PYSEC-2021-12

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to...

CVE-2021-21419

CVE-2021-21419 affects the Python Eventlet library. A malicious websocket peer can exhaust Eventlet memory by sending very large frames or highly compressed data frames. A fix was released in version 0.31.0 that restricts websocket frame sizes to reasonable limits. Workarounds like OS-level memor...

CVE-2020-11293

Out of bound read can happen in Widevine TA while copying data to buffer from user data due to lack of check of buffer length received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon...

CVE-2021-1925

Possible denial of service scenario due to improper handling of group management action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &...

CVE-2021-1927

Possible use after free due to lack of null check while memory is being freed in FastRPC driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired...

CVE-2020-11289

Out of bound write can occur in TZ command handler due to lack of validation of command ID in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables,...

CVE-2021-1891

A possible use-after-free occurrence in audio driver can happen when pointers are not properly handled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon...

Design/Logic Flaw

Possible use after free due to lack of null check while memory is being freed in FastRPC driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired...

Buffer overflow

Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music...

Design/Logic Flaw

Out of bound read can happen in Widevine TA while copying data to buffer from user data due to lack of check of buffer length received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon...

Design/Logic Flaw

Possible denial of service scenario due to improper handling of group management action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &...

Design/Logic Flaw

Out of bound write can occur in TZ command handler due to lack of validation of command ID in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables,...

CVE-2021-1925

CVE-2021-1925 is a DoS vulnerability tied to Qualcomm Snapdragon closed‑source components. The root cause, per the available documents, is improper handling of the Group Management Operations Framework in various Snapdragon lines (Auto, Compute, Connectivity, CE Connectivity, IoT, Industrial IoT,...

CVE-2021-1915

CVE-2021-1915 is a documented buffer overflow vulnerability arising from improper validation of the NDP application information length in Qualcomm Snapdragon platforms (Auto/Compute/Connectivity/CE/IoT/Industrial IoT/Mobile/Voice & Music/WIN). The initial entry states a buffer overflow risk witho...

CVE-2021-1925

Possible denial of service scenario due to improper handling of group management action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &...

CVE-2020-11293

CVE-2020-11293 details an out-of-bounds read in Widevine Trust Authority (TA) when copying data from user input to a buffer, caused by a missing/incorrect buffer-length check. Affected hardware/software span Snapdragon ranges (Auto/Compute/Connectivity/IoT/etc.) and Widevine components in Qualcom...

CVE-2020-11284

CVE-2020-11284 describes a memory-protection issue in Qualcomm Snapdragon SoCs where a non-secure bootloader can unlock and modify previously locked memory through an improper system call sequence, making a memory region an untrusted input source for the secure boot loader. Affected platforms inc...

Cisco SD-WAN vManage Cross-Site Scripting Vulnerability (CNVD-2021-37690)

Cisco SD-WAN vManage is a software from Cisco that provides software-defined networking capabilities. The software provides a way to virtualize the network. A cross-site scripting vulnerability exists in the API of Cisco SD-WAN vManage versions prior to 20.5.1, which stems from the API failing to...

Cisco SD-WAN vManage Software 安全漏洞

Cisco SD-WAN vManage is a software from Cisco that provides software-defined networking capabilities. The software provides a way to virtualize the network. An authentication bypass vulnerability exists in the Web Messaging Service interface of Cisco SD-WAN vManage, which can be exploited by an...

Cisco SD-WAN vManage 安全漏洞

Cisco SD-WAN vManage is a software from Cisco that provides software-defined networking capabilities. The software provides a way to virtualize the network. An information disclosure vulnerability exists in the cluster management interface of Cisco SD-WAN vManage versions prior to 20.5.1. The...