PT-2019-4381

Name of the Vulnerable Software and Affected Versions HedEx Lite versions earlier than V200R006C00SPC007 Description The issue is related to a reflection XSS vulnerability in HedEx products, where remote attackers can send malicious links to users, tricking them into clicking, which can initiate...

CVE-2017-8139

HedEx Earlier than V200R006C00 versions have the stored cross-site scripting XSS vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services of legitimate users...

CVE-2017-8136

HedEx Earlier than V200R006C00 versions has an arbitrary file download vulnerability. An attacker could exploit it to download arbitrary files on a target device to cause information leak...

CVE-2017-8137

HedEx Earlier than V200R006C00 versions has a dynamic link library DLL hijacking vulnerability due to calling the DDL file by accessing a relative path. An attacker could exploit this vulnerability to tamper with the DLL file, leading to DLL hijacking...

CVE-2017-8137

HedEx Earlier than V200R006C00 versions has a dynamic link library DLL hijacking vulnerability due to calling the DDL file by accessing a relative path. An attacker could exploit this vulnerability to tamper with the DLL file, leading to DLL hijacking...

CVE-2017-8138

HedEx Earlier than V200R006C00 versions has a cross-site request forgery CSRF vulnerability. An attacker could trick a user into accessing a website containing malicious scripts which may tamper with configurations and interrupt normal services...

CVE-2017-8139

HedEx Earlier than V200R006C00 versions have the stored cross-site scripting XSS vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services of legitimate users...

CVE-2017-8136

HedEx Earlier than V200R006C00 versions has an arbitrary file download vulnerability. An attacker could exploit it to download arbitrary files on a target device to cause information leak...

CVE-2017-8138

HedEx Earlier than V200R006C00 versions has a cross-site request forgery CSRF vulnerability. An attacker could trick a user into accessing a website containing malicious scripts which may tamper with configurations and interrupt normal services...

Design/Logic Flaw

HedEx Earlier than V200R006C00 versions has a dynamic link library DLL hijacking vulnerability due to calling the DDL file by accessing a relative path. An attacker could exploit this vulnerability to tamper with the DLL file, leading to DLL hijacking...

Arbitrary file deletion

HedEx Earlier than V200R006C00 versions has an arbitrary file download vulnerability. An attacker could exploit it to download arbitrary files on a target device to cause information leak...

Cross site request forgery (csrf)

HedEx Earlier than V200R006C00 versions has a cross-site request forgery CSRF vulnerability. An attacker could trick a user into accessing a website containing malicious scripts which may tamper with configurations and interrupt normal services...

Cross site scripting

HedEx Earlier than V200R006C00 versions have the stored cross-site scripting XSS vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services of legitimate users...

CVE-2017-8136

HedEx Earlier than V200R006C00 versions has an arbitrary file download vulnerability. An attacker could exploit it to download arbitrary files on a target device to cause information leak...

CVE-2017-8136

Huawei HedEx/HedEx Lite (pre-V200R006C00) contains an arbitrary file download vulnerability (CVE-2017-8136) that could disclose arbitrary files on the target device, per the Huawei advisory and NVD entry. No exploitation details are provided in the documents beyond the vulnerability description. ...

CVE-2017-8138

Huawei HedEx (Huawei Electronic Documentation Explorer), versions earlier than V200R006C00, suffer a cross-site request forgery (CSRF) vulnerability. An attacker can entice a logged-in user to access a malicious page, causing unauthorized configuration changes and potential service disruption. Th...

CVE-2017-8138

HedEx Earlier than V200R006C00 versions has a cross-site request forgery CSRF vulnerability. An attacker could trick a user into accessing a website containing malicious scripts which may tamper with configurations and interrupt normal services...

CVE-2017-8139

CVE-2017-8139 affects Huawei HedEx/HedEx Lite prior to V200R006C00. The vulnerability is a stored cross-site scripting (XSS) flaw in the configuration file, enabling an attacker to embed malicious scripts and disrupt legitimate users’ services. Descriptions consistently indicate the issue resides...

CVE-2017-8137

Huawei HedEx (HedEx Lite) prior to V200R006C00 suffers a DLL hijacking vulnerability caused by calling a DLL via a relative path. The issue enables tampering with the DLL file and is described for HedEx products in CVE-2017-8137. Affected versions are earlier than V200R006C00; Huawei’s advisory r...

CVE-2017-8138: Cross-Site Request Forgery (CSRF)

HedEx Earlier than V200R006C00 versions has a cross-site request forgery CSRF vulnerability. An attacker could trick a user into accessing a website containing malicious scripts which may tamper with configurations and interrupt normal services...