# OpenHarmony.

Every CVE that names OpenHarmony among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Bundlemanager has an authentication bypass vulnerability](https://agentprime.io/advisories/CVE-2024-22092.md)
  `CVE-2024-22092` · CVE record: OpenHarmony OpenHarmony · CVSS 7.7 High · Not analysed yet · Published 2 Apr 2024 · Tags: Authentication bypass
- [Telephony has an improper input validation vulnerability](https://agentprime.io/advisories/CVE-2024-29074.md)
  `CVE-2024-29074` · CVE record: OpenHarmony OpenHarmony · CVSS 6.5 Medium · Not analysed yet · Published 2 Apr 2024 · Tags: CWE-20
- [Camera has a use after free vulnerability](https://agentprime.io/advisories/CVE-2024-22180.md)
  `CVE-2024-22180` · CVE record: OpenHarmony OpenHarmony · CVSS 3.3 Low · Not analysed yet · Published 2 Apr 2024 · Tags: Memory corruption
- [AVSession has a use after free vulnerability](https://agentprime.io/advisories/CVE-2024-22098.md)
  `CVE-2024-22098` · CVE record: OpenHarmony OpenHarmony · CVSS 6.5 Medium · Not analysed yet · Published 2 Apr 2024 · Tags: Memory corruption
- [Audio has an improper preservation of permissions vulnerability](https://agentprime.io/advisories/CVE-2024-22177.md)
  `CVE-2024-22177` · CVE record: OpenHarmony OpenHarmony · CVSS 3.3 Low · Not analysed yet · Published 2 Apr 2024 · Tags: CWE-281
- [Arkui has a type confusion vulnerability](https://agentprime.io/advisories/CVE-2024-21834.md)
  `CVE-2024-21834` · CVE record: OpenHarmony OpenHarmony · CVSS 3.3 Low · Not analysed yet · Published 2 Apr 2024 · Tags: Memory corruption
- [Huks has an insecure storage of sensitive information vulnerability](https://agentprime.io/advisories/CVE-2024-21826.md)
  `CVE-2024-21826` · CVE record: OpenHarmony OpenHarmony · CVSS 4.3 Medium · Not analysed yet · Published 4 Mar 2024 · Tags: Information disclosure
- [Background task manager has an improper preservation of permissions vulnerability](https://agentprime.io/advisories/CVE-2024-21816.md)
  `CVE-2024-21816` · CVE record: OpenHarmony OpenHarmony · CVSS 4.0 Medium · Not analysed yet · Published 4 Mar 2024 · Tags: CWE-281
- [Arkui has a type confusion vulnerability](https://agentprime.io/advisories/CVE-2023-49602.md)
  `CVE-2023-49602` · CVE record: OpenHarmony OpenHarmony · CVSS 2.9 Low · Not analysed yet · Published 4 Mar 2024 · Tags: Memory corruption
- [Wlan has a use after free vulnerability](https://agentprime.io/advisories/CVE-2023-46708.md)
  `CVE-2023-46708` · CVE record: OpenHarmony OpenHarmony · CVSS 4.3 Medium · Not analysed yet · Published 4 Mar 2024 · Tags: Memory corruption
- [Pasteboard has an out-of-bounds read vulnerability](https://agentprime.io/advisories/CVE-2023-25176.md)
  `CVE-2023-25176` · CVE record: OpenHarmony OpenHarmony · CVSS 2.9 Low · Not analysed yet · Published 4 Mar 2024 · Tags: Memory corruption
- [Dsoftbus has an improper input validation vulnerability](https://agentprime.io/advisories/CVE-2024-21863.md)
  `CVE-2024-21863` · CVE record: OpenHarmony OpenHarmony · CVSS 4.7 Medium · Not analysed yet · Published 2 Feb 2024 · Tags: CWE-20
- [Dsoftbus has an integer overflow vulnerability](https://agentprime.io/advisories/CVE-2024-21851.md)
  `CVE-2024-21851` · CVE record: OpenHarmony OpenHarmony · CVSS 2.9 Low · Not analysed yet · Published 2 Feb 2024 · Tags: Memory corruption
- [Dsoftbus has an improper input validation vulnerability](https://agentprime.io/advisories/CVE-2024-0285.md)
  `CVE-2024-0285` · CVE record: OpenHarmony OpenHarmony · CVSS 4.7 Medium · Not analysed yet · Published 2 Feb 2024 · Tags: CWE-20
- [Dsoftbus has an out-of-bounds write vulnerability](https://agentprime.io/advisories/CVE-2023-45734.md)
  `CVE-2023-45734` · CVE record: OpenHarmony OpenHarmony · CVSS 4.2 Medium · Not analysed yet · Published 2 Feb 2024 · Tags: Memory corruption
- [Dsoftbus has a use after free vulnerability](https://agentprime.io/advisories/CVE-2024-21860.md)
  `CVE-2024-21860` · CVE record: OpenHarmony OpenHarmony · CVSS 8.2 High · Not analysed yet · Published 2 Feb 2024 · Tags: Memory corruption
- [Dsoftbus has an integer overflow vulnerability](https://agentprime.io/advisories/CVE-2024-21845.md)
  `CVE-2024-21845` · CVE record: OpenHarmony OpenHarmony · CVSS 2.9 Low · Not analysed yet · Published 2 Feb 2024 · Tags: Memory corruption
- [Dsoftbus has an out-of-bounds read vulnerability](https://agentprime.io/advisories/CVE-2023-49118.md)
  `CVE-2023-49118` · CVE record: OpenHarmony OpenHarmony · CVSS 2.9 Low · Not analysed yet · Published 2 Feb 2024 · Tags: Memory corruption
- [Dsoftbus has an out-of-bounds read vulnerability](https://agentprime.io/advisories/CVE-2023-43756.md)
  `CVE-2023-43756` · CVE record: OpenHarmony OpenHarmony · CVSS 2.9 Low · Not analysed yet · Published 2 Feb 2024 · Tags: Memory corruption
- [multimedia audio has a UAF vulnerability](https://agentprime.io/advisories/CVE-2023-49142.md)
  `CVE-2023-49142` · CVE record: OpenHarmony OpenHarmony · CVSS 4.0 Medium · Not analysed yet · Published 2 Jan 2024 · Tags: Memory corruption
- [multimedia player has a UAF vulnerability](https://agentprime.io/advisories/CVE-2023-49135.md)
  `CVE-2023-49135` · CVE record: OpenHarmony OpenHarmony · CVSS 4.0 Medium · Not analysed yet · Published 2 Jan 2024 · Tags: Memory corruption
- [multimedia player has a UAF vulnerability](https://agentprime.io/advisories/CVE-2023-48360.md)
  `CVE-2023-48360` · CVE record: OpenHarmony OpenHarmony · CVSS 4.0 Medium · Not analysed yet · Published 2 Jan 2024 · Tags: Memory corruption
- [multimedia camera has a UAF vulnerability](https://agentprime.io/advisories/CVE-2023-47857.md)
  `CVE-2023-47857` · CVE record: OpenHarmony OpenHarmony · CVSS 4.0 Medium · Not analysed yet · Published 2 Jan 2024 · Tags: Memory corruption
- [Liteos-A has a missing release of resource vulnerability](https://agentprime.io/advisories/CVE-2023-47216.md)
  `CVE-2023-47216` · CVE record: OpenHarmony OpenHarmony · CVSS 2.9 Low · Not analysed yet · Published 2 Jan 2024 · Tags: Denial of service
- [Arkruntime has a buffer overflow vulnerability](https://agentprime.io/advisories/CVE-2023-47217.md)
  `CVE-2023-47217` · CVE record: OpenHarmony OpenHarmony · CVSS 4.0 Medium · Not analysed yet · Published 20 Nov 2023 · Tags: Memory corruption
- [Cert manager has a use of uninitialized resource vulnerability](https://agentprime.io/advisories/CVE-2023-46100.md)
  `CVE-2023-46100` · CVE record: OpenHarmony OpenHarmony · CVSS 6.2 Medium · Not analysed yet · Published 20 Nov 2023 · Tags: Memory corruption
- [Liteos-A has a incorrect default permissions vulnerability](https://agentprime.io/advisories/CVE-2023-42774.md)
  `CVE-2023-42774` · CVE record: OpenHarmony OpenHarmony · CVSS 6.2 Medium · Not analysed yet · Published 20 Nov 2023 · Tags: Broken access control
- [Arkruntime has a type confusion vulnerability](https://agentprime.io/advisories/CVE-2023-6045.md)
  `CVE-2023-6045` · CVE record: OpenHarmony OpenHarmony · CVSS 5.9 Medium · Not analysed yet · Published 20 Nov 2023 · Tags: Memory corruption
- [Arkruntime has a type confusion vulnerability](https://agentprime.io/advisories/CVE-2023-46705.md)
  `CVE-2023-46705` · CVE record: OpenHarmony OpenHarmony · CVSS 6.2 Medium · Not analysed yet · Published 20 Nov 2023 · Tags: Memory corruption
- [Hiview has an improper preservation of permissions vulnerability](https://agentprime.io/advisories/CVE-2023-43612.md)
  `CVE-2023-43612` · CVE record: OpenHarmony OpenHarmony · CVSS 8.4 High · Not analysed yet · Published 20 Nov 2023 · Tags: CWE-281
- [Liteos-A has a incorrect default permissions vulnerability](https://agentprime.io/advisories/CVE-2023-3116.md)
  `CVE-2023-3116` · CVE record: OpenHarmony OpenHarmony · CVSS 7.3 High · Not analysed yet · Published 20 Nov 2023 · Tags: Broken access control
- [OpenHarmony v3.2.1 and prior version has a system call function usage error](https://agentprime.io/advisories/CVE-2023-4753.md)
  `CVE-2023-4753` · CVE record: OpenHarmony OpenHarmony · CVSS 3.9 Low · Not analysed yet · Published 21 Sept 2023 · Tags: CWE-20
- [The bundle management subsystem has a improper input validation when installing a HAP package.](https://agentprime.io/advisories/CVE-2023-25947.md)
  `CVE-2023-25947` · CVE record: OpenHarmony OpenHarmony · CVSS 6.2 Medium · Not analysed yet · Published 10 Mar 2023 · Tags: CWE-20
- [Communication Wi-Fi subsystem has a null pointer reference vulnerability when receving external data.](https://agentprime.io/advisories/CVE-2023-24465.md)
  `CVE-2023-24465` · CVE record: OpenHarmony OpenHarmony · CVSS 5.5 Medium · Not analysed yet · Published 10 Mar 2023 · Tags: CWE-20
- [The kernel subsystem function check_permission_for_set_tokenid has an UAF vulnerability.](https://agentprime.io/advisories/CVE-2023-22436.md)
  `CVE-2023-22436` · CVE record: OpenHarmony OpenHarmony · CVSS 7.8 High · Not analysed yet · Published 10 Mar 2023 · Tags: Memory corruption
- [The kernel subsystem hmdfs has a arbitrary memory accessing vulnerability.](https://agentprime.io/advisories/CVE-2023-22301.md)
  `CVE-2023-22301` · CVE record: OpenHarmony OpenHarmony · CVSS 6.5 Medium · Not analysed yet · Published 10 Mar 2023 · Tags: CWE-20
- [The ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access.](https://agentprime.io/advisories/CVE-2023-0083.md)
  `CVE-2023-0083` · CVE record: OpenHarmony OpenHarmony · CVSS 4.0 Medium · Not analysed yet · Published 10 Mar 2023 · Tags: Memory corruption
- [platform_callback_stub in misc subsystem has an authentication bypass vulnerability which allows an "SA relay attack".](https://agentprime.io/advisories/CVE-2023-0036.md)
  `CVE-2023-0036` · CVE record: OpenHarmony OpenHarmony · CVSS 6.5 Medium · Not analysed yet · Published 9 Jan 2023 · Tags: Authentication bypass
- [softbus_client_stub in communication subsystem has an authentication bypass vulnerability which allows an "SA relay attack".](https://agentprime.io/advisories/CVE-2023-0035.md)
  `CVE-2023-0035` · CVE record: OpenHarmony OpenHarmony · CVSS 6.5 Medium · Not analysed yet · Published 9 Jan 2023 · Tags: Authentication bypass
- [Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysTimerGettime.](https://agentprime.io/advisories/CVE-2022-43662.md)
  `CVE-2022-43662` · CVE record: OpenHarmony OpenHarmony · CVSS 4.0 Medium · Not analysed yet · Published 9 Jan 2023 · Tags: Memory corruption
- [Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGettime.](https://agentprime.io/advisories/CVE-2022-45126.md)
  `CVE-2022-45126` · CVE record: OpenHarmony OpenHarmony · CVSS 4.0 Medium · Not analysed yet · Published 9 Jan 2023 · Tags: Memory corruption
- [PIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks.](https://agentprime.io/advisories/CVE-2022-45877.md)
  `CVE-2022-45877` · CVE record: OpenHarmony OpenHarmony · CVSS 8.3 High · Not analysed yet · Published 8 Dec 2022 · Tags: Authentication bypass
- [Telephony in communication subsystem sends public events with personal data, but the permission is not set.](https://agentprime.io/advisories/CVE-2022-45118.md)
  `CVE-2022-45118` · CVE record: OpenHarmony OpenHarmony · CVSS 6.2 Medium · Not analysed yet · Published 8 Dec 2022 · Tags: Authentication bypass
- [The appspawn and nwebspawn services were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation.](https://agentprime.io/advisories/CVE-2022-44455.md)
  `CVE-2022-44455` · CVE record: OpenHarmony OpenHarmony · CVSS 6.8 Medium · Not analysed yet · Published 8 Dec 2022 · Tags: Memory corruption
- [Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres.](https://agentprime.io/advisories/CVE-2022-41802.md)
  `CVE-2022-41802` · CVE record: OpenHarmony OpenHarmony · CVSS 4.0 Medium · Not analysed yet · Published 8 Dec 2022 · Tags: Memory corruption
- [An abnormal packet recieved when distributedhardware_device_manager joining a network could cause a device reboot.](https://agentprime.io/advisories/CVE-2022-43495.md)
  `CVE-2022-43495` · CVE record: OpenHarmony OpenHarmony · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2022 · Tags: Memory corruption
- [Arbitrary file read via download_server.](https://agentprime.io/advisories/CVE-2022-43449.md)
  `CVE-2022-43449` · CVE record: OpenHarmony OpenHarmony · CVSS 6.2 Medium · Not analysed yet · Published 3 Nov 2022 · Tags: CWE-20
- [Multiple path traversal in appspawn and nwebspawn services.](https://agentprime.io/advisories/CVE-2022-43451.md)
  `CVE-2022-43451` · CVE record: OpenHarmony OpenHarmony · CVSS 8.4 High · Not analysed yet · Published 3 Nov 2022 · Tags: Authentication bypass
- [Kernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information in…](https://agentprime.io/advisories/CVE-2022-42464.md)
  `CVE-2022-42464` · CVE record: OpenHarmony OpenHarmony · CVSS 6.7 Medium · Not analysed yet · Published 14 Oct 2022 · Tags: Broken access control
- [Softbus_server in communication subsystem has a authenication bypass vulnerability in a callback handler function. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm pac…](https://agentprime.io/advisories/CVE-2022-42463.md)
  `CVE-2022-42463` · CVE record: OpenHarmony OpenHarmony · CVSS 8.3 High · Not analysed yet · Published 14 Oct 2022 · Tags: Authentication bypass
- [Out-of-bound memory read and write in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could read out-of-bound memory l…](https://agentprime.io/advisories/CVE-2022-41686.md)
  `CVE-2022-41686` · CVE record: OpenHarmony OpenHarmony · CVSS 5.1 Medium · Not analysed yet · Published 14 Oct 2022 · Tags: Memory corruption
- [Startup subsystem missed permission validation in param service. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause Do…](https://agentprime.io/advisories/CVE-2022-42488.md)
  `CVE-2022-42488` · CVE record: OpenHarmony OpenHarmony · CVSS 8.4 High · Not analysed yet · Published 14 Oct 2022 · Tags: Authentication bypass
- [IPC in communication subsystem has a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.](https://agentprime.io/advisories/CVE-2022-38701.md)
  `CVE-2022-38701` · CVE record: OpenHarmony OpenHarmony · CVSS 6.2 Medium · Not analysed yet · Published 9 Sept 2022 · Tags: Memory corruption
- [Tokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerabi…](https://agentprime.io/advisories/CVE-2022-38081.md)
  `CVE-2022-38081` · CVE record: OpenHarmony OpenHarmony · CVSS 6.2 Medium · Not analysed yet · Published 9 Sept 2022 · Tags: CWE-305
- [multimedia subsystem has a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.](https://agentprime.io/advisories/CVE-2022-38700.md)
  `CVE-2022-38700` · CVE record: OpenHarmony OpenHarmony · CVSS 8.8 High · Not analysed yet · Published 9 Sept 2022 · Tags: CWE-305
- [windowmanager in window subsystem has a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.](https://agentprime.io/advisories/CVE-2022-38064.md)
  `CVE-2022-38064` · CVE record: OpenHarmony OpenHarmony · CVSS 6.2 Medium · Not analysed yet · Published 9 Sept 2022 · Tags: CWE-305
- [Incorrect configuration of the cJSON library lead a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.](https://agentprime.io/advisories/CVE-2022-36423.md)
  `CVE-2022-36423` · CVE record: OpenHarmony OpenHarmony · CVSS 7.4 High · Not analysed yet · Published 9 Sept 2022 · Tags: CWE-16

Newest: <https://agentprime.io/advisories/technology/openharmony.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=openharmony&cursor=WyIyMDI0LTA0LTAyVDA2OjIzOjAzLjE0MTAwMFoiLCJDVkUtMjAyNC0yNDU4MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/openharmony/?cursor=WyIyMDI0LTA0LTAyVDA2OjIzOjAzLjE0MTAwMFoiLCJDVkUtMjAyNC0yNDU4MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.