1009 matches found
Security Advisory - Lock-screen Bypass Vulnerability in Huawei Smartphones
There is a lock-screen bypass vulnerability in Huawei smartphones. An unauthenticated attacker could force the phone to the fastboot mode and delete the user's password file during the reboot process, then login the phone without screen lock password after reboot. Vulnerability ID:...
Security Advisory - E-mail Information Leak Vulnerability in Android System
The Security Bulletin describes an E-mail Information Leak Vulnerability in Android System discovered by Google CVE-2016-3918. An attacker tricks a user into installing a malicious application on the smart phone, and send given parameter to smart phone to obtain information in the...
Security Advisory - DLL Hijacking Vulnerability on Huawei UTPS
Huawei UTPS software runs on USB modem products to manage data cards. It provides data card setting, dial-up setting, message sending and receiving, and contacts management functions. UTPS contains a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by UTPS...
Security Advisory - DNS Static Source Port Vulnerability in Huawei E5151 and E5186
Huawei E5151 and E5186 allow DNS query packets using the static source port. Attackers can exploit the vulnerability to launch DNS Spoofing Attack and compromise the normal service of DNS. Vulnerability ID: HWPSIRT-2015-10001 This vulnerability has been assigned Common Vulnerabilities and Exposur...
Security Advisory - Two Vulnerabilities in Huawei TE Series Product
Huawei TE series is a multimedia video conferencing endpoint that transfers audio, video, and desktop resources based on IP networks. It offers point-to-point and multiparty conferences for attendees at different places to enjoy face-to-face audio/video communication experience. A security...
Security Advisory - Improper Handling of Length Parameter Inconsistency in a Huawei PC Product
A Huawei PC product is vulnerable to improper handling of length parameter inconsistency. Successful exploitation of this vulnerability can compromise the data structure stored at the beginning of SMRAM and may cause code execution in SMM.Vulnerability ID:HWPSIRT-2023-91490 This vulnerability has...
Security Advisory - Misinterpretation of Input in a Huawei Printer Product
A Huawei printer product is vulnerable to misinterpretation of input. Successful exploitation could lead to DoS. Vulnerability ID:HWPSIRT-2022-44321 This vulnerability has been assigned a CVE ID: CVE-2022-48230...
Security Advisory - Path Traversal Vulnerability in Huawei PC Product
There is a path traversal vulnerability in Huawei PC product. Because the product does not filter path with special characters,attackers can construct a file path with special characters to exploit this vulnerability. Successful exploitation could allow the attacker to transport a file to certain...
Security Advisory - Path Traversal Vulnerability in Some Huawei Products
There is a path traversal vulnerability in some Huawei products. The vulnerability is due to that the software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly...
Security Advisory - Memory Leak Vulnerability in Huawei Products
There is a memory leak vulnerability in Huawei products. A resource management weakness exists in a module. Attackers with high privilege can exploit this vulnerability by performing some operations. This can lead to memory leak. Vulnerability ID: HWPSIRT-2020-89990 This vulnerability has been...
Security Advisory - Improper Licenses Management Vulnerability in Some Products
There has a license management vulnerability in some huawei products. An attacker with high privilege needs to perform specific operations to exploit the vulnerability on the affected device. Due to improper license management of the device, as a result, the license file can be applied and affect...
Security Advisory - Privilege Escalation Vulnerability in Huawei FusionCompute Product
There is a privilege escalation vulnerability in Huawei FusionCompute product. Due to insufficient verification on specific files that need to be deserialized, local attackers can exploit this vulnerability to elevate permissions. Vulnerability ID: HWPSIRT-2020-05241 This vulnerability has been...
Security Advisory - Denial of Service Vulnerability in Several Smartphones
There is a denial of service vulnerability in several smartphones. Certain service in the system does not sufficiently validate certain parameter which is received, the attacker should trick the user into installing a malicious application, successful exploit could cause a denial of service...
Security Advisory - Race Condition Vulnerability in Several Smartphones
There is a race condition vulnerability in several smartphones. There is a timing window exists in which certain pointer members can be modified by another process that is operating concurrently, an attacker should trick the user into running a crafted application with high privilege, successful...
Security Advisory - Information Leak Vulnerability in Some Huawei Products
There is an information leak vulnerability in some Huawei products. An unauthenticated, remote attacker can make a large number of attempts to guess information. Successful exploitation may cause information leak. Vulnerability ID: HWPSIRT-2019-10453 This vulnerability has been assigned a Common...
Security Advisory - DoS Vulnerability in Some Huawei Smart Phones
Some Huawei mobile phone versions have a denial of service DoS vulnerability because they do not adapt to specific screen gestures. An attacker may trick users into installing a malicious app. As a result, apps running on the frontend crash after the users make specific screen gestures...
Security Advisory - Authentication Bypass Vulnerability in Some Huawei Servers
There is an authentication bypass vulnerability in some Huawei servers. A remote attacker with low privilege may bypass the authentication by some special operations. Due to insufficient authentication, an attacker may exploit the vulnerability to get some sensitive information and high-level...
Security Advisory - Buffer Overflow Vulnerability in eNSP Software
There is a buffer overflow vulnerability in eNSP software. Due to the improper validation of specific command line parameter, a local attacker could exploit this vulnerability to cause the software process abnormal. Vulnerability ID: HWPSIRT-2017-12012 This vulnerability has been assigned a Commo...
Security Advisory - Weak Cryptography Vulnerability in Some Huawei Products
Some Huawei products have a weak cryptography vulnerability. Due to not properly some values in the certificates, an unauthenticated remote attacker could forges a specific RSA certificate and exploits the vulnerability to pass identity authentication and logs into the target device to obtain...
Security Advisory - DoS Vulnerability in Timergrp Module of Some Huawei Products
There is an DoS vulnerability in Timergrp module of some Huawei products due to insufficient validation of the parameter. An authenticated local attacker may call a special API with special parameter, which cause an infinite loop. Successful exploit of this vulnerability can allow an attacker to...
Security Advisory - Memory Leak Vulnerability in Some Huawei Products
Some Huawei products have a memory leak vulnerability. An unauthenticated attacker may send specific Resource ReServation Protocol RSVP packets to the affected products. Due to not release the memory to handle the packets, successful exploit will result in memory leak of the affected products and...
Security Advisory - Several Vulnerabilities in H323 protocol of Huawei Products
There are two out-of-bounds read vulnerabilities in H323 protocol of Huawei products. An attacker logs in to the system as a user and send crafted packets to the affected products. Due to insufficient verification of the packets, successful exploit will cause process reboot. Vulnerability ID:...
Security Advisory - Information Leak Vulnerability in Huawei Hilink APP
Huawei Hilink APP has an information leak vulnerability. An attacker may trick a user into installing a malicious application and application can access Hilink APP data. Vulnerability ID: HWPSIRT-2017-01092 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID:...
Security Advisory - Phone Finder Bypass Vulnerability in Some Huawei Smart Phones
Phone Finder is a Huawei security method that was designed to make sure someone can't just wipe and factory reset the phone if user lost it or it was stolen. The Phone Finder in some Huawei smart phones can be bypass. An attacker can bypass the Phone Finder by special steps and obtain the owner o...
Security Advisory - Stack Overflow Vulnerability in Drive of Huawei Smart Phones
There is a stack overflow vulnerabilities in touchscreen drive of some Huawei Smart phones. An attacker tricks a user into installing a malicious application on the smart phone, and send given parameter to touchscreen drive to crash the system or escalate privilege Vulnerability ID:...
Security Advisory - Two Command Injection Vulnerabilities in Huawei UMA
The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA has two command injection vulnerabilities due to the lack of validation on special fields. A...
Security Advisory - XSS Vulnerability in Huawei OceanStor ISM
The OceanStor ISM is an integrated system management software product that allows users to manages CSS, view CSS alarms and some other types of basic information, and configure basic functions. The management interface of the OceanStor ISM has a XSS vulnerability because the system does not escap...
Security Advisory - Input Validation Vulnerability in Multiple Huawei Products
There is an input validation vulnerability in Huawei multiple products, an attacker with control plane access may exploit this vulnerability by crafting a malformed packet. An exploit could allow the attacker to cause a Denial of Service or execute arbitrary code. Vulnerability ID:...
Security Advisory - Privilege Escalation Vulnerability in Huawei LogCenter
Huawei LogCenter has a privilege escalation vulnerability. After login to the LogCenter, a low privileged attacker can tamper with requests using a tool and submit the request to the server for privilege escalation, affecting some system functions. Vulnerability ID: HWPSIRT-2015-09020 This...
Security Advisory - VENOM Vulnerability in Huawei Products
Huawei has noticed the buffer overflow vulnerability in the floppy disk controller FDC of QEMU disclosed by open source organization Xen. This vulnerability allows an attacker to escape out of the virtual machine, execute code on the physical host with full privilege. Vulnerability ID:...
Security Advisory-Multiple Vulnerabilities on Huawei Tecal
Some Huawei server products have multiple security vulnerabilities. 1.Some Huawei server products have the sensitive information leak vulnerability. Users who log in to the products can view the sessions IDs of all online users on the Online Users page of the web UI. Attackers can also view the...
Security Advisory-Heap Overflow Vulnerability in Huawei eSap Platform
Huawei eSap software platform has four heap overflow vulnerabilities. Huawei products that have used this platform are affected. When receiving some special malformed packets, such devices access heap memory that is beyond the valid range and cause unexpected restart of the devices. If an attacke...
Security Advisory - Improper Input Validation Vulnerability in a Huawei Children's Watch
Huawei Aslan Children's Watch has an improper input validation vulnerability. Successful exploitation may cause the watch's application service abnormal. Vulnerability ID:HWPSIRT-2022-53187 This vulnerability has been assigned a CVE ID: CVE-2022-39012...
Security Advisory - Command Injection Vulnerability in Huawei Product
There is a command injection vulnerability in Huawei terminal printer product. Successful exploitation could result in the highest privileges of the printer. Vulnerability ID: HWPSIRT-2022-51773 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2022-32203. Fo...
Security Advisory - Improper Signature Management Vulnerability in Some Huawei Products
There is a signature management vulnerability in some huawei products. An attacker can forge signature and bypass the signature check. During firmware update process, successful exploit this vulnerability can cause the forged system file overwrite the correct system file. Vulnerability ID:...
Security Advisory - Improper File Upload Control Vulnerability in Huawei FusionCompute Product
There is an improper file upload control vulnerability in Huwei FusionCompute product. Due to the improper verification of file to be uploaded and does not strictly restrict the file access path, attackers may upload malicious files to the device, resulting in the service abnormal. Vulnerability...
Security Advisory - Out of Bounds Write Vulnerability in Huawei Smartphone
There is an out of bounds write vulnerability in Huawei Smartphone product when processing a message. An unauthenticated attacker can exploit this vulnerability by sending specific message to the target device. Due to insufficient validation of the input parameter, successful exploit can cause th...
Security Advisory - Use After Free Vulnerability in Huawei Product
There is a use-after-free vulnerability in Huawei product. A module cannot deal with specific operations in special scenarios. Attackers can exploit this vulnerability by performing malicious operations. This can cause memory use-after-free, compromising normal service. Vulnerability ID:...
Security Advisory - Improper Authentication Vulnerability in Several Smartphones
There is an improper authentication vulnerability in several smartphones. The system does not properly sign certain encrypted file, the attacker should gain the key used to encrypt the file, successful exploit could cause certain file be forged. Vulnerability ID: HWPSIRT-2019-10020 This...
Security Advisory - Improper Authentication Vulnerability in Several Smartphones
There is an improper authentication vulnerability in several smartphones. The system does not sufficiently validate certain parameter passed from the bottom level, the attacker should trick the user into installing a malicious application and control the bottom level, successful exploit could cau...
Security Advisory - Improper Authentication Vulnerability in Several Smartphones
There is an improper authentication vulnerability in several smartphones. The device does not sufficiently validate certain credential of user's face, an attacker could craft the credential of the user, successful exploit could allow the attacker to pass the authentication with the crafted...
Security Advisory - DoS Vulnerability in Some Huawei Smartphones
There is a denial of service DoS vulnerability in some Huawei Smartphones. An attacker tricks a user into installing a malicious application. Since the system does not verify the broadcasting message from the application, it could be exploited to cause some functions of system unavailable...
Security Advisory - Memory Leak Vulnerability in Some Huawei Products
Some Huawei products have a memory leak vulnerability. When the packet processing module of the device processes abnormal Multiprotocol Label Switching MPLS packets sent by attackers, the module repeatedly applies for memory, resulting in memory exhaustion in persistent attacks. Vulnerability ID:...
Security Advisory - Multiple Injection Vulnerabilities in UDS
The OceanStor UDS has some vulnerability: Attacker injects JavaScript into patch. After the patch is loaded through the OceanStor DeviceManager, the returned content contains the injected script. After the script is parsed and executed on the OceanStor DeviceManager, information leak occurs...
Security Advisory-Multiple Heap Overflow Vulnerabilities in Huawei Campus Series Switches
Some Huawei Campus series switches have three heap overflow vulnerabilities. When receiving some special malformed packets, such devices access heap memory that is beyond the valid range and cause unexpected restart of the devices. If an attacker keeps sending such malformed packets, the devices...
Security Advisory - Huawei PC Product Vulnerable to Improper Check for Unusual or Exceptional Conditions
A Huawei PC product is vulnerable to improper check for unusual or exceptional conditions. An attacker with the common privilege can exploit this vulnerability. Successful exploitation of this vulnerability could cause OS service exceptions.Vulnerability ID:HWPSIRT-2023-25233 This vulnerability h...
Security Advisory - Information Leakage Vulnerability in Some Huawei Product
There is an information leakage vulnerability in some huawei products. Due to the improperly storage of specific information in the log file, the attacker can obtain the information when a user logs in to the device. Successful exploit may cause the information leak. Vulnerability ID:...
Security Advisory - Information Leak Vulnerability in Huawei Products
There is an information leak vulnerability. A command does not have timeout exit mechanism. Temporary file contains sensitive information. This allows attackers to obtain information by inter-process access that requires other methods. Vulnerability ID: HWPSIRT-2020-01428 This vulnerability has...
Security Advisory - Insufficient Input Validation Vulnerability in Some Huawei Phones
There is an insufficient input validation vulnerability in some Huawei products. Due to the input validation logic is incorrect, an attacker can exploit this vulnerability to access and modify the memory of the device by doing a series of operations. Successful exploit may cause the service...
Security Advisory - Improper Authorization Vulnerability in Several Smartphones
There is an improper authorization vulnerability in several smartphones. The system does not properly restrict the use of system service by applications, the attacker should trick the user into installing a malicious application, successful exploit could cause a denial of audio service...