Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality.
AFFECTED_PRODUCTS:
Huawei Harmonyos
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate payload size in ipc response
If installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc
response to ksmbd kernel server. ksmbd should validate payload size of
ipc response from ksmbd.mountd to avoid m...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel
Out-of-bounds write vulnerability in the RSMC module.
Impact: Successful exploitation of this vulnerability will affect availability.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Harmonyos,
Huawei Harmonyos
... (+1)
Out-of-bounds write vulnerability in the RSMC module.
Impact: Successful exploitation of this vulnerability will affect availability.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Harmonyos,
Huawei Harmonyos
... (+1)
Vulnerability of input parameters being not strictly verified in the RSMC module.
Impact: Successful exploitation of this vulnerability may cause out-of-bounds write.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Harmonyos,
Huawei Harmonyos
... (+1)
Missing Authorization vulnerability in Saleswonder.Biz Team WP2LEADS.This issue affects WP2LEADS: from n/a through 3.2.7.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 1.5.2.
RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accounts. Attackers could perform malicious API requests or extract information from the users account. Pl...
Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accou...
Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Atta...
Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to the users account, access to another account within the same context or an successful social engineering at...
Permission control vulnerability in the Bluetooth module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Race condition vulnerability in the Wi-Fi module.
Impact: Successful exploitation of this vulnerability will affect availability.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Input verification vulnerability in the power module.
Impact: Successful exploitation of this vulnerability will affect availability.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Harmonyos,
Huawei Harmonyos
... (+2)
Vulnerability of data verification errors in the kernel module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Vulnerability of data verification errors in the kernel module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Vulnerability of data verification errors in the kernel module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Vulnerability of package name verification being bypassed in the Calendar app.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Harmonyos,
Huawei Harmonyos
Vulnerability of undefined permissions in the Calendar app.
Impact: Successful exploitation of this vulnerability will affect availability.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Harmonyos,
Huawei Harmonyos
... (+1)
Vulnerability of file path verification being bypassed in the email module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Permission verification vulnerability in the system module.
Impact: Successful exploitation of this vulnerability will affect availability.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Permission verification vulnerability in the system module.
Impact: Successful exploitation of this vulnerability will affect availability.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Authentication vulnerability in the API for app pre-loading.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+3)
Vulnerability of improper authentication in the Iaware module.
Impact: Successful exploitation of this vulnerability will affect availability.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Permission verification vulnerability in the Settings module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Vulnerability of package name verification being bypassed in the HwIms module.
Impact: Successful exploitation of this vulnerability will affect availability.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Vulnerability of package name verification being bypassed in the HwIms module.
Impact: Successful exploitation of this vulnerability will affect availability.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Permission control vulnerability in the clock module.
Impact: Successful exploitation of this vulnerability will affect availability.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Vulnerability of permission verification in some APIs in the ActivityTaskManagerService module.
Impact: Successful exploitation of this vulnerability will affect availability.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Harmonyos
... (+4)
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
An issue was discovered in CandyCMS version 1.0.0, allows remote attackers to execute arbitrary code via the install.php component.
AFFECTED_PRODUCTS:
Steve228Uk Candycms
Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sensitive information. The application system enables the http API interface by default and uses the secret parameter method to authenticate the http restful api i...
The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users
AFFECTED_PRODUCTS:
Wpb Show Core Project Wpb Show Core
The wpb-show-core WordPress plugin before 2.7 does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated request, leading to a Reflected Cross-Site Scripting
AFFECTED_PRODUCTS:
Wpb Show Core Project Wpb Show Core
The Font Farsi WordPress plugin through 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
AFFECTED_PRODUCTS:
Persian-Vc Font Farsi
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
AFFECTED_PRODUCTS:
Pressified Sendpress
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
AFFECTED_PRODUCTS:
Pressified Sendpress
The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
AFFECTED_PRODUCTS:
Wpb Show Core Project Wpb Show Core
In camera driver, there is a possible use after free due to a logic error. This could lead to local denial of service with System execution privileges needed
AFFECTED_PRODUCTS:
Google Android,
Google Android,
Google Android
In faceid service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
AFFECTED_PRODUCTS:
Google Android,
Google Android,
Google Android
In vsp driver, there is a possible missing verification incorrect input. This could lead to local denial of service with no additional execution privileges needed
AFFECTED_PRODUCTS:
Google Android,
Google Android