb21-96.html; https://helpx.adobe.com/security/products/prelude/apsb21-96.html
CVE: CVE-2021-43015
Published: 2021-11-22
Description: Adobe InCopy version 16.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious GIF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/incopy/apsb21-110.html; https://helpx.adobe.com/security/products/incopy/apsb21-110.html
CVE: CVE-2021-43016
Published: 2021-11-22
Description: Adobe InCopy version 16.4 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/incopy/apsb21-110.html; https://helpx.adobe.com/security/products/incopy/apsb21-110.html
CVE: CVE-2021-43558
Published: 2021-11-22
Description: A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=2021515; https://moodle.org/mod/forum/discuss.php?d=429097; https://bugzilla.redhat.com/show_bug.cgi?id=2021515
CVE: CVE-2021-43559
Published: 2021-11-22
Description: A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://bugzilla.redhat.com/show_bug.cgi?id=2021517; https://moodle.org/mod/forum/discuss.php?d=429099; https://bugzilla.redhat.com/show_bug.cgi?id=2021517
CVE: CVE-2021-43560
Published: 2021-11-22
Description: A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-668
References: https://bugzilla.redhat.com/show_bug.cgi?id=2021519; https://moodle.org/mod/forum/discuss.php?d=429100; https://bugzilla.redhat.com/show_bug.cgi?id=2021519
CVE: CVE-2019-5640
Published: 2021-11-22
Description: Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the inspect element browser feature to remove the login panel and view the details available in the last webpage visited by previous user
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-200
References: https://docs.rapid7.com/release-notes/nexpose/20211117/; https://docs.rapid7.com/release-notes/nexpose/20211117/
CVE: CVE-2021-23673
Published: 2021-11-22
Description: This affects all versions of package pekeupload. If an attacker induces a user to upload a file whose name contains javascript code, the javascript code will be executed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/moxiecode/plupload/blob/120cc0b5dd3373d7181fd11b06ac2557c890d3f0/js/jquery.plupload.queue/jquery.plupload.queue.js%23L226; https://snyk.io/vuln/SNYK-JS-PEKEUPLOAD-1584360; https://github.com/moxiecode/plupload/blob/120cc0b5dd3373d7181fd11b06ac2557c890d3f0/js/jquery.plupload.queue/jquery.plupload.queue.js%23L226
CVE: CVE-2021-23718
Published: 2021-11-22
Description: The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/welefen/ssrf-agent/blob/cec2b85fe8886ad6926a247a3e059d8369ec022b/index.js%23L13; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://snyk.io/vuln/SNYK-JS-SSRFAGENT-1584362
CVE: CVE-2021-23732
Published: 2021-11-22
Description: This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will be in a position to execute any arbitrary OS commands on the host system.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-78
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://snyk.io/vuln/SNYK-JS-DOCKERCLIJS-1568516; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-38448
Published: 2021-11-22
Description: The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-266-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-266-01
CVE: CVE-2021-42705
Published: 2021-11-22
Description: PLC Editor Versions 1.3.8 and prior is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-315-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-315-01
CVE: CVE-2021-42707
Published: 2021-11-22
Description: PLC Editor Versions 1.3.8 and prior is vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-315-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-315-01
CVE: CVE-2021-44143
Published: 2021-11-22
Description: A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2021/12/03/2; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999804; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CYZ2GNB4ZO2T27D2XNUWMCS3THZYSJQU/
CVE: CVE-2021-32004
Published: 2021-11-22
Description: This issue affects: Secomea GateManager All versions prior to 9.6. Improper Check of host header in web server of Secomea GateManager allows attacker to cause browser cache poisoning.
CVSS Score: 3.7 (LOW)
CWE: CWE-923
References: https://www.secomea.com/support/cybersecurity-advisory/#4578; https://www.secomea.com/support/cybersecurity-advisory/#4578
CVE: CVE-2021-44144
Published: 2021-11-22
Description: Croatia Control Asterix 2.8.1 has a heap-based buffer over-read, with additional details to be disclosed at a later date.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/CroatiaControlLtd/asterix/issues/183; https://github.com/CroatiaControlLtd/asterix/issues/183
CVE: CVE-2021-44147
Published: 2021-11-22
Description: An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://davidhamann.de/2021/11/18/filemaker-xxe-vulnerability/; https://support.claris.com/s/answerview?anum=000035751; https://davidhamann.de/2021/11/18/filemaker-xxe-vulnerability/
CVE: CVE-2021-44150
Published: 2021-11-22
Description: The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://github.com/tusdotnet/tusdotnet/issues/157; https://github.com/tusdotnet/tusdotnet/issues/157
CVE: CVE-2020-22719
Published: 2021-11-22
Description: Shimo Document v2.0.1 contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the table content text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://1drv.ms/u/s%21Ahrd0_3xjLgDhWFRO8bnsAg9I2UQ; https://1drv.ms/u/s%21Ahrd0_3xjLgDhWFRO8bnsAg9I2UQ
CVE: CVE-2021-40828
Published: 2021-11-23
Description: Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-295
References: https://github.com/aws/aws-iot-device-sdk-cpp-v2; https://github.com/aws/aws-iot-device-sdk-java-v2; https://github.com/aws/aws-iot-device-sdk-js-v2
CVE: CVE-2021-40829
Published: 2021-11-23
Description: Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-295
References: https://github.com/aws/aws-iot-device-sdk-cpp-v2; https://github.com/aws/aws-iot-device-sdk-java-v2; https://github.com/aws/aws-iot-device-sdk-js-v2
CVE: CVE-2021-40830
Published: 2021-11-23
Description: The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to override the default trust store. This corrects this issue. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Linux/Unix. Amazon Web Services AWS-C-IO 0.10.4 on Linux/Unix.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-295
References: https://github.com/aws/aws-iot-device-sdk-cpp-v2; https://github.com/aws/aws-iot-device-sdk-java-v2; https://github.com/aws/aws-iot-device-sdk-js-v2
CVE: CVE-2021-40831
Published: 2021-11-23
Description: The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been “overridden”. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to address this behavior. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.7.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.14.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.6.0 on macOS. Amazon Web Services AWS-C-IO 0.10.7 on macOS.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-295
References: https://github.com/aws/aws-iot-device-sdk-cpp-v2; https://github.com/aws/aws-iot-device-sdk-java-v2; https://github.com/aws/aws-iot-device-sdk-js-v2
CVE: CVE-2021-20601
Published: 2021-11-23
Description: Improper input validation vulnerability in GOT2000 series GT27 model all versions, GOT2000 series GT25 model all versions, GOT2000 series GT23 model all versions, GOT2000 series GT21 model all versions, GOT SIMPLE series GS21 model all versions, and GT SoftGOT2000 all versions allows an remote unauthenticated attacker to write a value that exceeds the configured input range limit by sending a malicious packet to rewrite the device value. As a result, the system operation may be affected, such as malfunction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://jvn.jp/vu/JVNVU98072504; https://us-cert.cisa.gov/ics/advisories/icsa-21-320-02; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2021-018.pdf
CVE: CVE-2021-22410
Published: 2021-11-23
Description: There is a XSS injection vulnerability in iMaster NCE-Fabric V100R019C10. A module of the client does not verify the input sufficiently. Attackers can exploit this vulnerability by modifying input after logging onto the client. This may compromise the normal service of the client.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210324-01-xss-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210324-01-xss-en
CVE: CVE-2021-37036
Published: 2021-11-23
Description: There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10. Due to the improperly storage of specific information in the log file, the attacker can obtain the information when a user logs in to the device. Successful exploit may cause the information leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210818-01-informationleak-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210818-01-informationleak-en
CVE: CVE-2021-39976
Published: 2021-11-23
Description: There is a privilege escalation vulnerability in CloudEngine 5800 V200R020C00SPC600. Due to lack of privilege restrictions, an authenticated local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege.
CVSS Score: 7.8 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211103-01-privilege-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211103-01-privilege-en
CVE: CVE-2021-22356
Published: 2021-11-23
Description: There is a weak secure algorithm vulnerability in Huawei products. A weak secure algorithm is used in a module. Attackers can exploit this vulnerability by capturing and analyzing the messages between devices to obtain information. This can lead to information leak.Affected product versions include: IPS Module V500R005C00SPC100, V500R005C00SPC200; NGFW Module V500R005C00SPC100, V500R005C00SPC200; Secospace USG6300 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200; Secospace USG6500 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200; Secospace USG6600 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200; USG9500 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210512-01-infomationleak-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210512-01-infomationleak-en
CVE: CVE-2021-35052
Published: 2021-11-23
Description: A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121; https://www.zerodayinitiative.com/advisories/ZDI-21-1335/; https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121
CVE: CVE-2021-37003
Published: 2021-11-23
Description: There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37004
Published: 2021-11-23
Description: There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37005
Published: 2021-11-23
Description: There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37006
Published: 2021-11-23
Description: There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the confidentiality of users is affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37007
Published: 2021-11-23
Description: There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37008
Published: 2021-11-23
Description: There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37009
Published: 2021-11-23
Description: There is a Configuration vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the confidentiality of users is affected.
CVSS Score: 7.5 (HIGH)
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37010
Published: 2021-11-23
Description: There is a Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the confidentiality of users is affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37012
Published: 2021-11-23
Description: There is a Data Processing Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.
CVSS Score: 7.5 (HIGH)
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37013
Published: 2021-11-23
Description: There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the availability of users is affected.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37015
Published: 2021-11-23
Description: There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]