Huawei Harmonyos vulnerabilities

CVE-2023-39404 [HIGH] CWE-20 CVE-2023-39404: Vulnerability of input parameter verification in certain APIs in the window management module. Succe Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerability may cause the device to restart.

CVE-2023-39406 [HIGH] CWE-264 CVE-2023-39406: Permission control vulnerability in the XLayout component. Successful exploitation of this vulnerabi Permission control vulnerability in the XLayout component. Successful exploitation of this vulnerability may cause apps to forcibly restart.

CVE-2023-37241 [HIGH] CWE-20 CVE-2023-37241: Input verification vulnerability in the WMS API. Successful exploitation of this vulnerability may c Input verification vulnerability in the WMS API. Successful exploitation of this vulnerability may cause the device to restart.

CVE-2022-48517 [HIGH] CWE-701 CVE-2022-48517: Unauthorized service access vulnerability in the DSoftBus module. Successful exploitation of this vu Unauthorized service access vulnerability in the DSoftBus module. Successful exploitation of this vulnerability will affect availability.

CVE-2023-46757 [HIGH] CWE-200 CVE-2023-46757: The remote PIN module has a vulnerability that causes incorrect information storage locations.Succes The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation of this vulnerability may affect confidentiality.

CVE-2022-46321 [HIGH] CVE-2022-46321: The Wi-Fi module has a vulnerability in permission verification. Successful exploitation of this vul The Wi-Fi module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2022-48347 [HIGH] CWE-200 CVE-2022-48347: The MediaProvider module has a vulnerability in permission verification. Successful exploitation of The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiality.

CVE-2023-49247 [HIGH] CWE-295 CVE-2023-49247: Permission verification vulnerability in distributed scenarios. Successful exploitation of this vuln Permission verification vulnerability in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-44114 [HIGH] CWE-125 CVE-2023-44114: Out-of-bounds array vulnerability in the dataipa module.Successful exploitation of this vulnerabilit Out-of-bounds array vulnerability in the dataipa module.Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-44103 [HIGH] CWE-20 CVE-2023-44103: Out-of-bounds read vulnerability in the Bluetooth module.Successful exploitation of this vulnerabili Out-of-bounds read vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-39380 [HIGH] CWE-264 CVE-2023-39380: Permission control vulnerability in the audio module. Successful exploitation of this vulnerability Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause audio devices to perform abnormally.

CVE-2021-46868 [HIGH] CWE-125 CVE-2021-46868: The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerabil The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory access.

CVE-2021-46867 [HIGH] CWE-125 CVE-2021-46867: The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerabil The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory access.

CVE-2023-44109 [HIGH] CWE-74 CVE-2023-44109: Clone vulnerability in the huks ta module.Successful exploitation of this vulnerability may affect s Clone vulnerability in the huks ta module.Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-52110 [HIGH] CWE-787 CVE-2023-52110: The sensor module has an out-of-bounds access vulnerability.Successful exploitation of this vulnerab The sensor module has an out-of-bounds access vulnerability.Successful exploitation of this vulnerability may affect availability.

CVE-2023-1694 [HIGH] CWE-269 CVE-2023-1694: The Settings module has the file privilege escalation vulnerability.Successful exploitation of this The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality.

CVE-2023-1692 [HIGH] CWE-732 CVE-2023-1692: The window management module lacks permission verification.Successful exploitation of this vulnerabi The window management module lacks permission verification.Successful exploitation of this vulnerability may affect confidentiality.

CVE-2023-1693 [HIGH] CWE-269 CVE-2023-1693: The Settings module has the file privilege escalation vulnerability.Successful exploitation of this The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality.

CVE-2022-48286 [HIGH] CWE-269 CVE-2022-48286: The multi-screen collaboration module has a privilege escalation vulnerability. Successful exploitat The multi-screen collaboration module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2023-31226 [HIGH] CWE-863 CVE-2023-31226: The SDK for the MediaPlaybackController module has improper permission verification. Successful expl The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vulnerability may affect confidentiality.