Vulnerabilidades em OpenHarmony

177 resultados
Análise Vexday

Com 177 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o OpenHarmony apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de agentes maliciosos sobre suas vulnerabilidades. A ausência de CVEs de severidade crítica e de provas de conceito públicas reforça um perfil de risco contido no momento, embora 10 novas CVEs registradas nos últimos 90 dias indiquem atividade contínua de descoberta que merece acompanhamento. O tipo de falha mais frequente é CWE-416 (use-after-free), classe de vulnerabilidade que, por natureza, pode levar a execução de código arbitrário e elevação de privilégios, demandando atenção prioritária em revisões de código e processos de desenvolvimento. A CVE mais relevante no momento, CVE-2024-37185, apresenta EPSS de 0,0062, sinalizando baixa probabilidade de exploração iminente, mas ainda assim deve ser tratada como referência para priorização de mitigações.

CVE-2023-46100MEDIUMCert manager has a use of uninitialized resource vulnerabilityEPSS 0.2%CVE-2023-46705MEDIUMArkruntime has a type confusion vulnerabilityEPSS 0.2%CVE-2024-38386HIGHArkcompiler Ets Runtime has an out-of-bounds write vulnerabilityEPSS 0.2%CVE-2024-3759MEDIUMHmdfs has a use after free vulnerabilityEPSS 0.2%CVE-2024-21826MEDIUMHuks has an insecure storage of sensitive information vulnerabilityEPSS 0.2%CVE-2024-3758MEDIUMHmdfs has a heap buffer overflow vulnerabilityEPSS 0.2%CVE-2023-47217MEDIUMArkruntime has a buffer overflow vulnerabilityEPSS 0.2%CVE-2022-38701MEDIUMIPC in communication subsystem has a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.EPSS 0.2%CVE-2022-42464MEDIUMKernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in furth ...EPSS 0.2%CVE-2024-27217MEDIUMMSDP has a use after free vulnerabilityEPSS 0.2%CVE-2024-3757LOWArkcompiler runtime has an integer overflow vulnerabilityEPSS 0.2%CVE-2022-38081MEDIUMTokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.EPSS 0.2%CVE-2022-43451HIGHMultiple path traversal in appspawn and nwebspawn services.EPSS 0.2%CVE-2023-43612HIGHHiview has an improper preservation of permissions vulnerabilityEPSS 0.2%CVE-2024-23808MEDIUMArkcompiler ets frontend has an out-of-bounds read vulnerabilityEPSS 0.2%CVE-2022-41802MEDIUMKernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres.EPSS 0.2%CVE-2024-41157HIGHLiteos-A has an use after free vulnerabilityEPSS 0.2%CVE-2023-42774MEDIUMLiteos-A has a incorrect default permissions vulnerabilityEPSS 0.2%CVE-2024-22098MEDIUMAVSession has a use after free vulnerabilityEPSS 0.2%CVE-2022-38064MEDIUMwindowmanager in window subsystem has a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.EPSS 0.2%