Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Staging: r8188eu: fixed a memory leak in rtwwxread32 Free “ptmp” before returning – EINVIL...

DEBIAN-CVE-2021-47570

In the Linux kernel, the following vulnerability has been resolved: staging: r8188eu: fix a memory leak in rtwwxread32 Free "ptmp" before returning -EINVAL...

UBUNTU-CVE-2021-47570

In the Linux kernel, the following vulnerability has been resolved: staging: r8188eu: fix a memory leak in rtwwxread32 Free "ptmp" before returning -EINVAL...

CVE-2022-21141

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization checks on multiple API functions. An attacker may gain access to these functions and achieve remote code execution...

CVE-2022-21800

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed...

CVE-2022-21176

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input, which may allow an attacker to perform a SQL injection and obtain sensitive information...

CVE-2022-21215

This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker could force the server into accessing...

CVE-2022-0138

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserialization function that does not validate or check the data, allowing arbitrary classes to be created...

Design/Logic Flaw

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed...

Sql injection

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input, which may allow an attacker to perform a SQL injection and obtain sensitive information...

Command injection

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input on several locations, which may allow an attacker to inject arbitrary commands...

CVE-2022-21141

Airspan Networks/Mimosa CVE-2022-21141 describes improper authorization on multiple API functions in MMP, PTP C-series, PTMP C-series and A5x, allowing remote code execution, DoS, and information disclosure. Affected versions: MMP < 1.0.3; PTP C-series < 2.8.6.1; PTMP C-series/A5x

CVE-2022-21176

CVE-2022-21176 affects Airspan/Mimosa MMP and related C-series and A5x device versions: improper input sanitization leads to SQL injection and potential exposure of sensitive data. Affected versions: MMP < 1.0.3; PTP C-series < 2.8.6.1; PTMP C-series/A5x

CVE-2022-0138

CVE-2022-0138 describes a deserialization of untrusted data issue in Airspan/Mimosa MMP stack. Affected: MMP (all versions before v1.0.3), PTP C-series (versions before v2.8.6.1), and PTMP C-series and A5x (versions before v2.5.4.1). Root cause: a deserialization function that does not validate o...

CVE-2022-21215

CVE-2022-21215 is an SSRF vulnerability in Airspan/Mimosa MMP stack. Affected: MMP before v1.0.3; PTP C-series before v2.8.6.1; PTMP C-series/A5x before v2.5.4.1. Root cause: improper server-side request handling allows an attacker to force the server to access internal routes and cloud-hosting p...

CVE-2022-21143: Improper Neutralization of Special Elements used in an OS Command

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input on several locations, which may allow an attacker to inject arbitrary commands...

CVE-2022-21215: Server-Side Request Forgery (SSRF)

This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker could force the server into accessing...

CVE-2022-21800: Use of a Broken or Risky Cryptographic Algorithm

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed...

PT-2022-14916 · Mmp +2 · Mmp +2

Name of the Vulnerable Software and Affected Versions: MMP versions prior to 1.0.3 PTP C-series versions prior to 2.8.6.1 PTMP C-series and A5x versions prior to 2.5.4.1 Description: The issue concerns improper authorization and authentication checks on multiple API routes. This could allow an...

CVE-2022-21196: Improper Authorization

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. An attacker may gain access to these API routes and achieve remo...