CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6045 – Arkruntime has a type confusion vulnerability
https://notcve.org/view.php?id=CVE-2023-6045
20 Nov 2023 — in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through type confusion. En OpenHarmony v3.2.2 y versiones anteriores permiten que un atacante local ejecute código arbitrario en aplicaciones preinstaladas mediante confusión de tipos. • https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46705 – Arkruntime has a type confusion vulnerability
https://notcve.org/view.php?id=CVE-2023-46705
20 Nov 2023 — in OpenHarmony v3.2.2 and prior versions allow a local attacker causes system information leak through type confusion. En OpenHarmony v3.2.2 y versiones anteriores permiten que un atacante local provoque una fuga de información del sistema a través de confusión de tipos. • https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-43612 – Hiview has an improper preservation of permissions vulnerability
https://notcve.org/view.php?id=CVE-2023-43612
20 Nov 2023 — in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions. En OpenHarmony v3.2.2 y versiones anteriores permiten que un atacante local lea y escriba archivos arbitrarios mediante la preservación inadecuada de los permisos. • https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md • CWE-281: Improper Preservation of Permissions •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-3116 – Liteos-A has a incorrect default permissions vulnerability
https://notcve.org/view.php?id=CVE-2023-3116
20 Nov 2023 — in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file through incorrect default permissions. En OpenHarmony v3.2.2 y versiones anteriores permiten que un atacante local obtenga información confidencial o reescriba archivos confidenciales mediante permisos predeterminados incorrectos. • https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md • CWE-276: Incorrect Default Permissions •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4753 – OpenHarmony v3.2.1 and prior version has a system call function usage error
https://notcve.org/view.php?id=CVE-2023-4753
21 Sep 2023 — OpenHarmony v3.2.1 and prior version has a system call function usage error. Local attackers can crash kernel by the error input. OpenHarmony v3.2.1 y versiones anteriores tienen un error de uso de la función de llamada al sistema. Los atacantes locales pueden bloquear el kernel debido a la entrada de error. • https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-11.md • CWE-20: Improper Input Validation •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25947 – The bundle management subsystem has a improper input validation when installing a HAP package.
https://notcve.org/view.php?id=CVE-2023-25947
10 Mar 2023 — The bundle management subsystem within OpenHarmony-v3.1.4 and prior versions has a null pointer reference vulnerability which local attackers can exploit this vulnerability to cause a DoS attack to the system when installing a malicious HAP package. The bundle management subsystem within OpenHarmony-v3.1.4 and prior versions has a null pointer reference vulnerability which local attackers can exploit this vulnerability to cause a DoS attack to the system when installing a malicious HAP package. • https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2023/2023-03.md • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-24465 – Communication Wi-Fi subsystem has a null pointer reference vulnerability when receving external data.
https://notcve.org/view.php?id=CVE-2023-24465
10 Mar 2023 — Communication Wi-Fi subsystem within OpenHarmony-v3.1.4 and prior versions, OpenHarmony-v3.0.7 and prior versions has a null pointer reference vulnerability which local attackers can exploit this vulnerability to cause the current application to crash. Communication Wi-Fi subsystem within OpenHarmony-v3.1.4 and prior versions, OpenHarmony-v3.0.7 and prior versions has a null pointer reference vulnerability which local attackers can exploit this vulnerability to cause the current application to crash. • https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2023/2023-03.md • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22436 – The kernel subsystem function check_permission_for_set_tokenid has an UAF vulnerability.
https://notcve.org/view.php?id=CVE-2023-22436
10 Mar 2023 — The kernel subsystem function check_permission_for_set_tokenid within OpenHarmony-v3.1.5 and prior versions has an UAF vulnerability which local attackers can exploit this vulnerability to escalate the privilege to root. The kernel subsystem function check_permission_for_set_tokenid within OpenHarmony-v3.1.5 and prior versions has an UAF vulnerability which local attackers can exploit this vulnerability to escalate the privilege to root. • https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2023/2023-02.md • CWE-190: Integer Overflow or Wraparound CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22301 – The kernel subsystem hmdfs has a arbitrary memory accessing vulnerability.
https://notcve.org/view.php?id=CVE-2023-22301
10 Mar 2023 — The kernel subsystem hmdfs within OpenHarmony-v3.1.5 and prior versions has an arbitrary memory accessing vulnerability which network attackers can launch a remote attack to obtain kernel memory data of the target system. The kernel subsystem hmdfs within OpenHarmony-v3.1.5 and prior versions has an arbitrary memory accessing vulnerability which network attackers can launch a remote attack to obtain kernel memory data of the target system. • https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2023/2023-02.md • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-0083 – The ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access.
https://notcve.org/view.php?id=CVE-2023-0083
10 Mar 2023 — The ArKUI framework subsystem within OpenHarmony-v3.1.5 and prior versions, OpenHarmony-v3.0.7 and prior versions has an Improper Input Validation vulnerability which local attackers can exploit this vulnerability to send malicious data, causing the current application to crash. • https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2023/2023-02.md • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •