Vendor
Qualcomm
3,001 known vulnerabilities.
Products
3,001 results · Feed
-
Medium 6.6
Buffer copy without checking size of input (Classic buffer overflow) in HLOS
Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled.
-
High 7.8
Buffer Over-read in Trusted Execution Environment
Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.
-
Medium 5.5
Improper Validation of Array Index in Audio
Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command.
-
High 7.5
Incorrect Type Conversion or Cast in Multi-Mode Call Processor
Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
-
High 7.5
Improper input validation in Multi-Mode Call Processor
Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification.
-
High 7.5
Improper Input Validation in Multi-Mode Call Processor
Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.
-
High 8.4
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications
Memory corruption while processing finish_sign command to pass a rsp buffer.
-
High 8.4
Buffer Copy Without Checking Size of Input in SPS Applications
Memory corruption in SPS Application while requesting for public key in sorter TA.
-
Critical 9.8
Use of Out-of-range Pointer Offset in WLAN HOST
Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
-
Critical 9.8
Use After Free in WLAN Host Communication
Memory corruption while processing MBSSID beacon containing several subelement IE.
-
High 7.8
Integer Overflow or Wraparound in Core Services
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
-
High 8.4
Stack-based Buffer Overflow in WLAN HAL
Memory corruption while processing TPC target power table in FTM TPC.
-
High 7.3
Buffer Copy Without Checking Size of Input in Video
Memory corruption while parsing qcp clip with invalid chunk data size.
-
High 8.4
Use After Free in Automotive Multimedia
Memory corruption while invoking IOCTLs calls in Automotive Multimedia.
-
High 8.4
Use After Free in Automotive Multimedia
Memory corruption while invoking HGSL IOCTL context create.
-
High 8.4
NULL Pointer Dereference in Windows Graphics
Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render.
-
High 8.4
Buffer Copy Without Checking Size of Input in Bluetooth HOST
Memory corruption while processing the IOCTL FM HCI WRITE request.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
-
High 7.5CVE-2023-33105 Public exploit
Configuration Issue in WLAN Host and Firmware
Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
-
High 7.5
Improper input Validation in Multi-Mode Call Processor
Transient DOS while processing PDU Release command with a parameter PDU ID out of range.
-
High 7.5
Improper Input Validation in Multi-Mode Call Processor
Transient DOS while processing CAG info IE received from NW.
-
High 7.5
Reachable Assertion in Multi-Mode Call Processor
Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16.
-
High 7.5
Reachable Assertion in Multi-Mode Call Processor
Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.
-
Medium 5.5
Buffer Over-read in Audio
Transient DOS while processing channel information for speaker protection v2 module in ADSP.
-
High 7.5
Improper Release of Memory Before Removing Last Reference in Data Modem
Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.
-
High 7.5
Improper Release of Memory Before Removing Last Reference in Data Modem
Transient DOS while processing IE fragments from server during DTLS handshake.
-
Medium 5.1
Buffer Over-read in DSP Services
Information Disclosure while processing IOCTL request in FastRPC.
-
High 8.4
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio while processing RT proxy port register driver.
-
Critical 9.8
Buffer Copy Without Checking Size of Input in Data Modem
Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake.
-
Critical 9.3
Improper Input Validation in Services
Memory corruption in Core Services while executing the command for removing a single event listener.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parse fils IE with length equal to 1.
-
High 8.4
Improper Validation of Array Index in Display
Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger.
-
High 8.6
Use of Out-of-range Pointer Offset in WLAN HOST
Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
-
High 8.4
Untrusted Pointer Dereference in Display
Memory corruption while reading ACPI config through the user mode app.
-
High 7.5
Reachable Assertion in WLAN Firmware
Transient DOS while processing 11AZ RTT management action frame received through OTA.
-
High 7.5
NULL Pointer Dereference in WLAN Firmware
Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
-
High 8.6
Stack-based Buffer Overflow in WLAN HOST
Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.
-
High 7.3
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Video
Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
-
High 7.3
Untrusted Pointer Dereference in Video
Memory corruption in video while parsing invalid mp2 clip.