PEI Stage Backdoor for UEFI Compatible Firmware: PeiBackdoor

PEI Stage Backdoor for UEFI Compatible Firmware This project implements early stage firmware backdoor for UEFI based firmware. It allows to execute arbitrary code written in C during Pre EFI Init PEI phase of Platform Initialization PI. This backdoor might be useful for low level manipulations wi...

Security Advisory - Two Command Injection Vulnerabilities in Huawei UMA

The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA has two command injection vulnerabilities due to the lack of validation on special fields. A...

Security Advisory - Reset Password and Information Leak Vulnerabilities in Huawei UMA

The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA has two security vulnerabilities. One vulnerability is due to insufficient parameter...

Dell SonicWALL GMS/Analyzer/UMA 8.0, 8.1 XXE Vulnerability - Active Check

Dell SonicWALL GMS/Analyzer/UMA is prone to an XML external entity XXE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Arbitrary Code Execution Vulnerability in Multiple Dell Products

Dell SonicWALL GMSGMS is a global management system for rapid deployment and centralized management of SonicWALL infrastructures.Analyzer is a set of network analyzer software for SonicWALL infrastructures.UMA EM5000 is a set of universal management appliance software.GMS ViewPoint GMSVP web...

CVE-2016-2397

The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data...

CVE-2016-2396

The GMS ViewPoint GMSVP web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via vectors related to configuration input...

Code injection

The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data...

CVE-2016-2396

CVE-2016-2396 affects Dell SonicWALL GMS ViewPoint (GMSVP) web app used by Dell SonicWALL GMS/Analyzer/UMA EM5000 versions 7.2, 8.0, 8.1 prior to Hotfix 168056. Affected component is the GMSVP web interface where input in configuration fields is not safely sanitized, allowing a remote authenticat...

CVE-2016-2397

The CVE-2016-2397 entry concerns the cliserver component in Dell SonicWALL GMS, Analyzer, and UMA EM5000 (versions 7.2, 8.0, 8.1 prior to Hotfix 168056). The vulnerability allows remote attackers to deserialize XML data and execute arbitrary Java code on affected systems. The underlying issue is ...

CVE-2016-2397

The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data...

Dell Sonicwall GMS AnalyzerUMA EM5000 Arbitrary Command Execution Vulnerability

The Dell Sonicwall GMS AnalyzerUMA EM5000 is the Analyzer module of the centralized GMS platform for Dell's SonicWALL security products. An arbitrary command execution vulnerability exists in the Dell Sonicwall GMS, Analyzer,UMA EM5000 that could allow an authenticated remote user to execute...

Design/Logic Flaw

The GMS ViewPoint GMSVP web application in Dell Sonicwall GMS, Analyzer, and UMA EM5000 before 7.2 SP4 allows remote authenticated users to execute arbitrary commands via vectors related to configuration...

CVE-2015-3990

CVE-2015-3990 affects the Dell SonicWall GMS suite (GMS ViewPoint web app) on GMS, Analyzer, and UMA EM5000 prior to 7.2 SP4. Affected component: GMSVP web application; vulnerability enables remote authenticated users to execute arbitrary commands via configuration-related input handling. Root ca...

CVE-2014-8420

The ViewPoint web application in Dell SonicWALL Global Management System GMS before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicWALL UMA before 7.2 SP2 allows remote authenticated users to execute arbitrary code via unspecified vectors...

Multiple Dell SonicWALL Products CVE-2014-8420 Multiple Remote Code Execution Vulnerabilities

The ViewPoint web application in Dell SonicWALL Global Management System GMS before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicWALL UMA before 7.2 SP2 allows remote authenticated users to execute arbitrary code via unspecified vectors. CVE: CVE-2014-8420 Last updated: March 12, 2018, 5:...

CVE-2014-8420

CVE-2014-8420 affects Dell SonicWALL GMS suite: ViewPoint web application in GMS, SonicWALL Analyzer, and SonicWALL UMA up to version 7.2 SP2. The vulnerability is a remote code execution flaw in the ViewPoint component, arising from insufficient input/config handling, allowing a remote authentic...

CVE-2014-8420

The ViewPoint web application in Dell SonicWALL Global Management System GMS before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicWALL UMA before 7.2 SP2 allows remote authenticated users to execute arbitrary code via unspecified vectors...

CVE-2014-5024

CVE-2014-5024 is a cross-site scripting (XSS) vulnerability in Dell SonicWALL GMS, Analyzer, and UMA, affecting the sgms/panelManager component. The issue allows remote attackers to inject arbitrary web script or HTML via the node_id parameter. The vulnerability is described in several connected ...

CVE-2014-0332

Cross-site scripting XSS vulnerability in mainPage in Dell SonicWALL GMS before 7.1 SP2, SonicWALL Analyzer before 7.1 SP2, and SonicWALL UMA E5000 before 7.1 SP2 might allow remote attackers to inject arbitrary web script or HTML via the nodeid parameter in a ScreenDisplayManager genNetwork acti...