Skip to contentOpenharmony vulnerabilities
Newest
- openatom openharmonyLiteos-A has a incorrect default permissions vulnerabilityCVE-2023-31167.3 High
- openatom openharmonyOpenHarmony v3.2.1 and prior version has a system call function usage errorCVE-2023-47533.9 Low
- openatom openharmonyThe bundle management subsystem has a improper input validation when installing a HAP package.CVE-2023-259476.2 Medium
- openatom openharmonyCommunication Wi-Fi subsystem has a null pointer reference vulnerability when receving external data.CVE-2023-244655.5 Medium
- openatom openharmonyThe kernel subsystem function check_permission_for_set_tokenid has an UAF vulnerability.CVE-2023-224367.8 High
- openatom openharmonyThe kernel subsystem hmdfs has a arbitrary memory accessing vulnerability.CVE-2023-223016.5 Medium
- openatom openharmonyThe ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access.CVE-2023-00834.0 Medium
- openatom openharmonyplatform_callback_stub in misc subsystem has an authentication bypass vulnerability which allows an "SA relay attack".CVE-2023-00366.5 Medium
- openatom openharmonysoftbus_client_stub in communication subsystem has an authentication bypass vulnerability which allows an "SA relay attack".CVE-2023-00356.5 Medium
- openatom openharmonyKernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysTimerGettime.CVE-2022-436624.0 Medium
- openatom openharmonyKernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGettime.CVE-2022-451264.0 Medium
- openharmonyPIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks.CVE-2022-458778.3 High
- openharmonyTelephony in communication subsystem sends public events with personal data, but the permission is not set.CVE-2022-451186.2 Medium
- openatom openharmonyThe appspawn and nwebspawn services were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation.CVE-2022-444556.8 Medium
- openatom openharmonyKernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres.CVE-2022-418024.0 Medium
- openharmonyAn abnormal packet recieved when distributedhardware_device_manager joining a network could cause a device reboot.CVE-2022-434956.5 Medium
- openharmonyArbitrary file read via download_server.CVE-2022-434496.2 Medium
- openharmonyMultiple path traversal in appspawn and nwebspawn services.CVE-2022-434518.4 High
- openharmonyKernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information inc…CVE-2022-424646.7 Medium
- openharmonySoftbus_server in communication subsystem has a authenication bypass vulnerability in a callback handler function. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm pack…CVE-2022-424638.3 High
- openatom openharmonyOut-of-bound memory read and write in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could read out-of-bound memory le…CVE-2022-416865.1 Medium
- openharmonyStartup subsystem missed permission validation in param service. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS…CVE-2022-424888.4 High
- openatom openharmonyIPC in communication subsystem has a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.CVE-2022-387016.2 Medium
- openharmonymultimedia subsystem has a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.CVE-2022-387008.8 High
- openharmonyTokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerabil…CVE-2022-380816.2 Medium
- openharmonywindowmanager in window subsystem has a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.CVE-2022-380646.2 Medium
- openatom openharmonyIncorrect configuration of the cJSON library lead a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.CVE-2022-364237.4 High