Vulnerabilidades em Qualcomm, Inc.

2.991 resultados
Análise Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2018-5835—If the seq_len is greater then CSR_MAX_RSC_LEN, a buffer overflow in __wlan_hdd_cfg80211_add_key() may occur when copying keyRSC in Android EPSS 0.2%CVE-2020-3640—u'Resizing the usage table header before passing all the checks leads to the function exiting with a usage table in invalid state when a HLOEPSS 0.2%CVE-2018-12004—Secure keypad is unlocked with secure display still intact in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics ConnectivEPSS 0.2%CVE-2018-11976—ECDSA signature code leaks private keys from secure world to non-secure world in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectivitEPSS 0.2%CVE-2018-11971—Interrupt exit code flow may undermine access control policy set forth by secure world can lead to potential secure asset leakage in SnapdraEPSS 0.2%CVE-2018-13885—Possible memory overread may be lead to access of sensitive data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, SnapdragonEPSS 0.2%CVE-2019-14117—u'Whenever the page list is updated via privileged user, the previous list elements are freed but are not deleted from the list which resultEPSS 0.2%CVE-2019-10615—u'Possibility of integer overflow in keymaster 4 while allocating memory due to multiplication of large numcerts value and size of keymasterEPSS 0.2%CVE-2019-10527—u'SMEM partition can be manipulated in case of any compromise on HLOS, thus resulting in access to memory outside of SMEM address range whicEPSS 0.2%CVE-2018-5838—Improper Validation of Array Index In the adreno OpenGL driver in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, an out-of-boEPSS 0.2%CVE-2019-14056—u'Possible integer overflow in API due to lack of check on large oid range count in cert extension field' in Snapdragon Auto, Snapdragon ComEPSS 0.2%CVE-2020-11128—u'Possible out of bound access while copying the mask file content into the buffer without checking the buffer size' in Snapdragon Auto, SnaEPSS 0.2%CVE-2019-10597—kernel writes to user passed address without any checks can lead to arbitrary memory write in Snapdragon Auto, Snapdragon Compute, SnapdragoEPSS 0.2%CVE-2019-10596—u'Improper access control can lead signed process to guess pid of other processes and access their address space' in Snapdragon Auto, SnapdrEPSS 0.2%CVE-2020-11175—u'Use after free issue in Bluetooth transport driver when a method in the object is accessed after the object has been deleted due to impropEPSS 0.2%CVE-2019-13998—u'Lack of check that the TX FIFO write and read indices that are read from shared RAM are less than the FIFO size results into memory corrupEPSS 0.2%CVE-2018-11299—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when WLAN FW has not filled the EPSS 0.2%CVE-2019-13999—u'Lack of check for integer overflow for round up and addition operations result into memory corruption and potential information leakage' iEPSS 0.2%CVE-2019-13995—u'Lack of integer overflow check for addition of fragment size and remaining size that are read from shared memory can lead to memory corrupEPSS 0.2%CVE-2019-13992—u'Out of bound memory access if stack push and pop operation are performed without doing a bound check on stack top' in Snapdragon Auto, SnaEPSS 0.2%