CVE-2017-8119

The CVE-2017-8119 entry concerns Huawei UMA products (V200R001 and V300R001) with a privilege-elevation vulnerability caused by insufficient validation/improper processing of parameters. Attackers could craft specific packets to exploit these flaws to gain elevated privileges. Connected sources c...

Security Advisory - SQL Injection Vulnerabilities in Huawei UMA Product

There is a SQL injection vulnerability in the operation and maintenance module of Huawei UMA Product. An attacker logs in to the system as a common user and sends crafted HTTP requests that contain malicious SQL statements to the affected system. Due to a lack of input validation on HTTP requests...

Huawei UMA Product Elevation of Privilege Vulnerability

Huawei Unified Maintenance Audit UMA is a unified IT core resource operation and maintenance management and security audit platform designed for carriers, government, finance, electric power and large enterprises. An elevation of privilege vulnerability exists in the Huawei UMA product. Due to...

Huawei UMA product cross-site scripting vulnerability (CNVD-2017-12920)

Huawei Unified Maintenance Audit UMA is a unified IT core resource operation and maintenance management and security audit platform designed for carriers, government, finance, electric power and large enterprises. A cross-site scripting vulnerability exists in the Huawei UMA product. Due to...

Huawei UMA Product Elevation of Privilege Vulnerability (CNVD-2017-12928)

Huawei Unified Maintenance Audit UMA is a unified IT core resource operation and maintenance management and security audit platform designed for carriers, government, finance, electric power and large enterprises. An elevation of privilege vulnerability exists in the Huawei UMA product. Due to...

Security Advisory - Multiple Vulnerabilities in UMA Products

The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA product has the following vulnerabilities, which are introduced by software provided by...

SonicWALL Global Management System (GMS) / Analyzer Universal Management Appliance or Host (UMA / UMH) Information Disclosure

The SonicWALL Global Management System GMS / Analyzer running on the remote host is affected by an information disclosure vulnerability due to a failure to protect access to the /appliance/license.jsp script. An unauthenticated, remote attacker can exploit this issue to easily compute the...

CVE-2016-7110

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a different vulnerability than CVE-2016-7109...

CVE-2016-7108

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote authenticated users to obtain the MD5 hashes of arbitrary user passwords via unspecified vectors...

CVE-2016-7107

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system data integrity via unspecified vectors...

Design/Logic Flaw

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a different vulnerability than CVE-2016-7110...

Code injection

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system data integrity via unspecified vectors...

CVE-2016-7108

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote authenticated users to obtain the MD5 hashes of arbitrary user passwords via unspecified vectors...

CVE-2016-7109

CVE-2016-7109 concerns Huawei Unified Maintenance Audit (UMA) prior to V200R001C00SPC200. The vulnerability allows remote attackers to execute arbitrary commands by injecting special characters into the UMA interface, indicating a command execution flaw in the Huawei UMA component. The issue is e...

CVE-2016-7107

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system data integrity via unspecified vectors...

CVE-2016-7109

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a different vulnerability than CVE-2016-7110...

CVE-2016-7107

Huawei UMA (Unified Maintenance Audit) prior to V200R001C00SPC200 SPH206 is affected by CVE-2016-7107 due to insufficient parameter validation on certain pages, enabling remote attackers to reset arbitrary user passwords and thereby compromise data integrity via unspecified vectors. The issue is ...

CVE-2016-7110

CVE-2016-7110 — Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 is vulnerable to remote command execution via “special characters.” The NVD description states that an attacker can exploit this to execute arbitrary commands. References point to Huawei PSIRT advisory and a SecurityF...

CVE-2016-7110

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a different vulnerability than CVE-2016-7109...

CVE-2016-7108

Huawei UMA (Unified Maintenance Audit) before V200R001C00SPC200 SPH206 suffers an information disclosure where remote authenticated users can obtain MD5 hashes of arbitrary user passwords via unspecified vectors. The advisory HWPSIRT-2016-07051 notes a fix; apply Huawei software updates to mitiga...