Arkruntime has a buffer overflow vulnerability

Cert manager has a use of uninitialized resource vulnerability

Liteos-A has a incorrect default permissions vulnerability

Arkruntime has a type confusion vulnerability

OpenHarmony v3.2.1 and prior version has a system call function usage error

The bundle management subsystem has a improper input validation when installing a HAP package.

Communication Wi-Fi  subsystem has a null pointer reference vulnerability when receving external data.

The ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access.

Telephony in communication subsystem sends public events with personal data, but the permission is not set.

Arbitrary file read via download_server.

Tokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.

windowmanager in window subsystem has a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.

Communication Dsoftbus has an UAF vulnerability

Arkcompiler Ets Runtime has an integer overflow vulnerability

PIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks.

kernel_liteos_a has a race condition vulnerability

Out-of-bound memory read and write in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could read out-of-bound memory leading sensitive to information disclosure. The proc ...

kernel_linux_common_modules has a Race Condition vulnerability

filemanagement_storage_service has an improper input validation vulnerability

kernel_liteos_a has an integer overflow vulnerability

Sensors_medical_sensor has a NULL pointer dereference vulnerability

communication_ipc an improper input validation vulnerability

Arkcompiler Ets Runtime has a type confusion vulnerability

Arkcompiler Ets Runtime has a type confusion vulnerability

multimedia audio has a UAF vulnerability

Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres.

IPC in communication subsystem has a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.