CVE Vulnerability Catalog

Permission control vulnerability in the autofill service module. Successful exploitation of this vulnerability may affect service confidentiality.

An out-of-bounds read (OOB read) vulnerability was found in the peripheral module. Successful exploitation may affect service confidentiality.

A use-after-free (UAF) vulnerability was found in the location service module. Successful exploitation may affect service availability.

A race condition vulnerability was found in the location service module. Successful exploitation may affect service availability.

A permission control vulnerability was found in the WLAN module. Successful exploitation may affect service confidentiality.

A Denial of Service (DoS) vulnerability was found in the file parsing module. Successful exploitation may affect service availability.

A buffer overflow vulnerability exists in the file preview module. Successful exploitation of this vulnerability may affect availability.

A null pointer dereference vulnerability exists in the ArkWeb module. Successful exploitation of this vulnerability may affect availability.

A DoS vulnerability exists in the DSoftBus module. Successful exploitation of this vulnerability may affect availability.

A DoS vulnerability exists in the DSoftBus module. Successful exploitation of this vulnerability may affect availability.

A permission control vulnerability exists in the graphics module. Successful exploitation of this vulnerability may affect confidentiality.

A DoS vulnerability exists in the file parsing module. Successful exploitation of this vulnerability may affect availability.

The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. The lock condition is only applied to the secondary user store account, allowing continued authentication attempts against the primary user store account. This flaw enables brute force attacks.

A flaw was found in the CloudClassroom-PHP-Project in an unknown function of manageassessment2.php. Manipulating the ExamName/Q1/Q2/Q3/Q4/Q5 arguments causes cross-site scripting, and the attack can be carried out remotely. The exploit has been published and may be used; the vendor did not respond to the disclosure.

A cross-site scripting vulnerability was found in the mathurvishal CloudClassroom-PHP-Project in the file updatedetailsfromfaculty.php due to manipulation of the fname argument. The attack can be launched remotely and a public exploit is already available.

In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.

In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.

In Modem, there is a possible way (for XXX) to XXXXX due to an integer overflow. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.

In Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.