1006 matches found
Security Advisory - Buffer Overflow Vulnerability in Some Huawei Products
Some Huawei products have a buffer overflow vulnerability. An attacker induces users to install malicious applications and sends specially constructed packets to affected devices after obtaining the root permission. Successful exploit may cause code execution. Vulnerability ID: HWPSIRT-2020-04125...
Security Advisory - Improper Authentication Vulnerability in Some Huawei Smartphones
There is an improper authentication vulnerability in some Huawei smartphones. Due to the identity of the message sender is not properly verified, an attacker can exploit this vulnerability through man-in-the-middle attack to induce user to access malicious URL. Vulnerability ID: HWPSIRT-2019-1213...
Security Advisory - Information Leak Vulnerability in Some Huawei Products
Some Huawei mobile phones have an information leak vulnerability. Due to improper function error records of some module, an attacker with the access permission may exploit the vulnerability to obtain some information. Vulnerability ID: HWPSIRT-2019-04053 This vulnerability has been assigned a...
Security Advisory - Two Vulnerabilities in Huawei PCManager Product
There is a privilege escalation vulnerability in Huawei PCManager product. Successful exploitation may cause the attacker to obtain a higher privilege. Vulnerability ID: HWPSIRT-2018-11141 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2019-5241. There is ...
Security Advisory - Three Vulnerabilities in SCCPX Module of Some Huawei Products
There is an out-of-bounds read vulnerability in SCCPX module of some Huawei products. An unauthenticated, remote attacker crafts malformed packets with specific parameter to the affected products. Due to insufficient validation of packets, successful exploitation may impact availability of produc...
Security Advisory - Buffer Overflow Vulnerability in the NFC Module of Some Huawei Mobile Phones
The Near Field Communication NFC module of some Huawei mobile phones has a buffer overflow vulnerability due to the lack of input validation. An attacker may use an NFC card reader or another device to inject malicious data into a target mobile phone. Successful exploit could lead to system resta...
Security Advisory - A CGI application vulnerability in Some Huawei Products
Some open source software used by Huawei does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an...
Security Advisory - App Lock Bypass Vulnerability in Huawei Mobile Phones
App Lock is a function provided by the Phone Manager app to prevent unauthorized use of apps on mobile phones. Some Huawei mobile phones have an App Lock bypass vulnerability. An attacker could perform specific operations to bypass the App Lock to use apps on a target mobile phone temporarily...
Security Advisory - Multiple Security Vulnerabilities in Huawei Smart Phone Products
The TrustZone driver of some Huawei smart phone products has an input validation vulnerability. An attacker may trick the target user into installing a malicious APP which could exploit this vulnerability to pass specific parameters to the TrustZone driver. Successful exploit could cause the syst...
Security Advisory - Two Information Leak Vulnerabilities in ION Memory Management Module of Huawei Smart Phone
Two information leak vulnerabilities exist in the ION memory management module of some Huawei mobile phones due to the lack of initialization during memory allocation. Vulnerability ID: HWPSIRT-2016-09032 and HWPSIRT-2016-09033 These two vulnerabilities have been assigned CVE ID: CVE-2016-8757 an...
Security Advisory - Privilege Escalation Vulnerability in Huawei Multiple Smart Phones
There is a privilege escalation vulnerability in Android kernel due to the lack of a parameters check. An attacker may trick a user into installing a malicious application, and the application can modify the data of kernel to crash the system or escalate user privilege. Vulnerability ID:...
Security Advisory - Buffer Overflow Vulnerability in Huawei USG Products
The Authentication, Authorization and Accounting AAA module in the USG products has a buffer overflow vulnerability. A remote attacker can send crafted Enterprise Application Platform EAP packets to the USG products through a Remote Authentication Dial In User Service RADIUS server which has...
Security Advisory - Path Traversal Vulnerability in Huawei Home Gateway Products
There is a path traversal vulnerability on several Huawei home gateway products. The products do not properly validate HTTP requests received by a specific port. An remote attacker may access the local files on the device without authentication by crafting an HTTP request and sending it to the...
Security Advisory - Bar Mitzvah Attack Vulnerability in Huawei Products
A security vulnerability exists in Rivest Cipher 4 RC4 used by TLS and SSL protocols. RC4 cannot provide sufficient data protection. After listening to an SSL or TLS connection, an attacker can obtain plaintext data by brute force cracking. This vulnerability is also called Bar Mitzvah...
Security Advisory-Information Leakage Vulnerability in Huawei P7 Smartphone
MeWidget is a plug-in of Huawei Emotion UI. The MeWidget module on Huawei smartphone P7 has a vulnerability that could lead to the disclosure of contact information. Attackers can obtain the name and URI information of mobile phone users through the malware installed on the smartphones...
Security Advisory-Information Leakage Vulnerability via MPLS Ping in VRP Platform
VRP Versatile Routing Platform has been developed by Huawei to provide improved IP routing services. The VRP has been widely applied to network devices, including high-end and low-end switches and routers, wireless and transmission devices. Information leakage vulnerability exists in several...
Security Advisory - Denial of Service Vulnerability in some Huawei Products
There is a denial of service vulnerability in some Huawei products. Successful exploitation could cause denial of service. Vulnerability ID: HWPSIRT-2022-27465 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2022-29798. For products that have released...
Security Advisory - Denial of Service Vulnerability in Some Products
There is a denial of service vulnerability in some huawei products. In specific scenarios, due to the improper handling of the packets, an attacker may craft the specific packet. Successful exploit may cause some services abnormal. Vulnerability ID: HWPSIRT-2020-70186 This vulnerability has been...
Security Advisory - Arbitrary Memory Write Vulnerability in Huawei Smart Phone
There is an arbitrary memory write vulnerability in Huawei smart phone when processing file parsing. Due to insufficient validation of the input files, successful exploit could cause certain service abnormal. Vulnerability ID: HWPSIRT-2020-04031 This vulnerability has been assigned a Common...
Security Advisory - Buffer Overflow Vulnerability in the Bluetooth Module of Some Huawei Mobile Phones
There is a buffer overflow vulnerability in the Bluetooth module of some Huawei mobile phones. Due to insufficient input validation, an unauthenticated attacker may craft Bluetooth messages after successful paring, causing buffer overflow. Successful exploit may cause code execution. Vulnerabilit...
Security Advisory - Denial of Service Vulnerability in Several Smartphones
There is a denial of service vulnerability in several smartphones. Certain system configuration can be modified because of improper authorization. The attacker should trick the user installing and executing a malicious application, successful exploit could cause a denial of service condition of...
Security Advisory - Improper Authorization Vulnerability in Huawei Product
There is an improper authorization vulnerability in Huawei FusionComput. A module does not verify some input correctly and authorizes files with incorrect access. Attackers can exploit this vulnerability to launch privilege escalation attack. This can compromise normal service. Vulnerability ID:...
Security Advisory - Improper Authentication Vulnerability in Some Huawei Smartphones
There is an improper authentication vulnerability in some Huawei smartphones. The vulnerability is due to that when an user wants to do certain operation, the software insufficiently validate the user's identity. Attackers need to physically access the smartphone to exploit this vulnerability...
Security Advisory - Authentication Bypass Vulnerability in Some Huawei Smart Phones
Some Huawei smartphones have an authentication bypass vulnerability. When the attacker obtains the user's smartphone, the vulnerability can be used to replace the start-up program so that the attacker can obtain the information in the smartphone and achieve the purpose of controlling the...
Security Advisory - Denial of Service Vulnerability on Several Huawei Products
There is a denial of service vulnerability on several products. The software does not correctly calculate the rest size in a buffer when handling SSL connections. A remote unauthenticated attacker could send a lot of crafted SSL messages to the device, successful exploit could cause no space in t...
Security Advisory - Multiple Vulnerabilities in Intel Management Engine Firmware
There are multiple vulnerabilities in Intel Management Engine ME firmware. Some Huawei devices are affected for using related Intel products. Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system t...
Security Advisory - Information Leak Vulnerability in Huawei FusionSphere Openstack
There is an information leak vulnerability in Huawei FusionSphere Openstack. Due to an incorrect configuration item, the information transmitted by a transmission channel is not encrypted. An attacker accessing the internal network may obtain sensitive information transmitted. Vulnerability ID:...
Security Advisory - Two Vulnerabilities in Some Huawei CPE Devices
The outdoor unit of some Customer Premise Equipment CPE has a no authentication vulnerability on a certain port. After accessing the network between the indoor and outdoor units of the CPE, an attacker can deliver commands to the specific port of the outdoor unit and execute them without...
Security Advisory - Authentication Bypass Vulnerability in the 'Find Phone' Function of some Huawei Smart Phones
The 'Find Phone' function of some Huawei smart phones has an authentication bypass vulnerability. An unauthenticated attacker may wipe and factory reset the phone by special steps. Due to missing authentication of the 'Find Phone' function, an attacker may exploit the vulnerability to bypass the...
Security Advisory - DNS Static Source Port Vulnerability in Huawei E5151 and E5186
Huawei E5151 and E5186 allow DNS query packets using the static source port. Attackers can exploit the vulnerability to launch DNS Spoofing Attack and compromise the normal service of DNS. Vulnerability ID: HWPSIRT-2015-10001 This vulnerability has been assigned Common Vulnerabilities and Exposur...
Security Advisory - ICMPv6 DoS Vulnerability in Huawei Switches
Multiple Huawei switches improperly release memory for ICMPv6 packets of a specific type. After the switch receives a specially crafted ICMPv6 packet, memory leak occurs, causing the switch to restart if the allocated memory is exhausted. Vulnerability ID: HWPSIRT-2015-11034 This vulnerability ha...
Security Advisory - Improper Authorization Vulnerability in a Huawei Children's Watch
Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file. Vulnerability ID:HWPSIRT-2022-62345 This vulnerability has been assigned a CVE ID: CVE-2022-45874...
Security Advisory - Out-of-bounds Read and Write Vulnerability in Some Huawei Headset Products
There is an out-of-bounds read and write vulnerability in some headset products. An unauthenticated attacker gets the device physically and crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be...
Security Advisory - CSV Injection Vulnerability in Some Huawei Products
There is a CSV injection vulnerability in some Huawei Products. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files ...
Security Advisory - Command Injection Vulnerability in Huawei FusionCompute Product
There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful...
Security Advisory - Denial of Service Vulnerability in Some Huawei Products
There is a denial of service vulnerability in some Huawei products. An attacker could exploit this vulnerability by sending specific message to a targeted device. Due to insufficient input validation, successful exploit can cause the service abnormal. Vulnerability ID: HWPSIRT-2020-24699 This...
Security Advisory - Denial of Service Vulnerability in Huawei Product
There is a denial of service vulnerability in Huawei product. The affected product cannot deal with some messages because of module design weakness . Attackers can exploit this vulnerability by sending a large amount of specific messages to cause denial of service. This can compromise normal...
Security Advisory - Privilege Escalation Vulnerability in FusionCompute Product
There is a privilege escalation vulnerability in FusionCompute product. Due to improper privilege management, an attacker with common privilege may access some specific files and get the administrator privilege in the affected products. Successful exploit will cause privilege escalation...
Security Advisory - Out-of-Bounds Read and Write Vulnerability in Huawei Smartphone
There is an out-of-bounds read and write vulnerability in Huawei smartphone. Some functions do not verify inputs sufficiently. Attackers can exploit this vulnerability by sending specific request. This could compromise normal service of the affected device. Vulnerability ID: HWPSIRT-2020-03107 Th...
Security Advisory - Use after Free Vulnerability in Huawei Smartphone
There is a user after free vulnerability in Huawei smartphone. A module is lack of lock protection. Attackers can exploit this vulnerability by launching specific request. This could compromise normal service of the affected device. Vulnerability ID: HWPSIRT-2020-03123 This vulnerability has been...
Security Advisory - Command Injection Vulnerability in FusionCompute
There is a command injection vulnerability in FusionCompute. The software does not sufficiently validate certain parameters post from user, successful exploit could allow an authenticated attacker to launch a command injection attack. Vulnerability ID: HWPSIRT-2020-05015 This vulnerability has be...
Security Advisory - Protection Mechanism Failure Vulnerability in Some Huawei Products
There is a protection mechanism failure vulnerability in some Huawei products. The product incorrectly uses a protection mechanism. An attacker has to find a way to exploit the vulnerability to conduct directed attacks against the affected product. Vulnerability ID: HWPSIRT-2020-05077 This...
Security Advisory - Insufficient Integrity Check Vulnerability in Several Smartphones
There is an insufficient integrity check vulnerability in several smartphones. The system does not check certain software package's integrity sufficiently, successful exploit could allow an attacker to load a crafted software package to the device. Vulnerability ID: HWPSIRT-2019-11020 This...
Security Advisory - Information Leak Vulnerability in Some Huawei Smartphones
There is an information leak vulnerability in some Huawei smartphones. An attacker may do some specific configuration in the smartphone and trick a user into inputting some sensitive information. Due to improper design, successful exploit may cause some information leak. Vulnerability ID:...
Security Advisory - Two Remote Code Execution Vulnerabilities in Microsoft Windows
Microsoft released a security advisory to disclose a remote code execution vulnerability in Microsoft Server Message Block 1.0 SMBv1. A remote attacker could send a specially crafted packet to a targeted SMBv1 server. The attacker could exploit the vulnerability to gain the ability to execute cod...
Security Advisory - Multiple Vulnerabilities in XML Parser of Some Huawei Products
There are multiple buffer overflow vulnerabilities in some Huawei products due to the lack of validation. An authenticated local attacker can craft specific XML files to the affected products and parse this file, which result in DoS attacks or remote code execution on the device. Vulnerability ID...
Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones
There is a information leak vulnerability in the date service proxy implementation of some Huawei smart phones. An attacker may trick a user into installing a malicious application and application can exploit the vulnerability to get kernel date, which may cause sensitive information leak...
Security Advisory - Memory Leak Vulnerability in Some Huawei Products
Some Huawei products have a memory leak vulnerability due to memory don't be released when the XML parser process some node fail. An attacker could exploit it to cause memory leak, which may further lead to system exceptions. Vulnerability ID: HWPSIRT-2017-08151 This vulnerability has been assign...
Security Advisory - Remote Code Execution Vulnerability in Microsoft Windows Server Service
Microsoft released a security bulletin MS08-067 to disclose a remote code execution vulnerability in the Server service. An unauthenticated, remote attacker may send a specially crafted RPC request to the affected products. Successful exploit may result in arbitrary code execution. Vulnerability...
Security Advisory - Two Security Vulnerabilities in Huawei EMUI
Huawei EMUI3.1 has two vulnerabilities. The Keyguard application in Huawei EMUI3.1 has a privilege elevation vulnerability due to insufficient validation on specific parameters. An attacker may trick a user into installing a malicious application. Successful exploit could allow the attacker to...