1006 matches found
Security Advisory - Out-of-bounds Read Vulnerability in Advanced Packages of Gauss100 OLTP Database
There is an out-of-bounds read vulnerability in the Advanced Packages feature of the Gauss100 OLTP database. Attackers who gain the specific permission can use this vulnerability by sending elaborate SQL statements to the database. Successful exploit of this vulnerability may cause the database t...
Security Advisory - Improper Credentials Management Vulnerability in Some Products
There is an improper credentials management vulnerability in some products. The software does not properly manage certain credential, successful exploit could cause information disclosure or damage, and impact the confidentiality or integrity. Vulnerability ID: HWPSIRT-2018-12263 This vulnerabili...
Security Advisory - FragmentSmack Vulnerability in Linux Kernel
There is a DoS vulnerability in the Linux Kernel versions 3.9+ known as a FragmentSmack attack. Remote attackers could send fragmented IPv4 or IPv6 packets to the affected device to trigger time and calculation reassembly algorithms that could consume excessive CPU resources, resulting in a DoS...
Security Advisory-SSLv3 POODLE Vulnerability in Huawei Products
The SSLv3 protocol supported by some Huawei products has the so-called Padding Oracle On Downgraded Legacy Encryption POODLE vulnerability. The attacker can launch a man-in-the-middle attack to manipulate the TLS negotiation process so that the communication parties use SSLv3, which has informati...
Security Advisory - Two Vulnerabilities in SaltStack Salt
An authentication bypass vulnerability was discovered in SaltStack Salt. An attacker may exploit the vulnerability to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions. Vulnerability ID: HWPSIRT-2020-05592 This vulnerability has been assigned a Common...
Security Advisory - Denial of Service Vulnerability in Some Huawei Products
There is a denial of service vulnerability in some Huawei products. Due to improper memory management, memory leakage may occur in some special cases. Attackers can perform a series of operations to exploit this vulnerability. Successful exploit may cause a denial of service. Vulnerability ID:...
Security Advisory - Authentication Bypass Vulnerability in the Backup Function of GaussDB
The backup function of GaussDB has an authentication bypass vulnerability. An attacker with low privilege may bypass the authentication of the backup function of database to start or stop the backup function, causing the backup function abnormal. Vulnerability ID: HWPSIRT-2017-05044 This...
Security Advisory - Stack Buffer Overflow Vulnerability in Several Products
There is a stack buffer overflow vulnerability in several products. The program copies an input buffer to an output buffer without verification. An attacker in the adjacent network could send a crafted message, successful exploit could lead to stack buffer overflow which may cause malicious code...
Security Advisory - DoS Vulnerability in Some Huawei Products
Some Huawei products have a DoS security vulnerability. Attackers with certain permissions perform specific operations on affected devices. Because the pointer in the program is not processed properly, the vulnerability can be exploited to cause the device to be abnormal. Vulnerability ID:...
Security Advisory - Two Vulnerabilities in Some Huawei Home Routers
Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an attacker can exploit this vulnerability by sending special constructed packets to obtain files in the device and upload files to some directories. Vulnerability ID:...
Security Advisory - Remote Code Execution Vulnerability in Jackson JSON library of Apache Struts2
Apache Struts2 released a remote code execution vulnerability in S2-055 on the official website. An attacker is possible to perform a Remote Code Execution RCE attack with a malicious JSON packet. Vulnerability ID: HWPSIRT-2017-12002 This vulnerability has been assigned a Common Vulnerabilities a...
Security Advisory - JavaScript Injection Vulnerability in Huawei Smartphone
There is a JavaScript injection vulnerability in Huawei smartphone. A module does not verify some inputs sufficiently. Attackers can exploit this vulnerability by sending malicious application request to launch JavaScript injection. This may compromise normal service. Vulnerability ID:...
Security Advisory - Intel Microarchitectural Data Sampling (MDS) vulnerabilities
Intel officially released a group of microarchitecture data sampling MDS vulnerabilities. An attacker with local access to a targeted system may exploit these vulnerabilities to obtain data on the targeted system, causing some information leakage. Vulnerability ID: HWPSIRT-2019-05136,...
Security Advisory - Information Leakage Vulnerability in Motion Sensor
Motion sensor in some Huawei smart phones has an information leakage vulnerability. An attacker may exploit this vulnerability to obtain specific information from the motion sensor through an APP installed on the smart phone and track the user. Successful exploit may cause information leak...
Security Advisory - Digital Balance Bypass Vulnerability in Huawei Smart Phones
There is a digital balance bypass vulnerability in some Huawei smart phones. When re-configuring the mobile phone at the digital balance mode, an attacker can perform some operations to bypass the startup wizard, and then open some switch. As a result, the digital balance function is bypassed...
Security Advisory - Remote Code Execution Vulnerability in Microsoft Windows SMBv1
Microsoft released a security advisory about a remote code execution vulnerability in Server Message Block Version 1 SMBv1. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server. Vulnerability ID: HWPSIRT-2020-06149 This vulnerability...
Security Advisory - Buffer Error Vulnerability in Some Huawei Products
There is a buffer error vulnerability in some Huawei products. An unauthenticated, remote attacker could send specific MPLS Echo Request messages to the target products. Due to insufficient input validation of some parameters in the messages, successful exploit may cause the device to reset...
Security Advisory - Improper Authorization Vulnerability in Several Smartphones
There is an improper authorization vulnerability in several smartphones. The software does not properly restrict certain operation of certain privilege, the attacker should trick the user into installing a malicious application before the user turns on student mode function. Successful exploit...
Security Advisory - Remote Code Execution Vulnerability in Microsoft Office
Microsoft released a security advisory to disclose a remote code execution vulnerability in Microsoft Office. Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office. The attacker could exploit the vulnerability to run...
Security Advisory - Escalation of Privilege Vulnerability in Intel AMT, Intel ISM and Intel SMT
Intel disclosed an escalation of privilege vulnerability in Intel Active Management Technology AMT, Intel Standard Manageability ISM, and Intel Small Business Technology in Security Center advisory INTEL-SA-00075. Unprivileged attackers could exploit this vulnerability to gain control of the...
Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones
There is an information leak vulnerability in some Huawei smart phones. An attacker could send specific command in the local area network LAN to exploit this vulnerability. Successful exploitation may cause information leak. Vulnerability ID: HWPSIRT-2019-10001 This vulnerability has been assigne...
Security Advisory - Improper Authorization Vulnerability in Several Smartphones
There is an improper authorization vulnerability in several smartphones. The software does incorrectly performs an authorization check when a user attempts to perform certain action. Successful exploit could allow the attacker to update a crafted package. Vulnerability ID: HWPSIRT-2019-07075 This...
Security Advisory - Command Injection Vulnerability in Some Huawei Products
Some Huawei products have a command injection vulnerability. An attacker with high privileges may exploit this vulnerability through some operations on the LAN. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject commands to the target...
Security Advisory - Remote Code Execution vulnerability in Apache Struts2
The Apache Struts frameworks, when forced, performs double evaluation of attributes' values assigned to certain tags attributes such as id so it is possible to pass in a value that will be evaluated again when a tag's attributes will be rendered. With a carefully crafted request, this can lead to...
Security Advisory - Information Leakage Vulnerability in Some Huawei Products
There is an information leakage vulnerability in some Huawei products. An unauthenticated, adjacent attacker could exploit this vulnerability to decrypt data. Successful exploitation may leak information randomly. Vulnerability ID: HWPSIRT-2020-02166 This vulnerability has been assigned a Common...
Security Advisory - Improper Authentication Vulnerability in Several Huawei Products
Some Huawei products have an improper authentication vulnerability. Attackers need to perform some operations to exploit the vulnerability. Successful exploit may obtain certain permissions on the device. Vulnerability ID: HWPSIRT-2020-04035 This vulnerability has been assigned a Common...
Security Advisory - Path Traversal Vulnerability in Huawei GaussDB
There is a path traversal vulnerability in Huawei GaussDB. Due to insufficient input path validation, an authenticated attacker can traverse directories and download files to a specific directory. Successful exploit may cause information leakage. Vulnerability ID: HWPSIRT-2019-10053 This...
Security Advisory - Improper Authentication Vulnerability in Smartphones
There is an improper authentication vulnerability in smartphones. Due to improperly validate of certain application, an attacker should trick the user into installing a malicious application to exploit this vulnerability. Successful exploit could allow the attacker to bypass the authentication to...
Security Advisory - Insufficient Authentication Vulnerability in Some Huawei Smart Phones
There is an insufficient authentication vulnerability in some Huawei smart phones. A local attacker with high privilege can execute a specific command to exploit this vulnerability. Successful exploitation may cause information leak and compromise the availability of the smart phones. Vulnerabili...
Security Advisory - Connection Hijacking Vulnerability in Some Huawei Home Routers
A connection hijacking vulnerability exists in some Huawei home routers. Successful exploitation of this vulnerability may cause DoS or information leakage.Vulnerability ID:HWPSIRT-2023-34408 This vulnerability has been assigned a CVEID:CVE-2023-52718...
Security Advisory - Out-of-bounds Write Vulnerability in Some Huawei Products
There is an out-of-bounds write vulnerability in some products. An unauthenticated attacker crafts malformed packets with specific parameter and sends the packets to the affected products. Due to insufficient validation of packets, which may be exploited to cause the process reboot. Vulnerability...
Security Advisory - Improper Authentication Vulnerability in Several Products
There is an improper authentication vulnerability in several products. The device does not perform a sufficient authentication when doing certain operation, successful exploit could allow an attacker to cause the device to reboot after launch a man in the middle attack. Vulnerability ID:...
Security Advisory - Improper Access Control Vulnerability in Huawei Share
There is an improper access control vulnerability in Huawei Share. The software does not properly restrict access to certain file from certain application. An attacker tricks the user into installing a malicious application then establishing a connect to the attacker through Huawei Share,...
Security Advisory - Improper Authorization Vulnerability in Several Smartphones
There is an improper authorization vulnerability in several smartphones. The system has a logic judging error under certain scenario, successful exploit could allow the attacker to switch to third desktop after a series of operation in ADB mode. Vulnerability ID: HWPSIRT-2019-10114 This...
Security Advisory - Improper Authorization Vulnerability in Several Huawei Smart Phones
Some Huawei mobile phones have an improper authorization vulnerability. Due to improper authorization of some function, attackers can bypass the authorization to perform some operations. Vulnerability ID: HWPSIRT-2019-08002 This vulnerability has been assigned a Common Vulnerabilities and Exposur...
Security Advisory - Use of Insufficiently Random Values Vulnerability in Huawei ViewPoint Products
There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An unauthenticated, remote attacker can guess information by a large number of attempts. Successful exploitation may cause information leak. Vulnerability ID: HWPSIRT-2019-10076 This vulnerability has been...
Security Advisory - Multiple Vulnerabilities in OpenSSL in May 2016
On May 3, 2016, the OpenSSL Software Foundation released a security advisory that included six vulnerabilities. Of the six vulnerabilities disclosed, four of them may cause memory corruption or excessive memory usage, one could allow a padding oracle attack to decrypt traffic when the connection...
Security Advisory - Memory Leak Vulnerability in Some Huawei Products
Some Huawei products have a memory leak vulnerability. An attacker with high privileges exploits this vulnerability by continuously performing specific operations. Successful exploitation of this vulnerability can cause service abnormal. Vulnerability ID: HWPSIRT-2019-12421 This vulnerability has...
Security Advisory - Information Leakage Vulnerability in some Huawei Firewall Product
There is an information leakage vulnerability in some Huawei firewall products. Due to improper processing of the initialization vector used in a specific encryption algorithm, an attacker who gains access to this cryptographic primitive may exploit this vulnerability to cause the value of the...
Security Advisory - Three Buffer Overflow Vulnerabilities in Some Huawei Products
There are three buffer overflow vulnerabilities in some Huawei products. An attacker may send specially crafted HTTP messages to the affected products. Due insufficient input validation of three different parameters in the messages, successful exploit may cause some service abnormal. Vulnerabilit...
Security Advisory - Information leakage Vulnerability in Some Huawei Products
There is an information leakage vulnerability in some Huawei products. Due to improper processing of some data, a local authenticated attacker can exploit this vulnerability through a series of operations. Successful exploitation may cause information leakage.Vulnerability ID: HWPSIRT-2019-12399...
Security Advisory - Improper Authentication Vulnerability in Smartphones
There is an improper authentication vulnerability in smartphones. The applock does not perform a sufficient authentication in a rare condition, successful exploit could allow the attacker to use the application locked by applock in an instant. Vulnerability ID: HWPSIRT-2019-04103 This vulnerabili...
Security Advisory - Buffer Overflow vulnerability in the FusionSphere OpenStack
The GaussDB of the FusionSphere OpenStack has a stack overflow vulnerability due to the lack of input validation on some parameters. An authenticated attacker on the LAN can exploit this vulnerability to execute arbitrary code or cause a denial of service DoS condition in the affected system...
Security Advisory - Elevation of Privilege Vulnerability in Some Microsoft Windows Systems
Microsoft released a security advisory to disclose an elevation of privilege vulnerability which exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability...
Security Advisory - Improper Authorization Vulnerability in Several Smartphones
There is an improper authorization vulnerability in several smartphones. The system does not properly restrict certain operation in ADB mode, successful exploit could allow certain user break the limit of digital balance function. Vulnerability ID: HWPSIRT-2019-08104 This vulnerability has been...
Security Advisory - Out of Bounds Write Vulnerability in Several Smartphones
There is an out of bounds write vulnerability in several smartphones. The software writes data past the end of the intended buffer because of insufficient validation of certain parameter when initializing certain driver program. An attacker could trick the user into installing a malicious...
Security Advisory - Denial of Service Vulnerability in Several Smartphones
There is a denial of service vulnerability in several smartphones. The system does not properly check the status of certain module during certain operations, an attacker should trick the user into installing a malicious application, successful exploit could cause reboot of the smartphone...
Security Advisory - OpenSSL DROWN Security Vulnerability
OpenSSL official website released a security advisory about a high risk vulnerability dubbed DROWN CVE-2016-0800 on March 1st, 2016. The vulnerability is: Once SSLv2 is used, an attacker can capture packets or act as a man in the middle MIMT to obtain SSL session keys, decrypt encrypted traffic,...
Security Advisory - Identity Authentication Bypass Vulnerability in The Huawei Children Smart Watch (Simba-AL00)
The Huawei Children Smart Watch Simba-AL00 has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may cause the access control function of specific applications to fail.Vulnerability ID:HWPSIRT-2022-18770 This vulnerability has been assigned a CVE ID:...
Security Advisory - Improper Privilege Management Vulnerability in Huawei Smartphone Product
There is an improper privilege management vulnerability in Huawei smart phone product. A local, authenticated attacker could craft a specific input to exploit this vulnerability. Successful exploitation may lead to local privilege escalation. Vulnerability ID: HWPSIRT-2020-05272 This vulnerabilit...