CVE-2017-8125

CVE-2017-8125 affects Huawei UMA product (software V200R001 and V300R001). It is a cross-site scripting (XSS) vulnerability caused by insufficient input validation in the UMA component, enabling an attacker to craft malicious links/scripts to perform XSS. CVSS v3.0 base score 6.1 (NETWORK/LOW com...

CVE-2017-8129

CVE-2017-8129 affects Huawei UMA products (software V200R001 and V300R001). The vulnerability is a privilege-elevation issue caused by insufficient validation/improper processing of parameters, enabling an attacker to craft specific packets to gain elevated privileges. Public details include CVSS...

CVE-2017-8130

The CVE-2017-8130 entry describes an information-leak vulnerability in Huawei UMA products. Affected software versions are V200R001 and V300R001, where an attacker could obtain sensitive information, leading to information leakage. The NVD data shows CVSSv3.0 base metrics: 6.5 (NETWORK, LOW compl...

CVE-2017-8121

The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information, causing information leak...

CVE-2017-8122

The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges...

CVE-2017-8128

The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges...

CVE-2017-8130

The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information, causing information leak...

Security Advisory - SQL Injection Vulnerabilities in Huawei UMA Product

There is a SQL injection vulnerability in the operation and maintenance module of Huawei UMA Product. An attacker logs in to the system as a common user and sends crafted HTTP requests that contain malicious SQL statements to the affected system. Due to a lack of input validation on HTTP requests...

Huawei UMA Product Elevation of Privilege Vulnerability

Huawei Unified Maintenance Audit UMA is a unified IT core resource operation and maintenance management and security audit platform designed for carriers, government, finance, electric power and large enterprises. An elevation of privilege vulnerability exists in the Huawei UMA product. Due to...

Huawei UMA product cross-site scripting vulnerability (CNVD-2017-12920)

Huawei Unified Maintenance Audit UMA is a unified IT core resource operation and maintenance management and security audit platform designed for carriers, government, finance, electric power and large enterprises. A cross-site scripting vulnerability exists in the Huawei UMA product. Due to...

Huawei UMA Product Elevation of Privilege Vulnerability (CNVD-2017-12928)

Huawei Unified Maintenance Audit UMA is a unified IT core resource operation and maintenance management and security audit platform designed for carriers, government, finance, electric power and large enterprises. An elevation of privilege vulnerability exists in the Huawei UMA product. Due to...

Security Advisory - Multiple Vulnerabilities in UMA Products

The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA product has the following vulnerabilities, which are introduced by software provided by...

SonicWALL Global Management System (GMS) / Analyzer Universal Management Appliance or Host (UMA / UMH) Information Disclosure

The SonicWALL Global Management System GMS / Analyzer running on the remote host is affected by an information disclosure vulnerability due to a failure to protect access to the /appliance/license.jsp script. An unauthenticated, remote attacker can exploit this issue to easily compute the...

CVE-2016-7110

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a different vulnerability than CVE-2016-7109...

CVE-2016-7108

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote authenticated users to obtain the MD5 hashes of arbitrary user passwords via unspecified vectors...

CVE-2016-7107

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system data integrity via unspecified vectors...

Code injection

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system data integrity via unspecified vectors...

Design/Logic Flaw

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a different vulnerability than CVE-2016-7110...

CVE-2016-7108

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote authenticated users to obtain the MD5 hashes of arbitrary user passwords via unspecified vectors...

CVE-2016-7107

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system data integrity via unspecified vectors...