1030 matches found
Security Advisory - Out of Bounds Read Vulnerability in Some Huawei Products
There is a few bytes out-of-bounds read vulnerability in some Huawei products. The software reads data past the end of the intended buffer when parsing certain message, an authenticated attacker could exploit this vulnerability by sending crafted messages to the device. Successful exploit may cau...
Security Advisory - Out of Bounds Write Vulnerability in Several Smartphones
There is an out of bounds write vulnerability in several smartphones. The software writes data past the end of the intended buffer because of insufficient validation of certain parameter when initializing certain driver program. An attacker could trick the user into installing a malicious...
Security Advisory - Command Injection Vulnerability in GaussDB 200 Product
There is a command injection vulnerability in GaussDB 200 product. Due to insufficient input validation, remote attackers with low permissions could exploit this vulnerability by sending crafted commands to the affected device. Successful exploit could allow an attacker to execute commands...
Security Advisory - Anonymous TLS Cipher Suite Supported Vulnerability in Huawei eSpace Product
There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to hijack the connection from a client when the user signs up to log in by TLS. Due to insufficient authentication, which may be exploite...
Security Advisory - Elevation of Privilege Vulnerability in Some Microsoft Windows Systems
Microsoft released a security advisory to disclose an elevation of privilege vulnerability which exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability...
Security Advisory - Improper Authorization Vulnerability in Several Smartphones
There is an improper authorization vulnerability in several smartphones. The software does not properly restrict certain operation in certain scenario, the attacker should do certain configuration before the user turns on student mode function. Successful exploit could allow the attacker to bypas...
Security Advisory - Improper Authorization Vulnerability in Several Smartphones
There is an improper authorization vulnerability in several smartphones. The digital balance function does not sufficiently restrict the using time of certain user, successful exploit could allow the user break the limit of digital balance function after a series of operations with a PC...
Security Advisory - Command Injection Vulnerability in GaussDB 200
There is a command injection vulnerability in GaussDB 200. The software constructs part of a command using external input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands. Vulnerability ID:...
Security Advisory - Six Vulnerabilities in Some Huawei Products
There are two out-of-bounds read vulnerability in some Huawei products. Due to insufficient input validation, an authenticated, remote attacker could send malformed SOAP packets to the target device. Successful exploit could make the device access invalid memory and might reset a process...
Security Advisory - Input Validation Vulnerability in Huawei VRP Platform
There is an input validation vulnerability in some Huawei devices using VRP. Due to the lack of input validation, an attacker may craft a malformed packet and send it to the device using VRP, causing the device to display additional memory data and possibly leading to sensitive information leakag...
Security Advisory - XSS Injection Vulnerability in a Huawei Product
There is a XSS injection vulnerability in a Huawei product. A module of the client does not verify the input sufficiently. Attackers can exploit this vulnerability by modifying input after logging onto the client. This may compromise the normal service of the client. Vulnerability ID:...
Security Advisory - Information Disclosure Vulnerability in Several Smartphones
There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, and successful...
Security Advisory - Improper Authorization Vulnerability in Several Smartphones
There is an improper authorization vulnerability in several smartphones. The system does not properly restrict certain operation in ADB mode, successful exploit could allow certain user break the limit of digital balance function. Vulnerability ID: HWPSIRT-2019-08104 This vulnerability has been...
Security Advisory - Logic Error Vulnerability in Several Smartphones
There is a logic error vulnerability in several smartphones. The software does not properly restrict certain operation when the Digital Balance function is on. Successful exploit could allow the attacker to bypass the Digital Balance limit after a series of operations. Vulnerability ID:...
Security Advisory - Insufficient Verification Vulnerability in Some Huawei Products
There is an insufficient verification vulnerability in some Huawei products. An attacker can access the device physically and exploit this vulnerability to tamper with device information. Successful exploit may cause service abnormal.Vulnerability ID: HWPSIRT-2019-10092 This vulnerability has bee...
Security Advisory - Insufficient Verification Vulnerability in Several Smartphones
There is an insufficient verification vulnerability in several smartphones. The system does not verify certain parameters sufficiently, an attacker should connect to the phone and gain high privilege to launch the attack, successful exploit could cause malicious code execution. Vulnerability ID:...
Security Advisory - Information Disclosure Vulnerability on Smartphones
There is an information disclosure vulnerability on certain Huawei smartphones. An attacker could view the photos after a series of operation without unlock the screen lock. Successful exploit could cause an information disclosure condition. Vulnerability ID: HWPSIRT-2019-01143 This vulnerability...
Security Advisory - Arbitrary Memory Read Write Vulnerability in Huawei Smart Phones
There is a arbitrary memory read/write vulnerability in the hardware security module of some Huawei smart phones due to the input parameters validation. An attacker with the root privilege of the Android system could exploit this vulnerability to read and write memory data anywhere or execute...
Security Advisory - Improper Handling of Exceptional Condition Vulnerability in Huawei Smartphones
There is an improper handling of exceptional condition Vulnerability in Huawei Smartphones. A component cannot deal with an exception correctly. Attackers can exploit this vulnerability by sending malformed message. This could compromise normal service of affected phones. Vulnerability ID:...
Security Advisory - Buffer Overflow Vulnerability in Some Huawei Products
There is a buffer overflow vulnerability in some Huawei products. The vulnerability can be exploited by an attacker to perform remote code execution on the affected products when the affected product functions as an optical line terminal OLT. Vulnerability ID: HWPSIRT-2019-09333 This vulnerabilit...
Security Advisory - Improper Authorization Vulnerability in Several Smartphones
There is an improper authorization vulnerability in several smartphones. The software incorrectly performs an authorization to certain user, successful exploit could allow a low privilege user to do certain operation which the user are supposed not to do. Vulnerability ID: HWPSIRT-2019-12104 This...
Security Advisory - Improper Validation of Array Index Vulnerability in Several Smartphones
There is an improper validation of array index vulnerability in several smartphones. The system does not properly validate the input value before use it as an array index when processing certain image information. The attacker tricks the user into installing a malicious application, successful...
Security Advisory - Three JSON Injection Vulnerabilities in Huawei Some Products
There are three JSON injection vulnerabilities in Huawei some product. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management privilege of the system...
Security Advisory - Improper Authorization Vulnerability on iBMC
There is an improper authorization vulnerability on iBMC. The software incorrectly performs an authorization check when a normal user attempts to access certain information which is supposed to be accessed only by admin user. Successful exploit could cause information disclosure. Vulnerability ID...
Security Advisory - Samba Remote Code Execution Vulnerability in Some Huawei Products
All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing an authenticated attacker to upload a shared library to a writable share and execute arbitrary code remotely on a targeted system. Samba 4.6.4, 4.5.10 and 4.4.14 have been issued as security...
Security Advisory - Command Injection Vulnerability in Huawei FusionAccess
There is a command injection vulnerability in Huawei FusionAccess due to the lack of input validation. A remote attacker with specific permission could inject an Lightweight Directory Access ProtocolLDAP operation command into a specific input variable to obtain sensitive information from the...
Security Advisory - Buffer Overflow Vulnerability in Some Huawei Products
There is a buffer overflow vulnerability in Connectivity Fault Management CFM function of some Huawei Products. When CFM is enabled and Maintenance Association End Point MEP is configured on the affected device, an adjacent attacker could exploit this vulnerability by sending crafted packets to t...
Security Advisory - DoS Vulnerability in Huawei U2990 and U2980
Huawei U2990 and U2980 have a DoS vulnerability caused by no error correction mechanism when handling specific signaling packets. An attacker can send malformed packets to cause a denial of service condition in some services of the U2990 and U2980. Vulnerability ID: HWPSIRT-2015-09025 This...
Security Advisory - VRF Hopping Vulnerability in Multiple Routers
A VPN routing and forwarding VRF hopping vulnerability exists in Huawei routers. The routers do not strictly check received MPLS forwarding packets, and an attacker may exploit this vulnerability to forward crafted packets to MPLS links, which leads to flood attacks against the destination VPN...
Security Advisory - Bluetooth Function Denial of Service Vulnerability in Some Huawei Smartphone Products
The Bluetooth function of some Huawei smartphones has a DoS vulnerability. Attackers can install third-party apps to send specific broadcasts, causing the Bluetooth module to crash. This vulnerability is successfully exploited to cause the Bluetooth function to become abnormal. Vulnerability ID:...
Security Advisory - CSV Injection Vulnerability in iManager NetEco Product
There has a CSV injection vulnerability in iManager NetEco Product. An attacker with common privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV...
Security Advisory - Improper Authentication Vulnerability in Smartphones
There is an improper authentication vulnerability in smartphones. Certain application does not properly validate the identity of another application who would call its interface, an attacker should trick the user into installing a malicious application, successful exploit could allow unauthorized...
Security Advisory - Insufficient Verification Vulnerability in Several Smartphones
There is an insufficient verification vulnerability in several smartphones. The system does not verify certain parameters sufficiently, an attacker should connect to the phone and gain high privilege to launch the attack, successful exploit could cause DOS or malicious code execution. Vulnerabili...
Security Advisory - Out-of-Bounds Read Vulnerability in Some Huawei Products
There is an out-of-bounds read vulnerability in the SFTP module of some Huawei products. A remote, authenticated attacker could exploit this vulnerability by sending specially crafted messages to a target device. Successful exploit may cause some information leak. Vulnerability ID:...
Security Advisory - Two Remote Code Execution Vulnerabilities in Huawei eSpace Product
There are two remote code execution vulnerabilities in import Signal Tone function and import Language Package function of Huawei eSpace product. An authenticated, remote attacker can craft and send the packets to the affected products after the Signal Tone or Language Package is uploaded. Due to...
Security Advisory - Information Leak Vulnerability in Huawei FusionSphere Openstack
There is an information leak vulnerability in Huawei FusionSphere Openstack. Due to an incorrect configuration item, the information transmitted by a transmission channel is not encrypted. An attacker accessing the internal network may obtain sensitive information transmitted. Vulnerability ID:...
Security Advisory - Denial of Service Vulnerability in Huawei Product
There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages correctly. Attackers can exploit this vulnerability by sending malicious messages to affected module. This can lead to denial of service. Vulnerability ID: HWPSIRT-2020-65315 This...
Security Advisory - NULL Pointer Dereference Vulnerability in Some Huawei Products
There is a NULL pointer dereference vulnerability in some Huawei products. An attacker may send specially crafted POST messages to the affected products. Due to insufficient validation of some parameter in the message, successful exploit may cause some process abnormal. Vulnerability ID:...
Security Advisory - Windows DNS Server Remote Code Execution Vulnerability
Microsoft's security update in July 2020 addresses the CVE-2020-1350 vulnerability. To exploit the vulnerability, an unauthenticated attacker could send specially crafted requests to a Windows DNS server. An attacker who successfully exploited the vulnerability could run arbitrary code remotely...
Security Advisory - Information leakage Vulnerability in Some Huawei Products
There is an information leakage vulnerability in some Huawei products. An attacker can exploit this vulnerability by sending specific request packets to affected devices. Successful exploit may lead to information leakage. Vulnerability ID: HWPSIRT-2019-11212 This vulnerability has been assigned ...
Security Advisory - Weak Algorithm Vulnerability in Some Huawei Products
There is a weak algorithm vulnerability in some Huawei products. The affected products use weak algorithms by default. Attackers may exploit the vulnerability to cause information leaks. Vulnerability ID: HWPSIRT-2019-02008 This vulnerability has been assigned a Common Vulnerabilities and Exposur...
Security Advisory - Denial of Service Vulnerability on Several Products
There is a denial of service vulnerability on several products. The software decodes X.509 certificate in an improper way. A remote unauthenticated attacker could send a crafted X.509 certificate to the device. Successful exploit could result in a denial of service on the device. Vulnerability ID...
Security Advisory - 'Phoenix Talon' Vulnerabilities in Linux Kernel
The Linux operating system has four security vulnerabilities called 'Phoenix Talon', which affect Linux kernel 2.5.69 to Linux kernel 4.11. Successful exploit of these vulnerabilities can allow an attacker to launch DoS attacks and can lead to arbitrary code execution when certain conditions are...
Security Advisory - HTTP Header Injection Vulnerability in Huawei FusionAccess
The FusionAccess is the desktop management system of Huawei FusionCloud desktop solution. Huawei FusionAccess has an HTTP header injection vulnerability. A remote, unauthenticated attacker can exploit it to tamper with HTTP headers, causing users to access crafted URLs. Vulnerability ID:...
Security Advisory - Insufficient Input Verification Vulnerability in the FusionAccess
FusionAccess is a kind of virtual desktop applications based on Huawei cloud platform. Through the deployment of Huawei desktop cloud software on the cloud platform, customers can access the cloud desktop by the thin client device or other devices. There is an insufficient input verification...
Security Advisory - Improper Authentication Vulnerability in Some Huawei Smartphones
There is an improper authentication vulnerability in some Huawei smartphones. The Application doesn't perform proper authentication when user performs certain operations. An attacker can trick user into installing a malicious plug-in to exploit this vulnerability. Successful exploit could allow t...
Security Advisory - Insufficient Authentication Vulnerability in Several Band Products
There is an insufficient authentication vulnerability in several products. The band does not sufficiently authenticate the device try to connect to it in certain scenario. Successful exploit could allow the attacker to spoof then connect to the band. Vulnerability ID: HWPSIRT-2019-09490 This...
Security Advisory - Use of a Risky Cryptographic Algorithm Vulnerability on Several Products
There is a use of a broken or risky cryptographic algorithm vulnerability on several products. The software uses risky cryptographic algorithm in SSL. This is dangerous because a remote unauthenticated attacker could use well-known techniques to break the algorithm. Successful exploit could resul...
Security Advisory - Multiple Vulnerabilities in UMA Products
The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA product has the following vulnerabilities, which are introduced by software provided by...
Security Advisory - OpenSSL Montgomery multiplication may produce incorrect results Vulnerability
The Broadwell-specific Montgomery multiplication procedure has a denial of service DoS vulnerability when handling input longer than 256 bits.Only EC algorithms that use Brainpool P-512 curves are affected. An attacker could exploit this vulnerability to cause DoS during ECDH key...