Openharmony
Page 2 of 2 — Openharmony CVEs from a corpus of 177, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38386 | High | 8.4 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. |
CVE-2024-38382 | Medium | 5.5 | 2024-09-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2024-28044 | Low | 3.3 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause crash through integer overflow. |
CVE-2024-37185 | High | 8.2 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write. |
CVE-2024-37077 | High | 8.2 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write. |
CVE-2024-37030 | High | 8.2 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through use after free. |
CVE-2024-36278 | Low | 3.3 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2024-36260 | High | 8.2 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write. |
CVE-2024-36243 | High | 8.2 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds read and write. |
CVE-2024-31071 | Low | 3.3 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2024-3759 | Medium | 6.5 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in TCB through use after free. |
CVE-2024-3758 | Medium | 6.5 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in TCB through heap buffer overflow. |
CVE-2024-3757 | Low | 3.3 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause service crash through integer overflow. |
CVE-2024-31078 | Low | 3.3 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause service crash through NULL pointer dereference. |
CVE-2024-27217 | Medium | 6.5 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. |
CVE-2024-23808 | Medium | 5.2 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free or cause DOS through NULL… |
CVE-2024-29086 | Low | 3.3 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause DOS through stack overflow. |
CVE-2024-29074 | Medium | 6.5 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through improper input. |
CVE-2024-28951 | Medium | 5.5 | 2024-04-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. |
CVE-2024-28226 | High | 8.1 | 2024-04-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker cause DOS through improper input. |
CVE-2024-24581 | Medium | 6.5 | 2024-04-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution through out-of-bounds write. |
CVE-2024-22180 | Low | 3.3 | 2024-04-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through use after free. |
CVE-2024-22177 | Low | 3.3 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through get permission. |
CVE-2024-22098 | Medium | 6.5 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after free. |
CVE-2024-22092 | High | 7.7 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a remote attacker bypass permission verification to install apps, although these require user action. |
CVE-2024-21834 | Low | 3.3 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2024-21826 | Medium | 4.3 | 2024-03-04 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause sensitive information leak through insecure storage. |
CVE-2024-21816 | Medium | 4.0 | 2024-03-04 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through improper preservation of permissions. |
CVE-2023-49602 | Low | 2.9 | 2024-03-04 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2023-46708 | Medium | 4.3 | 2024-03-04 | in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after free. |
CVE-2023-25176 | Low | 2.9 | 2024-03-04 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2024-21863 | Medium | 4.7 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2024-21860 | High | 8.2 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow an adjacent attacker arbitrary code execution in any apps through use after free. |
CVE-2024-21851 | Low | 2.9 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause heap overflow through integer overflow. |
CVE-2024-21845 | Low | 2.9 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause heap overflow through integer overflow. |
CVE-2024-0285 | Medium | 4.7 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2023-49118 | Low | 2.9 | 2024-02-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker causes information leak through out-of-bounds Read. |
CVE-2023-45734 | Medium | 4.2 | 2024-02-02 | in OpenHarmony v3.2.4 and prior versions allow an adjacent attacker arbitrary code execution through out-of-bounds write. |
CVE-2023-43756 | Low | 2.9 | 2024-02-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker causes information leak through out-of-bounds Read. |
CVE-2023-49142 | Medium | 4.0 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia audio crash through modify a released pointer. |
CVE-2023-49135 | Medium | 4.0 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer. |
CVE-2023-48360 | Medium | 4.0 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer. |
CVE-2023-47857 | Medium | 4.0 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia camera crash through modify a released pointer. |
CVE-2023-47216 | Low | 2.9 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through occupy all resources |
CVE-2023-6045 | Medium | 5.9 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through type confusion. |
CVE-2023-47217 | Medium | 4.0 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through buffer overflow. |
CVE-2023-46705 | Medium | 6.2 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker causes system information leak through type confusion. |
CVE-2023-46100 | Medium | 6.2 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource. |
CVE-2023-43612 | High | 8.4 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions. |
CVE-2023-42774 | Medium | 6.2 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through incorrect default permissions. |
CVE-2023-3116 | High | 7.3 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file through incorrect default permissions. |
CVE-2023-4753 | Low | 3.9 | 2023-09-21 | OpenHarmony v3.2.1 and prior version has a system call function usage error. Local attackers can crash kernel by the error input. |
CVE-2023-25947 | Medium | 6.2 | 2023-03-10 | The bundle management subsystem within OpenHarmony-v3.1.4 and prior versions has a null pointer reference vulnerability which local attackers can exploit this… |
CVE-2023-24465 | Medium | 5.5 | 2023-03-10 | Communication Wi-Fi subsystem within OpenHarmony-v3.1.4 and prior versions, OpenHarmony-v3.0.7 and prior versions has a null pointer reference vulnerability w… |
CVE-2023-22436 | High | 7.8 | 2023-03-10 | The kernel subsystem function check_permission_for_set_tokenid within OpenHarmony-v3.1.5 and prior versions has an UAF vulnerability which local attackers ca… |
CVE-2023-22301 | Medium | 6.5 | 2023-03-10 | The kernel subsystem hmdfs within OpenHarmony-v3.1.5 and prior versions has an arbitrary memory accessing vulnerability which network attackers can launch a… |
CVE-2023-0083 | Medium | 4.0 | 2023-03-10 | The ArKUI framework subsystem within OpenHarmony-v3.1.5 and prior versions, OpenHarmony-v3.0.7 and prior versions has an Improper Input Validation vulnerabi… |
CVE-2023-0036 | Medium | 6.5 | 2023-01-09 | platform_callback_stub in misc subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay atta… |
CVE-2023-0035 | Medium | 6.5 | 2023-01-09 | softbus_client_stub in communication subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA rela… |
CVE-2022-45126 | Medium | 4.0 | 2023-01-09 | Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGettime. 4 bytes p… |
CVE-2022-43662 | Medium | 4.0 | 2023-01-09 | Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysTimerGettime. 4 bytes p… |
CVE-2022-45877 | High | 8.3 | 2022-12-08 | OpenHarmony-v3.1.4 and prior versions had an vulnerability. PIN code is transmitted to the peer device in plain text during cross-device authentication, which… |
CVE-2022-45118 | Medium | 6.2 | 2022-12-08 | OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission… |
CVE-2022-44455 | Medium | 6.8 | 2022-12-08 | The appspawn and nwebspawn services within OpenHarmony-v3.1.2 and prior versions were found to be vulnerable to buffer overflow vulnerability due to insufficie… |
CVE-2022-41802 | Medium | 4.0 | 2022-12-08 | Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres. 4 bytes pa… |
CVE-2022-43495 | Medium | 6.5 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had a DOS vulnerability in distributedhardware_device_manager when joining a network. Network attakcers can send an abono… |
CVE-2022-43451 | High | 8.4 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary dir… |
CVE-2022-43449 | Medium | 6.2 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had an Arbitrary file read vulnerability via download_server. Local attackers can install an malicious application on the… |
CVE-2022-42488 | High | 8.4 | 2022-10-14 | OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application instal… |
CVE-2022-42464 | Medium | 6.7 | 2022-10-14 | OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have a Kernel memory pool override vulnerability in /dev/mmz_userdev device driver. The impact… |
CVE-2022-42463 | High | 8.3 | 2022-10-14 | OpenHarmony-v3.1.2 and prior versions have an authenication bypass vulnerability in a callback handler function of Softbus_server in communication subsystem. A… |
CVE-2022-41686 | Medium | 5.1 | 2022-10-14 | OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have an Out-of-bound memory read and write vulnerability in /dev/mmz_userdev device driver. The… |
CVE-2022-38701 | Medium | 6.2 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information. |
CVE-2022-38700 | High | 8.8 | 2022-09-09 | OpenHarmony-v3.1.1 and prior versions have a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service. |
CVE-2022-38081 | Medium | 6.2 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of… |
CVE-2022-38064 | Medium | 6.2 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information. |
CVE-2022-36423 | High | 7.4 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have an incorrect configuration of the cJSON library, which leads a Stack overflow vulnerability during recursive parsing… |