Vulnerabilidades em Qualcomm, Inc.

2.991 resultados
Análise Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2019-14093—Array out of bound access can occur in display module due to lack of bound check on input parcel received in Snapdragon Auto, Snapdragon ConEPSS 0.2%CVE-2019-14130—Memory corruption can occurs in trusted application if offset size from HLOS is more than actual mapped buffer size in Snapdragon Auto, SnapEPSS 0.2%CVE-2018-5914—Improper input validation in TZ led to array out of bound in TZ function while accessing the peripheral details using the incoming data in SEPSS 0.2%CVE-2026-24079HIGHMissing Authentication for Critical Function in Data ModemEPSS 0.2%CVE-2018-11950—Unapproved TrustZone applications can be loaded and executed in Snapdragon Mobile in version SD 845, SD 850EPSS 0.2%CVE-2018-13910—Out-of-Bounds access in TZ due to invalid index calculated to check against DDR in Snapdragon Auto, Snapdragon Connectivity, Snapdragon ConsEPSS 0.2%CVE-2019-14100—Register write via debugfs is disabled by default to prevent register writing via debugfs. in Snapdragon Auto, Snapdragon Compute, SnapdragoEPSS 0.2%CVE-2019-10618—Driver may access an invalid address while processing IO control due to lack of check of address validation in Snapdragon Connectivity in QCEPSS 0.2%CVE-2019-2316—When computing the digest a local variable is used after going out of scope in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, EPSS 0.2%CVE-2019-10621—Use after free issue when MAP and UNMAP calls at same time as data structure used my MAP may be freed by UNMAP function in Snapdragon Auto, EPSS 0.2%CVE-2019-14123—Possible buffer overflow and over read possible due to missing bounds checks for fixed limits if we consider widevine HLOS client as non-truEPSS 0.2%CVE-2018-11824—A stack-based buffer overflow can occur in a firmware routine in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SDEPSS 0.2%CVE-2018-11928—Lack of check on length parameter may cause buffer overflow while processing WMI commands in Snapdragon Auto, Snapdragon Compute, SnapdragonEPSS 0.2%CVE-2020-3676—Possible memory corruption in perfservice due to improper validation array length taken from user application. in Snapdragon Auto, SnapdragoEPSS 0.2%CVE-2019-2261—Unauthorized access from GPU subsystem to HLOS or other non secure subsystem memory can lead to information disclosure in Snapdragon Auto, SEPSS 0.2%CVE-2018-11855—If an end user makes use of SCP11 sample OCE code without modification it could lead to a buffer overflow when transmitting a CAPDU in SnapdEPSS 0.2%CVE-2020-11221—Usage of syscall by non-secure entity can allow extraction of secure QTEE diagnostic information in clear text form due to insufficient checEPSS 0.2%CVE-2020-11228—Part of RPM region was not protected from xblSec itself due to improper policy and leads to unprivileged access in Snapdragon Auto, SnapdragEPSS 0.2%CVE-2020-3687—Local privilege escalation in admin services in Windows environment can occur due to an arbitrary read issue.EPSS 0.2%CVE-2018-11958—Insufficient protection of keys in keypad can lead HLOS to gain access to confidential keypad input data in Snapdragon Auto, Snapdragon ConsEPSS 0.2%