openstack-keystone: Credentials endpoint policy logic allows changing credential owner and target project ID

A vulnerability was found in Keystone's EC2 credentials API. This flaw allows any authenticated user to create an EC2 credential for themselves for a project that they have a specified role, and then perform an update to the credential user and project, allowing them to masquerade as another user...

openstack-keystone: EC2 and credential endpoints are not protected from a scoped context

A vulnerability was found in Keystone's EC2 credentials API. This flaw allows any user authenticated within a limited scope trust/OAuth/application credential to create an EC2 credential with escalated permissions, for example, obtaining an "admin" role, while the user is on a limited "viewer" ro...

CVE-2020-3662

Buffer overflow can occur while parsing eac3 header while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ801...

CVE-2020-3626

Any application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096AU, APQ8098, MSM8905, MSM8909W, MSM8917, MSM8920,...

Code injection

kernel writes to user passed address without any checks can lead to arbitrary memory write in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ6018, IPQ8074, MSM8996, MSM8996AU, Nicobar,...

Race condition

Double free issue in NPU due to lack of resource locking mechanism to avoid race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, QCS405, Rennell, Saipan, SC8180X, SDX55, SM8150, SM8250,...

CVE-2020-3663

CVE-2020-3663 affects Qualcomm Snapdragon platforms (multiple Snapdragon Auto/Compute/Connectivity/IoT/Wearables generations) where buffer over-run can occur while fetching track decoder information if the decode- cb size exceeds the allocated buffer. The issue’s root cause is a buffer overflow i...

CVE-2020-3635

Stack based overflow If the maximum number of arguments allowed per request in perflock exceeds in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096AU, APQ8098, MSM8909W, MSM8917, MSM8920, MSM8937,...

CVE-2020-3635

CVE-2020-3635 is a stack-based overflow affecting Qualcomm/Snapdragon components where the maximum number of arguments per request in perflock can exceed limits across numerous Snapdragon SKUs (Auto, Compute, Consumer IOT, Industrial IOT, Mobile, Wearables) including APQ8053, APQ8096AU, APQ8098, ...

CVE-2020-3626

Any application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096AU, APQ8098, MSM8905, MSM8909W, MSM8917, MSM8920,...

CVE-2020-3626

CVE-2020-3626 affects Qualcomm closed‑source components on various Snapdragon platforms (e.g., APQ8053, SDM/SM variants). The underlying issue is reported as an authentication flaw where the AIDL uimlpaservice has insufficient protection, allowing any application to bind to the service and exerci...

CVE-2020-3614

CVE-2020-3614 is a buffer-overflow risk reported for Qualcomm Snapdragon firmware. The description in multiple sources specifies a lack of length check before copying a frame into a local buffer, affecting a broad set of Snapdragon products (Auto, Compute, Connectivity, IoT variants, Wearables, a...

CVE-2019-14094

CVE-2019-14094 describes an integer overflow in the diag command handler when a large value is supplied for the number of tasks in request packets. Affected products are Qualcomm Snapdragon families including Snapdragon Auto, Compute, Connectivity, etc., across numerous SoCs (e.g., APQ8009, APQ80...

CVE-2020-3613

Double free issue in kernel memory mapping due to lack of memory protection mechanism in Snapdragon Compute, Snapdragon Mobile, Snapdragon Voice & Music in SM8150...

CVE-2020-3613

CVE-2020-3613 is a double-free in the kernel memory mapping on Qualcomm Snapdragon SM8150 (Compute/Mobile/Voice & Music) leading to a local impact with high severity. The root cause is a memory-management error that enables a local attacker to potentially exploit or crash the kernel, with the CVS...

CVE-2019-14047

While IPA driver processes route add rule IOCTL, there is no input validation of the rule ID prior to adding the rule to the IPA HW commit list in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon...

CVE-2019-10597

CVE-2019-10597 is a kernel-level issue described across multiple sources as a local vulnerability where the kernel writes to a user-supplied address, enabling arbitrary memory writes in Qualcomm/Qualcomm-closed components. Public references in the dataset include a Red Hat advisory listing affect...

CVE-2019-10597

kernel writes to user passed address without any checks can lead to arbitrary memory write in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ6018, IPQ8074, MSM8996, MSM8996AU, Nicobar,...

PT-2020-3711 · Google Cloud Platform +1 · Guest-Oslogin +1

Name of the Vulnerable Software and Affected Versions: Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 Description: A vulnerability in Google Cloud Platform's guest-oslogin allows a user with the role "roles/compute.osLogin" to escalate privileges to root. Using their...

CVE-2020-3645

Firmware will hit assert in WLAN firmware If encrypted data length in FILS IE of reassoc response is more than 528 bytes in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon...