Vulnerabilidades em OpenHarmony

177 resultados
Análise Vexday

Com 177 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o OpenHarmony apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de agentes maliciosos sobre suas vulnerabilidades. A ausência de CVEs de severidade crítica e de provas de conceito públicas reforça um perfil de risco contido no momento, embora 10 novas CVEs registradas nos últimos 90 dias indiquem atividade contínua de descoberta que merece acompanhamento. O tipo de falha mais frequente é CWE-416 (use-after-free), classe de vulnerabilidade que, por natureza, pode levar a execução de código arbitrário e elevação de privilégios, demandando atenção prioritária em revisões de código e processos de desenvolvimento. A CVE mais relevante no momento, CVE-2024-37185, apresenta EPSS de 0,0062, sinalizando baixa probabilidade de exploração iminente, mas ainda assim deve ser tratada como referência para priorização de mitigações.

CVE-2024-37077HIGHArkcompiler Ets Runtime has an out-of-bounds write vulnerabilityEPSS 0.6%CVE-2024-37185HIGHArkcompiler Ets Runtime has an out-of-bounds write vulnerabilityEPSS 0.6%CVE-2022-43495MEDIUMAn abnormal packet recieved when distributedhardware_device_manager joining a network could cause a device reboot.EPSS 0.6%CVE-2024-28226HIGHFs has an improper input validation vulnerabilityEPSS 0.6%CVE-2023-22301MEDIUMThe kernel subsystem hmdfs has a arbitrary memory accessing vulnerability.EPSS 0.6%CVE-2024-37030HIGHArkcompiler Ets Runtime has a use after free vulnerabilityEPSS 0.6%CVE-2024-36243HIGHArkcompiler Ets Runtime has an out-of-bounds read vulnerabilityEPSS 0.6%CVE-2024-36260HIGHArkcompiler Ets Runtime has an out-of-bounds write vulnerabilityEPSS 0.6%CVE-2026-27648HIGHweb_webview has an out-of-bounds write vulnerabilityEPSS 0.6%CVE-2024-39775MEDIUMNet Manager has an out-of-bounds read permission bypass vulnerabilityEPSS 0.4%CVE-2024-22092HIGHBundlemanager has an authentication bypass vulnerabilityEPSS 0.4%CVE-2026-24792HIGHweb_webview has a Race Condition vulnerabilityEPSS 0.4%CVE-2024-21860HIGHDsoftbus has a use after free vulnerabilityEPSS 0.4%CVE-2022-38700HIGHmultimedia subsystem has a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.EPSS 0.4%CVE-2022-41686MEDIUMOut-of-bound memory read and write in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could read out-of-bound memory leading sensitive to information disclosure. The proc ...EPSS 0.3%CVE-2022-36423HIGHIncorrect configuration of the cJSON library lead a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.EPSS 0.3%CVE-2022-42463HIGHSoftbus_server in communication subsystem has a authenication bypass vulnerability in a callback handler function. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm packets to any remote device and executing arbitrary co ...EPSS 0.3%CVE-2023-45734MEDIUMDsoftbus has an out-of-bounds write vulnerabilityEPSS 0.3%CVE-2023-6045MEDIUMArkruntime has a type confusion vulnerabilityEPSS 0.2%CVE-2023-46705MEDIUMArkruntime has a type confusion vulnerabilityEPSS 0.2%