105 matches found
Privilege escalation
On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3750...
CVE-2017-3748
On Lenovo VIBE mobile phones, improper access controls on the nacserver component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the root user commonly known as 'rooting' or "jail breaking" a device...
CVE-2017-3748
CVE-2017-3748 concerns Lenovo VIBE phones with improper access controls in the nac_server component. The issue, described as enabling privilege escalation to root when used in conjunction with CVE-2017-3749 and CVE-2017-3750, affects Android devices running affected Lenovo software. The connected...
CVE-2017-3750
On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3749...
CVE-2017-3750
On Lenovo VIBE phones, the Lenovo Security Android app allows private data to be backed up and restored via Android Debug Bridge, enabling tampering that leads to privilege escalation when exploited with CVE-2017-3748 and CVE-2017-3749. The root cause is described as improper access controls on t...
CVE-2017-3749
On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3750...
CVE-2017-3749
CVE-2017-3749 affects Lenovo VIBE phones (Idea Friend Android app). The vulnerability allows private data to be backed up and restored via Android Debug Bridge, enabling tampering that leads to privilege escalation when exploited with CVE-2017-3748 and CVE-2017-3750. Connected sources also descri...
CVE-2017-3748
On Lenovo VIBE mobile phones, improper access controls on the nacserver component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the root user commonly known as 'rooting' or "jail breaking" a device...
Back That App Up: Gaining Root on the Lenovo Vibe
In May of 2016, Mandiant’s Red Team discovered a series of vulnerabilities present on Lenovo’s Vibe P1 Android-based mobile device that allow local privilege escalation to the user “root”. Mandiant disclosed these vulnerabilities to Lenovo in May of 2016. Lenovo advised Mandiant that it should wo...
Lenovo VIBE nac_server Component Local Mobilization Vulnerability
VIBE is a line of Android smartphones from Lenovo. The nacserver component of Lenovo VIBE suffers from a local elevation of privilege vulnerability that can be exploited by an attacker to elevate privileges to root...
Micro Focus Vibe Directory Traversal Vulnerability
Micro Focus Vibe aggregates what users need to do their jobs.Vibe supports seamless and secure access.The Vibe mobile app securely stores login credentials for one or more Vibe sites, so users can easily and quickly connect to Vibe sites. A directory traversal vulnerability exists in Micro Focus...
Path traversal
An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...
CVE-2017-7433
An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...
CVE-2017-7433
An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...
CVE-2017-7433
An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...
CVE-2017-7433
CVE-2017-7433 affects Micro Focus Vibe 4.0.2 and earlier, with an absolute path traversal in the viewFile endpoint. The vulnerability permits a remote attacker to download arbitrary files from the server; authentication may not be required if Guest access is enabled (Guest access is disabled by d...
CVE-2011-0464
Unspecified vulnerability in Novell Vibe OnPrem 3.0 before Hot Patch 1 allows remote attackers to execute arbitrary code via unknown vectors...
Code injection
Unspecified vulnerability in Novell Vibe OnPrem 3.0 before Hot Patch 1 allows remote attackers to execute arbitrary code via unknown vectors...
CVE-2011-0464
Unspecified vulnerability in Novell Vibe OnPrem 3.0 before Hot Patch 1 allows remote attackers to execute arbitrary code via unknown vectors...
CVE-2011-0464
The CVE-2011-0464 entry concerns Novell Vibe OnPrem 3.0 prior to Hot Patch 1, with a remote code execution vulnerability described as unspecified vectors. The NVD record assigns a CVSS v2 base score of 10.0 (HIGH) and indicates network attack with no authentication required, affecting confidentia...