Out‑of‑Bounds Read in HarmonyOS Peripheral Module

OOB read vulnerability in the peripheral module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Bluetooth Permission Control Vulnerability Affecting Availability

Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.

Use‑After‑Free in HarmonyOS Location Service Leading to Service Unavailability

UAF vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.

Race Condition in HarmonyOS Location Service Affects Availability

Race condition vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.

Permission Control Vulnerability in HarmonyOS WLAN Module Exposes Network Information

Permission control vulnerability in the WLAN module.  Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Denial of Service via File Parsing Module in HarmonyOS

DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.

Buffer Overflow in HarmonyOS File Preview Causing Availability Disruption

Buffer overflow vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect availability.

Permission Control Vulnerability in Huawei Autofill Service

Permission control vulnerability in the autofill service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Permission Control Vulnerability in Huawei EMUI and HarmonyOS Optimizer Module

Permission control vulnerability in the Optimizer module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Permission Control Vulnerability in Huawei EMUI Event Notification Module

Permission control vulnerability in the event notification management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Null Pointer Dereference in HarmonyOS ArkWeb Module Leading to Availability Impact

Null pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect availability.

DoS Vulnerability in DSoftBus Module Leading to Availability Impact

DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.

Denial of Service Vulnerability in Huawei HarmonyOS DSoftBus Module

DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.

Graphics Module Permission Control Vulnerability Affecting Confidentiality

Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality.

Permission Control Flaw in HarmonyOS Background Task Management

Permission control vulnerability in the background task management module. Impact: Successful exploitation of this vulnerability may affect service integrity.

DoS Vulnerability in Huawei HarmonyOS File Parsing Module

DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.

In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created work profile due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions

The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.

Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products

The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console. Successful exploitation enables an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract information from the browser. However, due to the use of the httpOnly flag on sensitive session cookies, session hijacking or similar attacks are prevented.