Vulnerabilidades em Qualcomm, Inc.

2.976 resultados
Análise Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2020-11288HIGHOut of bound write can occur in playready while processing command due to lack of input validation in Snapdragon Auto, Snapdragon Compute, SEPSS 0.2%CVE-2021-35077HIGHPossible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon CompEPSS 0.2%CVE-2020-11289HIGHOut of bound write can occur in TZ command handler due to lack of validation of command ID in Snapdragon Auto, Snapdragon Compute, SnapdragoEPSS 0.2%CVE-2018-13901—Due to missing permissions in Android Manifest file, Sensitive information disclosure issue can happen in PCI RCS app in Snapdragon Auto, SnEPSS 0.2%CVE-2019-2343—Out of bound read and information disclosure in firmware due to insufficient checking of an embedded structure that can be sent from a kerneEPSS 0.2%CVE-2018-11899—While processing radio connection status change events, Radio index is not properly validated in Snapdragon Auto, Snapdragon Connectivity, SEPSS 0.2%CVE-2019-2263—Access to freed memory can happen while reading from diag driver due to use after free issue in Snapdragon Auto, Snapdragon Connectivity, SnEPSS 0.2%CVE-2018-11257—Permissions, Privileges, and Access Controls in TA in Snapdragon Mobile has an options that allows RPMB erase for secure devices in versionsEPSS 0.2%CVE-2019-2238—Lack of check of data type can lead to subsequent loop-expression potentially go negative and the condition will still evaluate to true leadEPSS 0.2%CVE-2019-2298—Protection is missing while accessing md sessions info via macro which can lead to use-after-free in Snapdragon Auto, Snapdragon Compute, SnEPSS 0.2%CVE-2021-35089HIGHPossible buffer overflow due to lack of input IB amount validation while processing the user command in Snapdragon AutoEPSS 0.2%CVE-2018-11947—The txrx stats req might be double freed in the pdev detach when the host driver is unloading in Snapdragon Auto, Snapdragon Consumer ElectrEPSS 0.2%CVE-2019-10495—Arbitrary buffer write issue while processing sequence header during HEVC or AVC encoding. in Snapdragon Auto, Snapdragon Compute, SnapdragoEPSS 0.2%CVE-2017-18158—Possible buffer overflows and array out of bounds accesses in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS EPSS 0.2%CVE-2019-2243—Possible buffer overflow at the end of iterating loop while getting the version info and lead to information disclosure. in Snapdragon Auto,EPSS 0.2%CVE-2018-5862—In __wlan_hdd_cfg80211_vendor_scan() in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD AndroEPSS 0.2%CVE-2026-25289CRITICALStack-based Buffer Overflow in WLAN FirmwareEPSS 0.2%CVE-2018-5834—In __wlan_hdd_cfg80211_vendor_scan(), a buffer overwrite can potentially occur in Android releases from CAF using the linux kernel (Android EPSS 0.2%CVE-2018-5831—In the KGSL driver in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security paEPSS 0.2%CVE-2019-2278—User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer EPSS 0.2%