1009 matches found
Security Advisory - SQL Injection Vulnerability in the GaussDB
The GaussDB has a SQL injection vulnerability. An attacker with low privilege may inject some specific SQL to query or modify database files, causing database service abnormal. Vulnerability ID: HWPSIRT-2017-05017 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID:...
Security Advisory - Privilege Escalation Vulnerability in Some Huawei Storage Products
Some Huawei storage products have a privilege escalation vulnerability due to the lack of input validation. Attackers with administrator privilege could inject command into specific command’s parameters, and run this injected command with root privilege. Vulnerability ID: HWPSIRT-2016-05004 This...
Security Advisory - Incorrect Privilege Assignment Vulnerability in Huawei Whole-Home Intelligence Software
A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could allow attackers to access restricted functions. Vulnerability ID:HWPSIRT-2022-90086 This vulnerability has been assigned a CVE ID:...
Security Advisory - CSV Injection Vulnerability in ManageOne Product
There has a CSV injection vulnerability in ManageOne Product. An attacker with common privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files ...
Security Advisory - Command Injection Vulnerability in Some Huawei Products
Some Huawei products have a command injection vulnerability. Due to insufficient input validation, an attacker with high privilege may inject some malicious codes in some files of the affected products. Successful exploit may cause command injection. Vulnerability ID: HWPSIRT-2020-59877 This...
Security Advisory - Information Disclosure Vulnerability in Several Smartphones
There is an information vulnerability in Huawei smartphones. A module has a design error that is lack of control of input. Attackers can exploit this vulnerability to obtain some information. This can lead to information leak. Vulnerability ID: HWPSIRT-2020-02156 This vulnerability has been...
Security Advisory - Insufficient Verification Vulnerability in Some Huawei products
There is an insufficient verification vulnerability in some Huawei products. An attacker can perform specific operations to exploit this vulnerability by physical access methods. Successful exploitation may cause the attacker perform an illegal operation. Vulnerability ID: HWPSIRT-2019-10094 This...
Security Advisory - Improper Access Control Vulnerability in Huawei Share
There is an improper access control vulnerability in Huawei Share. The function incorrectly controls certain access messages, attackers can simulate a sender to steal P2P network information. Successful exploit may cause information leakage. Vulnerability ID: HWPSIRT-2019-09452 This vulnerability...
Security Advisory - Information Disclosure Vulnerability in Some Huawei Products
Some Huawei products have an information disclosure vulnerability. Attackers with low privilege can exploit this vulnerability by performing some specific operations. Successful exploit of this vulnerability can cause some information disclosure. Vulnerability ID: HWPSIRT-2019-10408 This...
Security Advisory - Improper Authentication Vulnerability on Smartphones
There is an improper authentication vulnerability on smartphones. App Lock is a function to prevent unauthorized use of apps on smartphones, an attacker could directly change the lock password after a series of operations. Successful exploit could allow the attacker to use the application which i...
Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can connect the phone with PC and send special instructions to install third party desktop and disable...
Security Advisory - Two Vulnerabilities in MGCP Protocol of Some Huawei Products
There is an out-of-bounds read vulnerability in Media Gateway Control Protocol MGCP of some Huawei products. An unauthenticated, remote attacker crafts malformed packets with specific parameter to the affected products. Due to insufficient validation of packets, successful exploitation may cause...
Security Advisory - Two DOS Vulnerabilities of XML Parser in Some Huawei Products
XML parser have two DOS vulnerabilities in some Huawei products. An attacker may craft specific XML files to the affected products. Due to not check the specially XML file and to parse this file, successful exploit will result in DOS attacks. Vulnerability ID: HWPSIRT-2017-03037 and...
Security Advisory - Remote Code Execution Vulnerability in Microsoft Windows Server Service
Microsoft released a security bulletin MS08-067 to disclose a remote code execution vulnerability in the Server service. An unauthenticated, remote attacker may send a specially crafted RPC request to the affected products. Successful exploit may result in arbitrary code execution. Vulnerability...
Security Advisory - DoS Vulnerability in Huawei S Series Switches
Multiple models of Huawei S series switches have a DoS vulnerability. When an attacker controls or impersonates a server connected to a switch, the attacker can send malicious attack packets to the switch to cause it to restart and make it unavailable. Vulnerability ID: HWPSIRT-2015-12022 This...
Security Advisory - Privilege Escalation Vulnerability in Huawei Product
There is a privilege escalation vulnerability in some Huawei products. Some files in a directory of a module are located improperly. It does not apply the directory limitation. Attackers can exploit this vulnerability by crafting malicious file to launch privilege escalation. This can compromise...
Security Advisory - Buffer Overflow Vulnerability BootHole in GRUB2 Secure Boot
Eclypsium researchers have discovered a vulnerability named“BootHole”in the GRUB2 bootloader. There is a buffer overflow vulnerability that can be used to gain arbitrary code execution during the boot process, even when Secure Boot is enabled. Attackers exploiting this vulnerability can install...
Security Advisory - Buffer Overflow Vulnerability on Several Mobile Broadband Products
There is a buffer overflow vulnerability on several mobile broadband products. The software does not sufficiently validate the length of certain fields in DHCP message which is received. Successful exploit could cause the device to reboot. Vulnerability ID: HWPSIRT-2017-09083 This vulnerability h...
Security Advisory - Information Disclosure Vulnerability on some Huawei Products
There is a information leak vulnerability in some Huawei products, and it could allow a local attacker to get information. The vulnerability is due to the improper management of the username. An attacker with the ability to access the device and cause the username information leak. Vulnerability...
Security Advisory - Type Confusion Vulnerability in Several Smartphones
There is a type confusion vulnerability in several smartphones. The system does not properly check and transform the type of certain variable, the attacker tricks the user into installing then running a crafted application, successful exploit could cause code execution. Vulnerability ID:...
Security Advisory - Insufficient Input Validation Vulnerability in Huawei Share
There is an insufficient input validation vulnerability in Huawei Share. Attackers can exploit this vulnerability by sending crafted packets to the affected device. Successful exploit may cause the function will be disabled. Vulnerability ID: HWPSIRT-2019-09454 This vulnerability has been assigne...
Security Advisory - Two Command Injection Vulnerabilities in The FusionSphere OpenStack
The FusionSphere has two command injection vulnerabilities due to the insufficient input validation on one port. An attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands. Vulnerability ID: HWPSIRT-2017-05142 and HWPSIRT-2017-05143 The tw...
Security Advisory - Command Injection Vulnerability in the NetEco
Huawei iManager NetEco has a command injection vulnerability due to insufficient input validation. An authenticated, remote attacker could exploit this vulnerability to send malicious packets to a target device. Successful exploit could enable a low privileged user to execute commands that a high...
Security Advisory - Path Traversal Vulnerability in Huawei Home Music System
Some Huawei home music system products have a path traversal vulnerability. Successful exploitation of this vulnerability may cause unauthorized file deletion or file permission change.Vulnerability ID:HWPSIRT-2023-53450 This vulnerability has been assigned a CVEID:CVE-2023-7263...
Security Advisory - Privilege Escalation Vulnerability in Huawei Product
There is a privilege escalation vulnerability in some Huawei products. Due to lack of privilege restrictions, an authenticated local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege. Vulnerability ID...
Security Advisory - Privilege Escalation Vulnerability in Some Huawei Products
There is a privilege escalation vulnerability in some Huawei products. Due to insufficient input validation, a local attacker with high privilege may execute some specially crafted scripts in the affected products. Successful exploit will cause privilege escalation. Vulnerability ID:...
Security Advisory - Buffer Overflow Vulnerability in Some Huawei Smart Phones
There is a buffer overflow vulnerability in some Huawei smart phones. An attacker may intercept and tamper with the packet in the local area network LAN to exploit this vulnerability. Successful exploitation may cause the affected phone abnormal. Vulnerability ID: HWPSIRT-2019-09447 This...
Security Advisory - Information Leakage Vulnerability on Some Huawei Products
There is an information leakage vulnerability on some Huawei products. An attacker with low permissions can view some high-privilege information by running specific commands.Successful exploit could cause an information disclosure condition. Vulnerability ID: HWPSIRT-2019-04080 This vulnerability...
Security Advisory - Out of Bounds Read Vulnerability on Several Smartphones
There is an out of bounds read vulnerability on several smartphones, the system does not properly validate certain length parameter which an application transports to kernel. An attacker tricks the user to install a malicious application, successful exploit could cause out of bounds read and...
Security Advisory - Four Remote Code Execution Vulnerabilities in Some Microsoft Windows Systems
Microsoft released four security advisories to disclose four remote code execution vulnerabilities in Remote Desktop Services. An unauthenticated attacker connects to the target system using RDP and sends specially crafted requests to exploit the vulnerabilities. Successful exploit may cause...
Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can login the configuration flow by some secret code and can perform some operations to update the...
Security Advisory - Buffer Overflow Vulnerability in The GaussDB
There is a buffer overflow vulnerability in the handling code for regular expressions on GaussDB. An authenticated, remote attacker could use a specially crafted regular expression to cause GaussDB to crash or possibly execute arbitrary code. Vulnerability ID: HWPSIRT-2017-05046 This vulnerabilit...
Security Advisory - Chrome V8 engine has a remote code execution vulnerability
Chrome V8 is a Google Chrome engine for parsing JavaScript. Chrome V8 v3.20 to v4.2 has a remote code execution vulnerability due to misspelling of exception name observeacceptinvalid into observeinvalidaccept in source code, leading to the leak of kMessages. Successful exploit of this...
Security Advisory - Input Validation Vulnerability in Some Huawei Products
Some Huawei products have an input validation vulnerability due to improper validation of Multiprotocol Label Switching MPLS packets. A remote unauthenticated attacker could exploit this vulnerability by sending malformed MPLS packets. Successful exploit could lead to a denial of service DoS...
Security Advisory - Multiple Security Vulnerabilities in Huawei HiSuite
Huawei HiSuite PC client software has an information leak vulnerability. The software provides the function for configuring the proxy server. The password textbox on the proxy configuration UI do not disable the password copy function. An attacker who can log in to the system can copy out the...
Security Advisory - Input Validation Vulnerability in Huawei Routers
There is an input validation vulnerability in Huawei access routers, an attacker may exploit this vulnerability by crafting a malformed packet and sending it to the device. An exploit could allow the attacker to cause a Denial of Service or remote code execution. Vulnerability ID:...
Security Advisory - Permission Control Vulnerability in Some Huawei Switches
Some Huawei switches have a permission control vulnerability. If a switch enables Authentication, Authorization and Accounting AAA for permission control and user permissions are not appropriate, AAA users may obtain the virtual type terminal VTY access permission, resulting in privilege...
Security Advisory - Logic Error Vulnerability in Several Smartphones
There is a logic error vulnerability in several smartphones. The software does not properly restrict certain operation when the Digital Balance function is on. Successful exploit could allow the attacker to bypass the Digital Balance limit after a series of operations. Vulnerability ID:...
Security Advisory - Information Disclosure Vulnerability in Several Smartphones
There is an information disclosure vulnerability in several smartphones. The system has a logic judging error under certain scenario, the attacker should gain the permit to execute commands in ADB mode and then do a series of operation on the phone. Successful exploit could allow the attacker to...
Security Advisory - Improper Signature Verification Vulnerability in Some Huawei Smartphones
There is an improper signature verification vulnerability in some smartphones. The system does not improper check signature of specific software package, an attacker may exploit this vulnerability to load a crafted software package to the device. Vulnerability ID: HWPSIRT-2019-11220 This...
Security Advisory - Authentication Bypass Vulnerability in Huawei iBMC Products
There is an authentication bypass vulnerability in Huawei iBMC products. A remote attacker with low privilege may craft specific messages to upload authentication certificate to the affected products. Due to improper validation of the upload authority, successful exploit may cause privilege...
Security Advisory - Out-Of-Bounds Read Vulnerability in Some Huawei Products
Some Huawei products have an out-of-bounds read vulnerability due to insufficient input validation. An unauthenticated, remote attacker could exploit this vulnerability by sending malformed Session Initiation ProtocolSIP packets to the target device. Successful exploit could make the device read...
Security Advisory - Input Validation Vulnerability in H323 Protocol of Huawei products
There is an insufficient validation vulnerability in some Huawei products. Since packet validation is insufficient, an unauthenticated attacker may send special H323 packets to exploit the vulnerability. Successful exploit could allow the attacker to send malicious packets and result in DOS...
Security Advisory - Information Disclosure Vulnerability in the Synaptics Touchscreen Driver
An information disclosure vulnerability in the Synaptics touchscreen driver. An attacker tricks a user into installing a malicious application on the smart phone, and it could enable to access data outside of its permission levels. And cause to the sensitive information leaks. Vulnerability ID:...
Security Advisory - Multiple Vulnerabilities in MTK Platform
There are two buffer overflow vulnerabilities and one arbitrary memory write vulnerability in the camera driver of MTK platform in some Huawei smart phones. Due to the insufficient input verification, an attacker tricks a user into installing a malicious application which has special privilege an...
Security Advisory - Multiple Security Vulnerabilities in HedEx product
HedExHuawei Electronic Documentation Explorer，Huawei electronic document browser, mainly used to browse Huawei products electronic documents. HedEx exist some vulnerabilities. HedEx has an arbitrary file download vulnerability. An attacker could exploit it to download arbitrary files on a target...
Security Advisory - Multiple Input Validation Vulnerabilities in Huawei Smart Phone
There are four input validation vulnerabilities in some Huawei Smart phones. An attacker gets the graphic or Camera privilege and tricks a user into installing a malicious application on the smart phone, and send given parameter to smart phone to crash the system or escalate privilege...
Security Advisory - Multiple Security Vulnerabilities in Driver of Huawei Smart Phones
There are two stack overflow vulnerabilities in video driver. An attacker may trick a user into installing a malicious application and the application can send given parameter to video driver to crash the system or escalate user privilege. Vulnerability ID: HWPSIRT-2016-08056 and HWPSIRT-2016-080...
Security Advisory - DoS Vulnerability in Huawei U2990 and U2980
Huawei U2990 and U2980 have a DoS vulnerability caused by no error correction mechanism when handling specific signaling packets. An attacker can send malformed packets to cause a denial of service condition in some services of the U2990 and U2980. Vulnerability ID: HWPSIRT-2015-09025 This...
Security Advisory - Improper Authentication Management Vulnerability in some Huawei Products
There is an improper authentication vulnerability in some huawei products.Successful exploitation of this vulnerability may lead to a control of the victim device. Vulnerability ID: HWPSIRT-2021-30580 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID:...