alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2018-7806 (published 2018-11-30)
Data Center Operation allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly uploaded by an authenticated user via this feature which could contain path traversal file names. As such, it could allow for the arbitrary upload of files contained with the zip onto the server file system outside of the intended directory. This is leveraging the more commonly known ZipSlip vulnerability within Java code.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: schneider-electric
Affected products: struxureware_data_center_operation
CVE-2018-7807 (published 2018-11-30)
Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly uploaded by an authenticated user via this feature which could contain path traversal file names. As such, it could allow for the arbitrary upload of files contained with the zip onto the server file system outside of the intended directory. This is leveraging the more commonly known ZipSlip vulnerability within Java code.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: schneider-electric
Affected products: struxureware_data_center_expert
CVE-2018-7809 (published 2018-11-30)
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-640
Affected vendors: schneider-electric
Affected products: modicom_bmxnor0200h, modicom_bmxnor0200h_firmware, modicom_m340, modicom_m340_firmware, modicom_premium, modicom_premium_firmware, modicom_quantum, modicom_quantum_firmware
CVE-2018-7810 (published 2018-11-30)
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browser, potentially impacting the machine the browser is running on.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: schneider-electric
Affected products: modicom_bmxnor0200h, modicom_bmxnor0200h_firmware, modicom_m340, modicom_m340_firmware, modicom_premium, modicom_premium_firmware, modicom_quantum, modicom_quantum_firmware
CVE-2018-7811 (published 2018-11-30)
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-640
Affected vendors: schneider-electric
Affected products: modicom_bmxnor0200h, modicom_bmxnor0200h_firmware, modicom_m340, modicom_m340_firmware, modicom_premium, modicom_premium_firmware, modicom_quantum, modicom_quantum_firmware
CVE-2018-7812 (published 2018-12-17)
An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where the web server sends different responses in a way that exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: schneider-electric
Affected products: modicom_bmxnor0200h, modicom_bmxnor0200h_firmware, modicom_m340, modicom_m340_firmware, modicom_premium, modicom_premium_firmware, modicom_quantum, modicom_quantum_firmware
CVE-2018-7813 (published 2019-02-06)
A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on pcwin.dll which could cause remote code to be executed when parsing a GD1 file
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-704
Affected vendors: schneider-electric
Affected products: guicon
CVE-2018-7814 (published 2019-02-06)
A Stack-based Buffer Overflow (CWE-121) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) which could cause remote code to be executed when parsing a GD1 file
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: schneider-electric
Affected products: guicon
CVE-2018-7815 (published 2019-02-06)
A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on c3core.dll which could cause remote code to be executed when parsing a GD1 file
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-704
Affected vendors: schneider-electric
Affected products: guicon
CVE-2018-7816 (published 2019-05-22)
A Permissions, Privileges, and Access Control vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to delete an arbitrary file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: schneider-electric
Affected products: d6220, d6220_firmware, d6220l, d6220l_firmware, d6230, d6230_firmware, d6230l, d6230l_firmware, ime119-1ei, ime119-1ei_firmware, ime119-1ep, ime119-1ep_firmware, ime119-1es, ime119-1es_firmware, ime119-1i, ime119-1i_firmware, ime119-1p, ime119-1p_firmware, ime119-1s, ime119-1s_firmware, ime119-1vi, ime119-1vi_firmware, ime119-1vp, ime119-1vp_firmware, ime119-1vs
CVE-2018-7817 (published 2019-02-06)
A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially crafted Zelio Soft project file.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: schneider-electric
Affected products: zelio_soft_2
CVE-2018-7820 (published 2019-09-17)
A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to be viewed in plaintext when Remote Monitoring is enabled, and then disabled.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-255
Affected vendors: schneider-electric
Affected products: ap9630, ap9630_firmware, ap9631, ap9631_firmware, ap9635, ap9635_firmware, smart-ups_srt_5kva, smart-ups_srt_5kva_firmware
CVE-2018-7821 (published 2019-05-22)
An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause cycle time impact when flooding the M221 ethernet interface while the Ethernet/IP adapter is activated.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: schneider-electric
Affected products: modicon_m221, modicon_m221_firmware, somachine_basic
CVE-2018-7822 (published 2019-05-22)
An Incorrect Default Permissions (CWE-276) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause unauthorized access to SoMachine Basic resource files when logged on the system hosting SoMachine Basic.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-276
Affected vendors: schneider-electric
Affected products: modicon_m221, modicon_m221_firmware, somachine_basic
CVE-2018-7823 (published 2019-05-22)
A Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause remote launch of SoMachine Basic when sending crafted ethernet message.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Affected vendors: schneider-electric
Affected products: modicon_m221, modicon_m221_firmware, somachine_basic
CVE-2018-7824 (published 2019-05-22)
An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior) which could allow write access to system files available only to users with SYSTEM privilege or other important user files.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-610
Affected vendors: microsoft, schneider-electric
Affected products: driver_suite, modbus_serial_driver, windows
CVE-2018-7825 (published 2019-05-22)
A Command Injection vulnerability exists in the web-based GUI of the 1st Gen PelcoSarix Enhanced Camera that could allow a remote attacker to execute arbitrary commands.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: schneider-electric
Affected products: d6220, d6220_firmware, d6220l, d6220l_firmware, d6230, d6230_firmware, d6230l, d6230l_firmware, ime119-1ei, ime119-1ei_firmware, ime119-1ep, ime119-1ep_firmware, ime119-1es, ime119-1es_firmware, ime119-1i, ime119-1i_firmware, ime119-1p, ime119-1p_firmware, ime119-1s, ime119-1s_firmware, ime119-1vi, ime119-1vi_firmware, ime119-1vp, ime119-1vp_firmware, ime119-1vs
CVE-2018-7826 (published 2019-05-22)
A Command Injection vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to execute arbitrary commands.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: schneider-electric
Affected products: d6220, d6220_firmware, d6220l, d6220l_firmware, d6230, d6230_firmware, d6230l, d6230l_firmware, ime119-1ei, ime119-1ei_firmware, ime119-1ep, ime119-1ep_firmware, ime119-1es, ime119-1es_firmware, ime119-1i, ime119-1i_firmware, ime119-1p, ime119-1p_firmware, ime119-1s, ime119-1s_firmware, ime119-1vi, ime119-1vi_firmware, ime119-1vp, ime119-1vp_firmware, ime119-1vs
CVE-2018-7827 (published 2019-05-22)
A Cross-Site Scripting (XSS) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which a remote attacker can execute arbitrary HTML and script code in a user’s browser session.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: schneider-electric
Affected products: d6220, d6220_firmware, d6220l, d6220l_firmware, d6230, d6230_firmware, d6230l, d6230l_firmware, ime119-1ei, ime119-1ei_firmware, ime119-1ep, ime119-1ep_firmware, ime119-1es, ime119-1es_firmware, ime119-1i, ime119-1i_firmware, ime119-1p, ime119-1p_firmware, ime119-1s, ime119-1s_firmware, ime119-1vi, ime119-1vi_firmware, ime119-1vp, ime119-1vp_firmware, ime119-1vs
CVE-2018-7828 (published 2019-05-22)
A Cross-Site Request Forgery (CSRF) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera when an authenticated user clicks a specially crafted malicious link while logged into the camera.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: schneider-electric
Affected products: d6220, d6220_firmware, d6220l, d6220l_firmware, d6230, d6230_firmware, d6230l, d6230l_firmware, ime119-1ei, ime119-1ei_firmware, ime119-1ep, ime119-1ep_firmware, ime119-1es, ime119-1es_firmware, ime119-1i, ime119-1i_firmware, ime119-1p, ime119-1p_firmware, ime119-1s, ime119-1s_firmware, ime119-1vi, ime119-1vi_firmware, ime119-1vp, ime119-1vp_firmware, ime119-1vs
CVE-2018-7829 (published 2019-05-22)
An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which allows an attacker to execute arbitrary system commands.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-943
Affected vendors: schneider-electric
Affected products: d6220, d6220_firmware, d6220l, d6220l_firmware, d6230, d6230_firmware, d6230l, d6230l_firmware, ime119-1ei, ime119-1ei_firmware, ime119-1ep, ime119-1ep_firmware, ime119-1es, ime119-1es_firmware, ime119-1i, ime119-1i_firmware, ime119-1p, ime119-1p_firmware, ime119-1s, ime119-1s_firmware, ime119-1vi, ime119-1vi_firmware, ime119-1vp, ime119-1vp_firmware, ime119-1vs
CVE-2018-7830 (published 2018-11-30)
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a denial of service can occur for ~1 minute by sending a specially crafted HTTP request.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-113
Affected vendors: schneider-electric
Affected products: modicom_bmxnor0200h, modicom_bmxnor0200h_firmware, modicom_m340, modicom_m340_firmware, modicom_premium, modicom_premium_firmware, modicom_quantum, modicom_quantum_firmware
CVE-2018-7831 (published 2018-11-30)
An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a password change on the web server.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-79
Affected vendors: schneider-electric
Affected products: modicom_bmxnor0200h, modicom_bmxnor0200h_firmware, modicom_m340, modicom_m340_firmware, modicom_premium, modicom_premium_firmware, modicom_quantum, modicom_quantum_firmware
CVE-2018-7832 (published 2018-12-24)
An Improper Input Validation vulnerability exists in Pro-Face GP-Pro EX v4.08 and previous versions which could cause the execution arbitrary executable when GP-Pro EX is launched.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: schneider-electric
Affected products: pro-face_gp-pro_ex
CVE-2018-7833 (published 2018-12-17)
An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where an unauthenticated user can send a specially crafted XML data via a POST request to cause the web server to become unavailable
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-754
Affected vendors: schneider-electric
Affected products: modicom_bmxnor0200h, modicom_bmxnor0200h_firmware, modicom_m340, modicom_m340_firmware, modicom_premium, modicom_premium_firmware, modicom_quantum, modicom_quantum_firmware
CVE-2018-7834 (published 2019-05-22)
A CWE-79 Cross-Site Scripting vulnerability exists in all versions of the TSXETG100 allowing an attacker to send a specially crafted URL with an embedded script to a user that would then be executed within the context of that user.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: schneider-electric
Affected products: tsxetg100, tsxetg100_firmware
CVE-2018-7835 (published 2018-12-24)
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files available to SYSTEM user.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: schneider-electric
Affected products: iiot_monior
CVE-2018-7836 (published 2018-12-24)
An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and execution of malicious files.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: schneider-electric
Affected products: iiot_monitor
CVE-2018-7837 (published 2018-12-24)
An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow the software to resolve documents outside of the intended sphere of control, causing the software to embed incorrect documents into its output and expose restricted information.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-611
Affected vendors: schneider-electric
Affected products: iiot_monior
CVE-2018-7838 (published 2019-07-15)
A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP CWD command with a data length greater than 1020 bytes. A power cycle is then needed to reactivate the FTP service.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: schneider-electric
Affected products: bmeh582040, bmeh582040_firmware, bmeh582040c, bmeh584040, bmeh584040c, bmeh586040, bmeh586040_firmware, bmeh586040c, bmenoc0301, bmenoc0301_firmware, modicon_m580_bmep581020, modicon_m580_bmep581020_firmware, modicon_m580_bmep581020h, modicon_m580_bmep582020, modicon_m580_bmep582020_firmware, modicon_m580_bmep582020h, modicon_m580_bmep582040, modicon_m580_bmep582040_firmware, modicon_m580_bmep582040h, modicon_m580_bmep582040s, modicon_m580_bmep582040s_firmware, modicon_m580_bmep583020, modicon_m580_bmep583020_firmware, modicon_m580_bmep583040, modicon_m580_bmep583040_firmware
CVE-2018-7839 (published 2019-02-06)
A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-310
Affected vendors: schneider-electric
Affected products: iiot_monitor
CVE-2018-7840 (published 2019-05-22)
A Uncontrolled Search Path Element (CWE-427) vulnerability exists in VideoXpert OpsCenter versions prior to 3.1 which could allow an attacker to cause the system to call an incorrect DLL.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: pelco
Affected products: videoxpert_opscenter
CVE-2018-7841 (published 2019-05-22)
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: schneider-electric
Affected products: u.motion_builder
Added to CISA KEV catalog: 2022-04-15
KEV required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2018-7842 (published 2019-05-22)
A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an elevation of privilege by conducting a brute force attack on Modbus parameters sent to the controller.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-290
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7843 (published 2019-05-22)
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading memory blocks with an invalid data size or with an invalid data offset in the controller over Modbus.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7844 (published 2019-05-22)
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading memory blocks from the controller over Modbus.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7845 (published 2019-05-22)
A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7846 (published 2019-05-22)
A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-668
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7847 (published 2019-05-22)
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service or potential code execution by overwriting configuration settings of the controller over Modbus.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7848 (published 2019-05-22)
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading files from the controller over Modbus
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7849 (published 2019-05-22)
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause a possible Denial of Service due to improper data integrity check when sending files the controller over Modbus.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-755
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7850 (published 2019-05-22)
A CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause invalid information displayed in Unity Pro software.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7851 (published 2019-05-22)
CWE-119: Buffer errors vulnerability exists in Modicon M580 with firmware prior to V2.50, Modicon M340 with firmware prior to V3.01, BMxCRA312xx with firmware prior to V2.40, All firmware versions of Modicon Premium and 140CRA312xxx when sending a specially crafted Modbus packet, which could cause a denial of service to the device that would force a restart to restore availability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: schneider-electric
Affected products: 140cra312xxx, 140cra312xxx_firmware, bmeh582040, bmeh582040c, bmeh584040, bmeh584040c, bmeh586040, bmeh586040c, bmx\/e_cra_firmware, bmxcra31200, bmxcra31210c, m340_firmware, m580_firmware, modicon_m340_bmxp341000, modicon_m340_bmxp341000h, modicon_m340_bmxp342000, modicon_m340_bmxp3420102, modicon_m340_bmxp3420102cl, modicon_m340_bmxp342020, modicon_m340_bmxp342020h, modicon_m340_bmxp3420302, modicon_m340_bmxp3420302cl, modicon_m340_bmxp3420302h, modicon_m580_bmep581020, modicon_m580_bmep581020h
CVE-2018-7852 (published 2019-05-22)
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when an invalid private command parameter is sent to the controller over Modbus.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-755
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7853 (published 2019-05-22)
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading invalid physical memory blocks in the controller over Modbus
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-754
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7854 (published 2019-05-22)
A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a denial of Service when sending invalid debug parameters to the controller over Modbus.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-754
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7855 (published 2019-05-22)
A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a Denial of Service when sending invalid breakpoint parameters to the controller over Modbus
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-754
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7856 (published 2019-05-22)
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of Service when writing invalid memory blocks to the controller over Modbus.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-754
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7857 (published 2019-05-22)
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible Denial of Service when writing out of bounds variables to the controller over Modbus.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-754
Affected vendors: schneider-electric
Affected products: modicon_m340, modicon_m340_firmware, modicon_m580, modicon_m580_firmware, modicon_premium, modicon_premium_firmware, modicon_quantum, modicon_quantum_firmware
CVE-2018-7858 (published 2018-03-12)
Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: canonical, opensuse, qemu, redhat
Affected products: enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_server_eus, enterprise_linux_server_tus, enterprise_linux_workstation, leap, qemu, ubuntu_linux
CVE-2018-7859 (published 2019-12-30)
A security vulnerability in D-Link DGS-1510-series switches with firmware 1.20.011, 1.30.007, 1.31.B003 and older that may allow a remote attacker to inject malicious scripts in the device and execute commands via browser that is configuring the unit.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: dlink
Affected products: dgs-1510-20, dgs-1510-20_firmware, dgs-1510-28, dgs-1510-28_firmware, dgs-1510-28p, dgs-1510-28p_firmware, dgs-1510-28x, dgs-1510-28x_firmware, dgs-1510-28xmp, dgs-1510-28xmp_firmware, dgs-1510-52, dgs-1510-52_firmware, dgs-1510-52x, dgs-1510-52x_firmware, dgs-1510-52xmp, dgs-1510-52xmp_firmware
CVE-2018-7866 (published 2018-03-08)
A NULL pointer dereference was discovered in newVar3 in util/decompile.c in libming 0.4.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: debian, libming
Affected products: debian_linux, libming
CVE-2018-7867 (published 2018-03-08)
There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 during a RegisterNumber sprintf. A Crafted input will lead to a denial of service attack.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: debian, libming
Affected products: debian_linux, libming
CVE-2018-7868 (published 2018-03-08)
There is a heap-based buffer over-read in the getName function of util/decompile.c in libming 0.4.8 for CONSTANT8 data. A Crafted input will lead to a denial of service attack.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: debian, libming
Affected products: debian_linux, libming
CVE-2018-7869 (published 2018-03-08)
There is a memory leak triggered in the function dcinit of util/decompile.c in libming 0.4.8, which will lead to a denial of service attack.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-772
Affected vendors: debian, libming
Affected products: debian_linux, libming
CVE-2018-7870 (published 2018-03-08)
An invalid memory address dereference was discovered in getString in util/decompile.c in libming 0.4.8 for CONSTANT16 data. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: debian, libming
Affected products: debian_linux, libming
CVE-2018-7871 (published 2018-03-08)
There is a heap-based buffer over-read in the getName function of util/decompile.c in libming 0.4.8 for CONSTANT16 data. A crafted input will lead to a denial of service or possibly unspecified other impact.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: debian, libming
Affected products: debian_linux, libming
CVE-2018-7872 (published 2018-03-08)
An invalid memory address dereference was discovered in the function getName in libming 0.4.8 for CONSTANT16 data. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: debian, libming
Affected products: debian_linux, libming
CVE-2018-7873 (published 2018-03-08)
There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 for INTEGER data. A Crafted input will lead to a denial of service attack.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: debian, libming
Affected products: debian_linux, libming
CVE-2018-7874 (published 2018-03-08)
An invalid memory address dereference was discovered in strlenext in util/decompile.c in libming 0.4.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: debian, libming
Affected products: debian_linux, libming
CVE-2018-7875 (published 2018-03-08)
There is a heap-based buffer over-read in the getString function of util/decompile.c in libming 0.4.8 for CONSTANT8 data. A Crafted input will lead to a denial of service attack.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: debian, libming
Affected products: debian_linux, libming
CVE-2018-7876 (published 2018-03-08)
In libming 0.4.8, a memory exhaustion vulnerability was found in the function parseSWF_ACTIONRECORD in util/parser.c, which allows remote attackers to cause a denial of service via a crafted file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: debian, libming
Affected products: debian_linux, libming
CVE-2018-7877 (published 2018-03-08)
There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 for DOUBLE data. A Crafted input will lead to a denial of service attack.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: debian, libming
Affected products: debian_linux, libming
CVE-2018-7884 (published 2018-06-05)
An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a process as SYSTEM to uninstall the old version: cl_1956.exe is run as SYSTEM on the %systemroot%\Temp folder, where any user can write a DLL (e.g., version.dll) to perform DLL Hijacking and elevate privileges to SYSTEM.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-426
Affected vendors: displaylink
Affected products: core_software_cleaner
CVE-2018-7886 (published 2018-03-15)
An issue was discovered in CloudMe 1.11.0. An unauthenticated local attacker that can connect to the "CloudMe Sync" client application listening on 127.0.0.1 port 8888 can send a malicious payload causing a buffer overflow condition. This will result in code execution, as demonstrated by a TCP reverse shell, or a crash. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-6892.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: cloudme
Affected products: sync
CVE-2018-7889 (published 2018-03-08)
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: calibre-ebook
Affected products: calibre
CVE-2018-7890 (published 2018-03-08)
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal classes, and then executes a PowerShell script. If the specified system is OfficeSharePointServer, then the username and password parameters to this script are not validated, leading to Command Injection.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: zohocorp
Affected products: manageengine_applications_manager
CVE-2018-7891 (published 2018-04-30)
The Milestone XProtect Video Management Software (Corporate, Expert, Professional+, Express+, Essential+) 2016 R1 (10.0.a) to 2018 R1 (12.1a) contains .NET Remoting endpoints that are vulnerable to deserialization attacks resulting in remote code execution.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: milestonesys, siemens
Affected products: siveillance_vms, xprotect
CVE-2018-7893 (published 2018-03-12)
CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cmsmadesimple
Affected products: cms_made_simple
CVE-2018-7894 (published 2018-03-09)
Eramba e1.0.6.033 has Reflected XSS in reviews/filterIndex/ThirdPartyRiskReview via the advanced_filter parameter (aka the Search Parameter).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: eramba
Affected products: eramba
CVE-2018-7899 (published 2018-04-19)
The Mali Driver of Huawei Berkeley-AL20 and Berkeley-BD smart phones with software Berkeley-AL20 8.0.0.105(C00), 8.0.0.111(C00), 8.0.0.112D(C00), 8.0.0.116(C00), 8.0.0.119(C00), 8.0.0.119D(C00), 8.0.0.122(C00), 8.0.0.132(C00), 8.0.0.132D(C00), 8.0.0.142(C00), 8.0.0.151(C00), Berkeley-BD 1.0.0.21, 1.0.0.22, 1.0.0.23, 1.0.0.24, 1.0.0.26, 1.0.0.29 has a double free vulnerability. An attacker can trick a user to install a malicious application and exploit this vulnerability when in the exception handling process. Successful exploitation may cause system reboot.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-415
Affected vendors: huawei
Affected products: berkeley-al20, berkeley-al20_firmware, berkeley-bd, berkeley-bd_firmware
CVE-2018-7900 (published 2019-01-02)
There is an information leak vulnerability in some Huawei HG products. An attacker may obtain information about the HG device by exploiting this vulnerability.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: huawei
Affected products: hg8010h, hg8010h_firmware, hg8040h, hg8040h_firmware, hg8045q, hg8045q_firmware, hg8110h, hg8110h_firmware, hg8240h, hg8240h_firmware, hg8242h, hg8242h_firmware
CVE-2018-7901 (published 2018-04-30)
RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with software versions earlier than 8.0.0.129 has a remote control vulnerability. An attacker can trick a user to install a malicious application. When the application connects with RCS for the first time, it needs user to manually click to agree. In addition, the attacker needs to obtain the key that RCS uses to authenticate the application. Successful exploitation may cause the attacker to control keyboard remotely.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)
Affected vendors: huawei
Affected products: alp-al00b, alp-al00b_firmware, bla-al00b, bla-al00b_firmware
CVE-2018-7902 (published 2018-05-24)
Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management privilege of the system.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: huawei
Affected products: 1288h_v5, 1288h_v5_firmware, 2288h_v5, 2288h_v5_firmware
CVE-2018-7903 (published 2018-05-24)
Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management privilege of the system.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: huawei
Affected products: 1288h_v5, 1288h_v5_firmware, 2288h_v5, 2288h_v5_firmware
CVE-2018-7904 (published 2018-05-24)
Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management privilege of the system.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: huawei
Affected products: 1288h_v5, 1288h_v5_firmware, 2288h_v5, 2288h_v5_firmware
CVE-2018-7906 (published 2018-09-12)
Some Huawei smart phones with software of Leland-AL00 8.0.0.114(C636), Leland-AL00A 8.0.0.171(C00) have a denial of service (DoS) vulnerability. An attacker can trick a user to install a malicious application to exploit this vulnerability. Due to insufficient verification of the parameter, successful exploitation can cause the smartphone black screen until restarting the phone.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: huawei
Affected products: leland-al00, leland-al00_firmware, lleland-al00a, lleland-al00a_firmware
CVE-2018-7907 (published 2018-09-26)
Some Huawei products Agassi-L09 AGS-L09C100B257CUSTC100D001, AGS-L09C170B253CUSTC170D001, AGS-L09C199B251CUSTC199D001, AGS-L09C229B003CUSTC229D001, Agassi-W09 AGS-W09C100B257CUSTC100D001, AGS-W09C128B252CUSTC128D001, AGS-W09C170B252CUSTC170D001, AGS-W09C229B251CUSTC229D001, AGS-W09C331B003CUSTC331D001, AGS-W09C794B001CUSTC794D001, Baggio2-U01A BG2-U01C100B160CUSTC100D001, BG2-U01C170B160CUSTC170D001, BG2-U01C199B162CUSTC199D001, BG2-U01C209B160CUSTC209D001, BG2-U01C333B160CUSTC333D001, Bond-AL00C Bond-AL00CC00B201, Bond-AL10B Bond-AL10BC00B201, Bond-TL10B Bond-TL10BC01B201, Bond-TL10C Bond-TL10CC01B131, Haydn-L1JB HDN-L1JC137B068, Kobe-L09A KOB-L09C100B252CUSTC100D001, KOB-L09C209B002CUSTC209D001, KOB-L09C362B001CUSTC362D001, Kobe-L09AHN KOB-L09C233B226, Kobe-W09C KOB-W09C128B251CUSTC128D001, LelandP-L22C 8.0.0.101(C675CUSTC675D2), LelandP-L22D 8.0.0.101(C675CUSTC675D2), Rhone-AL00 Rhone-AL00C00B186, Selina-L02 Selina-L02C432B153, Stanford-L09S Stanford-L09SC432B183, Toronto-AL00 Toronto-AL00C00B223, Toronto-AL00A Toronto-AL00AC00B223, Toronto-TL10 Toronto-TL10C01B223 have a sensitive information leak vulnerability. An attacker can trick a user to install a malicious application to exploit this vulnerability. Due to insufficient verification of the input, successful exploitation can cause sensitive information leak.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: huawei
Affected products: agassi-l09, agassi-l09_firmware, agassi-w09, agassi-w09_firmware, baggio2-u01a, baggio2-u01a_firmware, bond-al00c, bond-al00c_firmware, bond-al10b, bond-al10b_firmware, bond-tl10b, bond-tl10b_firmware, bond-tl10c, bond-tl10c_firmware, haydn-l1jb, haydn-l1jb_firmware, kobe-l09a, kobe-l09a_firmware, kobe-l09ahn, kobe-l09ahn_firmware, kobe-w09c, kobe-w09c_firmware, lelandp-l22c, lelandp-l22c_firmware, lelandp-l22d
CVE-2018-7910 (published 2018-11-13)
Some Huawei smartphones ALP-AL00B 8.0.0.118D(C00), ALP-TL00B 8.0.0.118D(C01), BLA-AL00B 8.0.0.118D(C00), BLA-L09C 8.0.0.127(C432), 8.0.0.128(C432), 8.0.0.137(C432), BLA-L29C 8.0.0.129(C432), 8.0.0.137(C432) have an authentication bypass vulnerability. When the attacker obtains the user's smartphone, the vulnerability can be used to replace the start-up program so that the attacker can obtain the information in the smartphone and achieve the purpose of controlling the smartphone.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: huawei
Affected products: alp-al00b, alp-al00b_firmware, alp-tl00b, alp-tl00b_firmware, bla-al00b, bla-al00b_firmware, bla-l09c, bla-l09c_firmware, bla-l29c, bla-l29c_firmware
CVE-2018-7911 (published 2018-10-23)
Some Huawei smart phones ALP-AL00B 8.0.0.106(C00), 8.0.0.113(SP2C00), 8.0.0.113(SP3C00), 8.0.0.113(SP7C00), 8.0.0.118(C00), 8.0.0.120(SP2C00), 8.0.0.125(SP1C00), 8.0.0.125(SP3C00), 8.0.0.126(SP2C00), 8.0.0.126(SP5C00), 8.0.0.127(SP1C00), 8.0.0.128(SP2C00), ALP-AL00B-RSC 1.0.0.2, BLA-TL00B 8.0.0.113(SP7C01), 8.0.0.118(C01), 8.0.0.120(SP2C01), 8.0.0.125(SP1C01), 8.0.0.125(SP2C01), 8.0.0.125(SP3C01), 8.0.0.126(SP2C01), 8.0.0.126(SP5C01), 8.0.0.127(SP1C01), 8.0.0.128(SP2C01), 8.0.0.129(SP2C01), Charlotte-AL00A 8.1.0.105(SP7C00), 8.1.0.106(SP3C00), 8.1.0.107(SP5C00), 8.1.0.107(SP7C00), 8.1.0.108(SP3C00), 8.1.0.108(SP6C00), 8.1.0.109(SP2C00), Emily-AL00A 8.1.0.105(SP6C00), 8.1.0.106(SP2C00), 8.1.0.107(SP5C00), 8.1.0.107(SP7C00), 8.1.0.108(SP2C00), 8.1.0.108(SP6C00), 8.1.0.109(SP5C00) have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the configuration flow by Gaode Map and can perform some operations to update the Google account. As a result, the FRP function is bypassed.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: huawei
Affected products: alp-al00b, alp-al00b-rsc, alp-al00b-rsc_firmware, alp-al00b_firmware, bla-tl00b, bla-tl00b_firmware, charlotte-al00a, charlotte-al00a_firmware, emily-al00a, emily-al00a_firmware
CVE-2018-7920 (published 2018-04-19)
Huawei AR1200 V200R006C10SPC300, AR160 V200R006C10SPC300, AR200 V200R006C10SPC300, AR2200 V200R006C10SPC300, AR3200 V200R006C10SPC300 devices have an improper resource management vulnerability. Due to the improper implementation of ACL mechanism, a remote attacker may send TCP messages to the management interface of the affected device to exploit this vulnerability. Successful exploit could exhaust the socket resource of management interface, leading to a DoS condition.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: huawei
Affected products: ar1200, ar1200_firmware, ar160, ar160_firmware, ar200, ar200_firmware, ar2200, ar2200_firmware, ar3200, ar3200_firmware
CVE-2018-7921 (published 2018-09-12)
Huawei B315s-22 products with software of 21.318.01.00.26 have an information leak vulnerability. Unauthenticated adjacent attackers may exploit this vulnerability to obtain device information.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: huawei
Affected products: b315s-22, b315s-22_firmware