Vulnerabilidades em Qualcomm, Inc.

2.991 resultados
Análise Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2021-1954HIGHPossible buffer over read due to improper validation of data pointer while parsing FILS indication IE in Snapdragon Auto, Snapdragon ComputeEPSS 0.6%CVE-2021-1964HIGHPossible buffer over read due to improper validation of IE size while parsing beacon from peer device in Snapdragon Auto, Snapdragon ComputeEPSS 0.6%CVE-2021-1953HIGHImproper handling of received malformed FTMR request frame can lead to reachable assertion while responding with FTM1 frame in Snapdragon AuEPSS 0.6%CVE-2021-1955HIGHDenial of service in SAP case due to improper handling of connections when association is rejected in Snapdragon Auto, Snapdragon Compute, SEPSS 0.6%CVE-2021-30353HIGHImproper validation of function pointer type with actual function signature can lead to assertion in Snapdragon Auto, Snapdragon Compute, SnEPSS 0.6%CVE-2021-1887HIGHAn assertion can be reached in the WLAN subsystem while using the Wi-Fi Fine Timing Measurement protocol in Snapdragon Wired Infrastructure EPSS 0.6%CVE-2021-1943HIGHPossible buffer out of bound read can occur due to improper validation of TBTT count and length while parsing the beacon response in SnapdraEPSS 0.6%CVE-2021-30330HIGHPossible null pointer dereference due to improper validation of APE clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnEPSS 0.6%CVE-2021-1945HIGHPossible out of bound read due to lack of length check of Bandwidth-NSS IE in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, EPSS 0.6%CVE-2016-10383—In all Qualcomm products with Android releases from CAF using the Linux kernel, there is a TOCTOU race condition in Secure UI.EPSS 0.6%CVE-2023-33045CRITICALBuffer Copy Without Checking Size of Input in WLAN FirmwareEPSS 0.6%CVE-2021-30329HIGHPossible assertion due to improper validation of TCI configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdragEPSS 0.6%CVE-2021-30328HIGHPossible assertion due to improper validation of invalid NR CSI-IM resource configuration in Snapdragon Auto, Snapdragon Compute, SnapdragonEPSS 0.6%CVE-2014-9936—In TrustZone a time-of-check time-of-use race condition could potentially exist in an authentication routine in all Android releases from CAEPSS 0.6%CVE-2021-1910HIGHDouble free in video due to lack of input buffer length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon CoEPSS 0.6%CVE-2024-45569CRITICALImproper Validation of Array Index in WLAN Host CommunicationEPSS 0.6%CVE-2017-8260—In all Qualcomm products with Android releases from CAF using the Linux kernel, due to a type downcast, a value may improperly pass validatiEPSS 0.6%CVE-2018-11285—In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SDEPSS 0.6%CVE-2021-30326HIGHPossible assertion due to improper size validation while processing the DownlinkPreemption IE in an RRC Reconfiguration/RRC Setup message inEPSS 0.6%CVE-2021-30332HIGHPossible assertion due to improper validation of OTA configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdragEPSS 0.6%