deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-34359
Published: 2022-02-25
Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy Server 1.4.2 ( 2021/12/30 ) and later
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-22-04; https://www.qnap.com/en/security-advisory/qsa-22-04
CVE: CVE-2021-34361
Published: 2022-02-25
Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy Server 1.4.2 ( 2021/12/30 ) and later
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-22-04; https://www.qnap.com/en/security-advisory/qsa-22-04
CVE: CVE-2021-45229
Published: 2022-02-25
Description: It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk; https://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk
CVE: CVE-2022-0746
Published: 2022-02-25
Description: Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-840
References: https://github.com/dolibarr/dolibarr/commit/[PII_REDACTED]d51ad76b7c1a4141ec7a33053a7d21; https://huntr.dev/bounties/b812ea22-0c02-46fe-b89f-04519dfb1ebd; https://github.com/dolibarr/dolibarr/commit/[PII_REDACTED]d51ad76b7c1a4141ec7a33053a7d21
CVE: CVE-2022-24288
Published: 2022-02-25
Description: In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t; https://lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t
CVE: CVE-2022-24947
Published: 2022-02-25
Description: Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/02/25/1; https://lists.apache.org/thread/txrgykjkpt80t57kzpbjo8kfrv8ss02c; http://www.openwall.com/lists/oss-security/2022/02/25/1
CVE: CVE-2022-24948
Published: 2022-02-25
Description: A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.2 or later.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/02/25/2; https://lists.apache.org/thread/86p0yzopc4mw2h5bkwpt927b2c8tfq3b; http://www.openwall.com/lists/oss-security/2022/02/25/2
CVE: CVE-2022-0247
Published: 2022-02-25
Description: An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they do not have permission to. We recommend upgrading past commit d97c05d2301799ed585620a9c5c739d36e7b5d3d or any of the listed versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732, CWE-732
References: https://fuchsia.googlesource.com/fuchsia/+/d97c05d2301799ed585620a9c5c739d36e7b5d3d; https://fuchsia.googlesource.com/fuchsia/+/d97c05d2301799ed585620a9c5c739d36e7b5d3d
CVE: CVE-2022-25326
Published: 2022-02-25
Description: fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/google/fscrypt/pull/346; https://github.com/google/fscrypt/pull/346
CVE: CVE-2022-25327
Published: 2022-02-25
Description: The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-255, CWE-276
References: https://github.com/google/fscrypt/pull/346; https://github.com/google/fscrypt/pull/346
CVE: CVE-2022-25328
Published: 2022-02-25
Description: The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to version 0.3.3 or above
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://github.com/google/fscrypt/pull/346; https://github.com/google/fscrypt/pull/346
CVE: CVE-2022-24594
Published: 2022-02-25
Description: In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/walinejs/waline/discussions/792; https://github.com/walinejs/waline/issues/785; https://github.com/walinejs/waline/discussions/792
CVE: CVE-2022-24612
Published: 2022-02-25
Description: An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11, resulting in a stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/EyesOfNetworkCommunity/eonweb/issues/114; https://github.com/EyesOfNetworkCommunity/eonweb/issues/114
CVE: CVE-2022-25374
Published: 2022-02-25
Description: HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensitive data. Fixed in v202202-1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://discuss.hashicorp.com; https://discuss.hashicorp.com/t/hcsec-2022-06-terraform-enterprise-may-capture-sensitive-data-in-logs/; https://discuss.hashicorp.com
CVE: CVE-2021-45977
Published: 2022-02-25
Description: JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021.3.1 RC, RubyMine 2021.3.1 Preview, RubyMine 2021.3.1 RC, CLion 2021.3.1, WebStorm 2021.3.1 Preview, and WebStorm 2021.3.1 RC (used as Remote Development backend IDEs) bind to the 0.0.0.0 IP address. The fixed versions are: IntelliJ IDEA 2021.3.1, PyCharm Professional 2021.3.1, GoLand 2021.3.2, PhpStorm 2021.3.1 (213.6461.83), RubyMine 2021.3.1, CLion 2021.3.2, and WebStorm 2021.3.1.
CVSS Score: 9.8 (CRITICAL)
References: https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/
CVE: CVE-2022-24327
Published: 2022-02-25
Description: In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24328
Published: 2022-02-25
Description: In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.
CVSS Score: 6.5 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24329
Published: 2022-02-25
Description: In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-829
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2022-24330
Published: 2022-02-25
Description: In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24331
Published: 2022-02-25
Description: In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.
CVSS Score: 9.8 (CRITICAL)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24332
Published: 2022-02-25
Description: In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-613
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24333
Published: 2022-02-25
Description: In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24334
Published: 2022-02-25
Description: In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24335
Published: 2022-02-25
Description: JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC.
CVSS Score: 8.1 (HIGH)
CWE: CWE-367
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24336
Published: 2022-02-25
Description: In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24337
Published: 2022-02-25
Description: In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24338
Published: 2022-02-25
Description: JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24339
Published: 2022-02-25
Description: JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24340
Published: 2022-02-25
Description: In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24341
Published: 2022-02-25
Description: In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-613
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24342
Published: 2022-02-25
Description: In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24343
Published: 2022-02-25
Description: In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24344
Published: 2022-02-25
Description: JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24345
Published: 2022-02-25
Description: In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a project was possible.
CVSS Score: 7.8 (HIGH)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24346
Published: 2022-02-25
Description: In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible.
CVSS Score: 7.8 (HIGH)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2022-24347
Published: 2022-02-25
Description: JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/; https://blog.jetbrains.com
CVE: CVE-2021-38993
Published: 2022-02-25
Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the smbcd daemon to cause a denial of service. IBM X-Force ID: 212962.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212962; https://www.ibm.com/support/pages/node/6559320; https://exchange.xforce.ibmcloud.com/vulnerabilities/212962
CVE: CVE-2021-22319
Published: 2022-02-25
Description: There is an improper verification vulnerability in smartphones. Successful exploitation of this vulnerability may cause integer overflows.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://consumer.huawei.com/en/support/bulletin/2021/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202109-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/10/
CVE: CVE-2021-22394
Published: 2022-02-25
Description: There is a buffer overflow vulnerability in smartphones. Successful exploitation of this vulnerability may cause DoS of the apps during Multi-Screen Collaboration.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2021/7/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202108-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/7/
CVE: CVE-2021-22395
Published: 2022-02-25
Description: There is a code injection vulnerability in smartphones. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://consumer.huawei.com/en/support/bulletin/2021/7/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202108-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/7/
CVE: CVE-2021-22426
Published: 2022-02-25
Description: There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202107-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22429
Published: 2022-02-25
Description: There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202107-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22430
Published: 2022-02-25
Description: There is a logic bypass vulnerability in smartphones. Successful exploitation of this vulnerability may cause code injection.
CVSS Score: 9.8 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202107-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22431
Published: 2022-02-25
Description: There is a vulnerability when configuring permission isolation in smartphones. Successful exploitation of this vulnerability may cause out-of-bounds access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202107-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22432
Published: 2022-02-25
Description: There is a vulnerability when configuring permission isolation in smartphones. Successful exploitation of this vulnerability may cause out-of-bounds access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202107-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22433
Published: 2022-02-25
Description: There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202107-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22434
Published: 2022-02-25
Description: There is a memory address out of bounds vulnerability in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202107-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22437
Published: 2022-02-25
Description: There is a software integer overflow leading to a TOCTOU condition in smartphones. Successful exploitation of this vulnerability may cause random address access.
CVSS Score: 7.0 (HIGH)
CWE: CWE-190
References: https://consumer.huawei.com/en/support/bulletin/2021/9/; https://consumer.huawei.com/en/support/bulletin/2021/9/
CVE: CVE-2021-22441
Published: 2022-02-25
Description: Some Huawei products have an integer overflow vulnerability. Successful exploitation of this vulnerability may lead to kernel crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-22448
Published: 2022-02-25
Description: There is an improper verification vulnerability in smartphones. Successful exploitation of this vulnerability may cause unauthorized read and write of some files.
CVSS Score: 9.1 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22478
Published: 2022-02-25
Description: The interface of a certain HarmonyOS module has a UAF vulnerability. Successful exploitation of this vulnerability may lead to information leakage.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]
CVE: CVE-2021-22479
Published: 2022-02-25
Description: The interface of a certain HarmonyOS module has an invalid address access vulnerability. Successful exploitation of this vulnerability may lead to kernel crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]
CVE: CVE-2021-22480
Published: 2022-02-25
Description: The interface of a certain HarmonyOS module has an integer overflow vulnerability. Successful exploitation of this vulnerability may lead to heap memory overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-[PII_REDACTED]
CVE: CVE-2021-22489
Published: 2022-02-25
Description: There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service availability.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202108-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/10/
CVE: CVE-2021-26617
Published: 2022-02-25
Description: This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to execute malicious code in Firstmall via navercheckout_add function.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36469; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36469
CVE: CVE-2021-37027
Published: 2022-02-25
Description: There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service integrity.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/7/; https://consumer.huawei.com/en/support/bulletin/2021/9/; https://consumer.huawei.com/en/support/bulletin/2021/7/
CVE: CVE-2021-37103
Published: 2022-02-25
Description: There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2021/10/; https://consumer.huawei.com/en/support/bulletin/2021/10/