CVE-2020-1842

CVE-2020-1842: Affected Huawei devices (HEGE-560; OSCA-550/550A/550X family) expose an insufficient authentication flaw that can be exploited with physical access to obtain high privileges. Root cause is authentication weakness allowing attackers with local access to perform privileged operations...

CVE-2020-1842

Huawei HEGE-560 version 1.0.1.20SP2; OSCA-550 and OSCA-550A version 1.0.0.71SP1; and OSCA-550AX and OSCA-550X version 1.0.0.71SP2 have an insufficient authentication vulnerability. An attacker can access the device physically and perform specific operations to exploit this vulnerability. Successf...

CVE-2020-1789

Huawei OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X products with version 1.0.1.21SP3 have an insufficient authentication vulnerability. The software does not require a strong credential when the user trying to do certain operations. Successful exploit could allow an attacker to pass the...

CVE-2020-1789

CVE-2020-1789 affects Huawei OSCA-550 series (OSCA-550/550A/550AX/550X) with version 1.0.1.21(SP3). The issue is insufficient authentication: the software may grant access to certain operations with a weak credential, enabling an attacker to pass authentication and perform actions. The vulnerabil...

CVE-2020-1855

Huawei HEGE-570 version 1.0.1.22SP3; and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21SP3 have an insufficient verification vulnerability. An attacker can access the device physically and exploit this vulnerability to tamper with device information. Successful exploit...

CVE-2020-1855

CVE-2020-1855 affects Huawei HEGE-570 (1.0.1.22 SP3) and HEGE-560, OSCA-550/550A/550AX/550X (1.0.1.21 SP3) with an insufficient verification vulnerability. An attacker with physical access can tamper with device information, potentially causing service abnormality. Huawei has released software up...

CVE-2020-1843

CVE-2020-1843 affects Huawei HEGE-560 and several OSCA/OSCA variants (OSCA-550, OSCA-550A, OSCA-550AX, OSCA-550X) with an insufficient verification vulnerability. The issue enables an attacker to perform specific operations via physical access, potentially resulting in illegal actions. Root cause...

CVE-2020-1843

Huawei HEGE-560 version 1.0.1.20SP2, OSCA-550 version 1.0.0.71SP1, OSCA-550A version 1.0.0.71SP1, OSCA-550AX version 1.0.0.71SP2, and OSCA-550X version 1.0.0.71SP2 have an insufficient verification vulnerability. An attacker can perform specific operations to exploit this vulnerability by physica...

Cisco 250 Series Smart Switches, 350 Series Managed Switches, and 550X Series Stackable Managed Switches Cross-Site Request Forgery Vulnerability

Cisco 250 Series Smart Switches and so on are the products of Cisco, Inc.Cisco 250 Series Smart Switches is a 250 Series Smart Switch.Cisco 350 Series Managed Switches is a 350 Series Managed Switch.550X Series Stackable Managed Switches is a 550X Series Managed Switch. Cisco 350 Series Managed...

conventocristo.gov.pt Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-990550 Security Researcher meltdown Helped patch 7 vulnerabilities Received 0 Coordinated Disclosure badges Received 1 recommendations , found a security vulnerability affecting conventocristo.gov.pt website and its users. Following coordinated and responsible vulnerabilit...

AMD ATIDXX64.DLL Memory Corruption Vulnerability

AMD ATIDXX64.DLL is a driver from AMD. A memory corruption vulnerability exists in AMD ATIDXX64.DLL versions 25.20.15031.5004 and 25.20.15031.9002 running on Radeon RX 550 / 550 Series VMware Workstation 15 15.0.4 build-12990004 versions. A memory corruption vulnerability exists in VMware...

devolo dLAN 550 duo+ Starter Kit Remote Code Execution

Summary Devolo dLAN® 550 duo+ Starter Kit is Powerlineadapter which is a cost-effective and helpful networking alternative for any location without structured network wiring. Especially in buildings or residences lacking network cables or where updating the wiring would be expensive and...

devolo dLAN 550 duo+ Starter Kit Cross-Site Request Forgery

Summary Devolo dLAN® 550 duo+ Starter Kit is Powerlineadapter which is a cost-effective and helpful networking alternative for any location without structured network wiring. Especially in buildings or residences lacking network cables or where updating the wiring would be expensive and...

Franklin Fueling Systems TS-550 evo File Upload Vulnerability

The Franklin Fueling Systems TS-550 evo is a fuel management system from Franklin Fueling Systems USA. The system monitors fuel storage and provides an intuitive and easy to recognize interface for alarm functions. A security vulnerability exists in the Franklin Fueling Systems TS-550 evo version...

Franklin Fueling Systems TS-550 evo File Download Vulnerability

The Franklin Fueling Systems TS-550 evo is a fuel management system from Franklin Fueling Systems USA. The system monitors fuel storage and provides an intuitive and easy to recognize interface for alarm functions. A security vulnerability exists in the Franklin Fueling Systems TS-550 evo version...

CVE-2017-6564

On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the Guest user, which contains the lowest privileges, can post to the idSourceFileName parameter found within the /download directory. This ability allows for an attacker to download sensitive system files from the host machine such as...

CVE-2017-6564

On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the Guest user, which contains the lowest privileges, can post to the idSourceFileName parameter found within the /download directory. This ability allows for an attacker to download sensitive system files from the host machine such as...

CVE-2017-6565

On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the ability to upload files to the server hosting the web service. As no sanitization checks are in place, an attacker can upload a malicious payload...

Cross site request forgery (csrf)

On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the Guest user, which contains the lowest privileges, can post to the idSourceFileName parameter found within the /download directory. This ability allows for an attacker to download sensitive system files from the host machine such as...

Design/Logic Flaw

On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the ability to upload files to the server hosting the web service. As no sanitization checks are in place, an attacker can upload a malicious payload...