Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
519 results · page 6 of 11
Jun 6, 2019The image processing module of some Huawei Mate 10 smartphones versions before ALP-L29 9.0.0.159(C185) has a memory double free vulnerability.CVE-2019-5305 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
The image processing module of some Huawei Mate 10 smartphones versions before ALP-L29 9.0.0.159(C185) has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can call special API, which could trigger double free and cause a system crash.
- Product
- Mate 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2019Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.125(C00E125R2P14T8) have an authorization bypass vulnerability.CVE-2019-5295 · Other software · Huawei · reported by psirt@huawei.comMedium 6.4
Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.125(C00E125R2P14T8) have an authorization bypass vulnerability. Due to improper authorization implementation logic, attackers can bypass certain authorization scopes of smart phones by performing specific operations. This vulnerability can be exploited to perform operations beyond the scope of authorization.
- Product
- Honor V10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2019There is a double free vulnerability on certain drivers of Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.181(C00E87R2P20T8).CVE-2019-5219 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
There is a double free vulnerability on certain drivers of Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.181(C00E87R2P20T8). An attacker tricks the user into installing a malicious application, which makes multiple processes operate the same resource at the same time. Successful exploit could cause a denial of service condition.
- Product
- Mate10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2019There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C00E156R2P14T8), Honor 10 smartphones versCVE-2019-5216 · Other software · Huawei · reported by psirt@huawei.comHigh 7
There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C00E156R2P14T8), Honor 10 smartphones versions earlier than Columbia-AL10B 9.0.0.156(C00E156R1P20T8) and Honor Play smartphones versions earlier than Cornell-AL00A 9.0.0.156(C00E156R1P13T8). An attacker tricks the user into installing a malicious application, which makes multiple processes to operate the same variate at the same time. Successful exploit could cause execution of malicious code.
- Product
- Honor V10, Honor 10, Honor Play
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2019There is a use after free vulnerability on certain driver component in Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.167(C00E85R2P20T8).CVE-2019-5214 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
There is a use after free vulnerability on certain driver component in Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.167(C00E85R2P20T8). An attacker tricks the user into installing a malicious application, which make the software to reference memory after it has been freed. Successful exploit could cause a denial of service condition.
- Product
- Huawei Mate10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2019Emily-L29C Huawei phones versions earlier than 9.0.0.159 (C185E2R1P12T8) have a Factory Reset Protection (FRP) bypass security vulnerability.CVE-2019-5297 · Other software · Huawei · reported by psirt@huawei.comMedium 4.6
Emily-L29C Huawei phones versions earlier than 9.0.0.159 (C185E2R1P12T8) have a Factory Reset Protection (FRP) bypass security vulnerability. Before the FRP account is verified and activated during the reset process, the attacker can perform some special operations to bypass the FRP function and obtain the right to use the mobile phone.
- Product
- Emily-L29C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2019There is a DoS vulnerability in RTSP module of Leland-AL00A Huawei smart phones versions earlier than Leland-AL00A 9.1.0.111(C00E111R2P10T8).CVE-2019-5284 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
There is a DoS vulnerability in RTSP module of Leland-AL00A Huawei smart phones versions earlier than Leland-AL00A 9.1.0.111(C00E111R2P10T8). Remote attackers could trick the user into opening a malformed RTSP media stream to exploit this vulnerability. Successful exploit could cause the affected phone abnormal, leading to a DoS condition. (Vulnerability ID: HWPSIRT-2019-02004)
- Product
- Leland-AL00A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2019There is Factory Reset Protection (FRP) bypass security vulnerability in P20 Huawei smart phones versions earlier than Emily-AL00A 9.0.0.167 (C00E81R1P21T8).CVE-2019-5283 · Other software · Huawei · reported by psirt@huawei.comMedium 4.6
There is Factory Reset Protection (FRP) bypass security vulnerability in P20 Huawei smart phones versions earlier than Emily-AL00A 9.0.0.167 (C00E81R1P21T8). When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the Talkback mode and can perform some operations to access the setting page. As a result, the FRP function is bypassed.
- Product
- P20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2019There is an information disclosure vulnerability on Mate 9 Pro Huawei smartphones versions earlier than LON-AL00B9.0.1.150 (C00E61R1P8T8).CVE-2019-5217 · Other software · Huawei · reported by psirt@huawei.comMedium 4.6
There is an information disclosure vulnerability on Mate 9 Pro Huawei smartphones versions earlier than LON-AL00B9.0.1.150 (C00E61R1P8T8). An attacker could view the photos after a series of operations without unlocking the screen lock. Successful exploit could cause an information disclosure condition.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2019There is a man-in-the-middle (MITM) vulnerability on Huawei P30 smartphones versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), and P30 Pro versions bCVE-2019-5215 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
There is a man-in-the-middle (MITM) vulnerability on Huawei P30 smartphones versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), and P30 Pro versions before VOG-AL00 9.1.0.162 (C01E160R1P12/C01E160R2P1). When users establish connection and transfer data through Huawei Share, an attacker could sniff, spoof and do a series of operations to intrude the Huawei Share connection and launch a man-in-the-middle attack to obtain and tamper the data. (Vulnerability ID: HWPSIRT-2019-03109)
- Product
- P30,P30 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2019There is a Factory Reset Protection (FRP) bypass security vulnerability in P20 Huawei smart phones versions before Emily-AL00A 9.0.0.167(C00E81R1P21T8).CVE-2019-5306 · Other software · Huawei · reported by psirt@huawei.comMedium 4.6
There is a Factory Reset Protection (FRP) bypass security vulnerability in P20 Huawei smart phones versions before Emily-AL00A 9.0.0.167(C00E81R1P21T8). When re-configuring the mobile phone using the FRP function, an attacker can delete the activation lock after a series of operations. As a result, the FRP function is bypassed and the attacker gains access to the smartphone.
- Product
- P20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2019Mate20 Huawei smartphones versions earlier than HMA-AL00C00B175 have an out-of-bounds read vulnerability.CVE-2019-5296 · Other software · Huawei · reported by psirt@huawei.comLow 3.9
Mate20 Huawei smartphones versions earlier than HMA-AL00C00B175 have an out-of-bounds read vulnerability. An attacker with a high permission runs some specific commands on the smartphone. Due to insufficient input verification, successful exploit may cause out-of-bounds read of the memory and the system abnormal.
- Product
- Mate20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2019There is an information leak vulnerability in some Huawei phones, versions earlier than Jackman-L21 8.2.0.155(C185R1P2).CVE-2019-5281 · Other software · Huawei · reported by psirt@huawei.comMedium 4.6
There is an information leak vulnerability in some Huawei phones, versions earlier than Jackman-L21 8.2.0.155(C185R1P2). When a local attacker uses the camera of a smartphone, the attacker can exploit this vulnerability to obtain sensitive information by performing a series of operations.
- Product
- Huawei Y9 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2019Mate 9 Pro Huawei smartphones earlier than LON-L29C 8.0.0.361(C636) versions have an information leak vulnerability due to the lack of input validation.CVE-2019-5244 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Mate 9 Pro Huawei smartphones earlier than LON-L29C 8.0.0.361(C636) versions have an information leak vulnerability due to the lack of input validation. An attacker tricks the user who has root privilege to install an application on the smart phone, and the application can read some process information, which may cause sensitive information leak.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2019Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commaCVE-2018-17565 · Other software · Grandstream · reported by MITRECritical 9.8
Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell.
- Product
- Gxp1610 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrandstream.comiridiumxor.wordpress.com
Apr 1, 2019A Malformed Input String to /cgi-bin/delete_CA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin aCVE-2018-17564 · Other software · Grandstream · reported by MITRECritical 9.8
A Malformed Input String to /cgi-bin/delete_CA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device.
- Product
- Gxp1610 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrandstream.comiridiumxor.wordpress.com
Apr 1, 2019A Malformed Input String to /cgi-bin/api-get_line_status on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleCVE-2018-17563 · Other software · Grandstream · reported by MITREMedium 5.3
A Malformed Input String to /cgi-bin/api-get_line_status on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext.
- Product
- Gxp1610 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrandstream.comiridiumxor.wordpress.com
Mar 13, 2019A vulnerability in the implementation of Session Initiation Protocol (SIP) processing in Cisco Small Business SPA514G IP Phones could allow an unauthenticated, CVE-2018-0389 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the implementation of Session Initiation Protocol (SIP) processing in Cisco Small Business SPA514G IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to improper processing of SIP request messages by an affected device. An attacker could exploit this vulnerability by sending crafted SIP messages to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. Cisco has not released software updates that address this vulnerability. This vulnerability affects Cisco Small Business SPA514G IP Phones that are running firmware release 7.6.2SR2 or earlier.
- Product
- Cisco Small Business SPA500 Series IP Phones
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Feb 25, 2019A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker tCVE-2019-1683 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security (TLS)-encrypted Session Initiation Protocol (SIP) conversation. The vulnerability is due to the improper validation of server certificates. An attacker could exploit this vulnerability by crafting a malicious server certificate to present to the client. An exploit could allow an attacker to eavesdrop on TLS-encrypted traffic and potentially route or redirect calls initiated by an affected device. Affected software include version 7.6.2 of the Cisco Small Business SPA525 Series IP Phones and Cisco Small Business SPA5X5 Series IP Phones and version 1.4.2 of the Cisco Small Business SPA500 Series IP Phones and Cisco Small Business SPA112 Series IP Phones.
- Product
- Cisco Small Business SPA500 Series IP Phones
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Dec 20, 2018Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker (in the same network CVE-2018-18871 · Other software · Gigasetpro · reported by MITRECritical 9.8
Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker (in the same network as the device) to change the admin password without authentication (and without knowing the original password).
- Product
- Maxwell Basic Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsit.fraunhofer.desit.fraunhofer.de
Dec 4, 2018There is an out-of-bounds write vulnerability on Huawei P20 smartphones with versions before 8.1.0.171(C00).CVE-2018-7987 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.9
There is an out-of-bounds write vulnerability on Huawei P20 smartphones with versions before 8.1.0.171(C00). The software does not handle the response message properly when the user doing certain inquiry operation, an attacker could send crafted message to the device, successful exploit could cause a denial of service condition.
- Product
- Huawei P20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2018There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones.CVE-2018-7988 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 4.6
There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently verify the permission, an attacker uses a data cable to connect the smartphone to another smartphone and then perform a series of specific operations. Successful exploit could allow the attacker bypass the FRP protection.
- Product
- Huawei nova 2 Plus, Huawei Mate9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2018There is a smart SMS verification code vulnerability in some Huawei smart phones.CVE-2018-7961 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6.5
There is a smart SMS verification code vulnerability in some Huawei smart phones. An attacker should trick a user to access malicious Website or malicious App and register. Due to incorrect processing of the smart SMS verification code, successful exploitation can cause sensitive information leak.
- Product
- Emily-AL00A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2018There is an information leak vulnerability in some Huawei smartphones.CVE-2018-7946 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 4.3
There is an information leak vulnerability in some Huawei smartphones. An attacker may do some specific configuration in the smartphone and trick a user into inputting some sensitive information. Due to improper design, successful exploit may cause some information leak.
- Product
- Huawei Honor 7A, Huawei Honor 9 Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2018The radio module of some Huawei smartphones Emily-AL00A The versions before 8.1.0.171(C00) have a lock-screen bypass vulnerability.CVE-2018-7925 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6.8
The radio module of some Huawei smartphones Emily-AL00A The versions before 8.1.0.171(C00) have a lock-screen bypass vulnerability. An unauthenticated attacker could start third-part input method APP through certain operations to bypass lock-screen by exploit this vulnerability.
- Product
- Emily-AL00A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2018Some Huawei smartphones ALP-AL00B 8.0.0.118D(C00), ALP-TL00B 8.0.0.118D(C01), BLA-AL00B 8.0.0.118D(C00), BLA-L09C 8.0.0.127(C432), 8.0.0.128(C432), 8.0.0.137(C4CVE-2018-7910 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6.8
Some Huawei smartphones ALP-AL00B 8.0.0.118D(C00), ALP-TL00B 8.0.0.118D(C01), BLA-AL00B 8.0.0.118D(C00), BLA-L09C 8.0.0.127(C432), 8.0.0.128(C432), 8.0.0.137(C432), BLA-L29C 8.0.0.129(C432), 8.0.0.137(C432) have an authentication bypass vulnerability. When the attacker obtains the user's smartphone, the vulnerability can be used to replace the start-up program so that the attacker can obtain the information in the smartphone and achieve the purpose of controlling the smartphone.
- Product
- ALP-AL00B, ALP-TL00B, BLA-AL00B, BLA-L09C, BLA-L29C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2018Some Huawei smart phones ALP-AL00B 8.0.0.106(C00), 8.0.0.113(SP2C00), 8.0.0.113(SP3C00), 8.0.0.113(SP7C00), 8.0.0.118(C00), 8.0.0.120(SP2C00), 8.0.0.125(SP1C00)CVE-2018-7911 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 4.6
Some Huawei smart phones ALP-AL00B 8.0.0.106(C00), 8.0.0.113(SP2C00), 8.0.0.113(SP3C00), 8.0.0.113(SP7C00), 8.0.0.118(C00), 8.0.0.120(SP2C00), 8.0.0.125(SP1C00), 8.0.0.125(SP3C00), 8.0.0.126(SP2C00), 8.0.0.126(SP5C00), 8.0.0.127(SP1C00), 8.0.0.128(SP2C00), ALP-AL00B-RSC 1.0.0.2, BLA-TL00B 8.0.0.113(SP7C01), 8.0.0.118(C01), 8.0.0.120(SP2C01), 8.0.0.125(SP1C01), 8.0.0.125(SP2C01), 8.0.0.125(SP3C01), 8.0.0.126(SP2C01), 8.0.0.126(SP5C01), 8.0.0.127(SP1C01), 8.0.0.128(SP2C01), 8.0.0.129(SP2C01), Charlotte-AL00A 8.1.0.105(SP7C00), 8.1.0.106(SP3C00), 8.1.0.107(SP5C00), 8.1.0.107(SP7C00), 8.1.0.108(SP3C00), 8.1.0.108(SP6C00), 8.1.0.109(SP2C00), Emily-AL00A 8.1.0.105(SP6C00), 8.1.0.106(SP2C00), 8.1.0.107(SP5C00), 8.1.0.107(SP7C00), 8.1.0.108(SP2C00), 8.1.0.108(SP6C00), 8.1.0.109(SP5C00) have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the configuration flow by Gaode Map and can perform some operations to update the Google account. As a result, the FRP function is bypassed.
- Product
- ALP-AL00B, ALP-AL00B-RSC, BLA-TL00B, Charlotte-AL00A, Emily-AL00A,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2018Huawei Mate 10 pro smartphones with the versions before BLA-AL00B 8.1.0.326(C00) have an improper authentication vulnerability.CVE-2018-7989 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 4.6
Huawei Mate 10 pro smartphones with the versions before BLA-AL00B 8.1.0.326(C00) have an improper authentication vulnerability. App Lock is a function to prevent unauthorized use of apps on smartphones, an attacker could directly change the lock password after a series of operations. Successful exploit could allow the attacker to use the application which is locked.
- Product
- Mate 10 pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2018Anne-AL00 Huawei phones with versions earlier than 8.0.0.151(C00) have an information leak vulnerability.CVE-2018-7924 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comLow 2.4
Anne-AL00 Huawei phones with versions earlier than 8.0.0.151(C00) have an information leak vulnerability. Due to improper permission settings for specific commands, attackers who can connect to a mobile phone via the USB interface may exploit this vulnerability to obtain specific device information of the mobile phone.
- Product
- Anne-AL00
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2018The hardware security module of Mate 9 and Mate 9 Pro Huawei smart phones with the versions earlier before MHA-AL00BC00B156, versions earlier before MHA-CL00BC0CVE-2017-17176 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6.7
The hardware security module of Mate 9 and Mate 9 Pro Huawei smart phones with the versions earlier before MHA-AL00BC00B156, versions earlier before MHA-CL00BC00B156, versions earlier before MHA-DL00BC00B156, versions earlier before MHA-TL00BC00B156, versions earlier before LON-AL00BC00B156, versions earlier before LON-CL00BC00B156, versions earlier before LON-DL00BC00B156, versions earlier before LON-TL00BC00B156 has a arbitrary memory read/write vulnerability due to the input parameters validation. An attacker with the root privilege of the Android system could exploit this vulnerability to read and write memory data anywhere or execute arbitrary code in the TrustZone.
- Product
- Mate 9, Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2018Huawei smartphones Mate10 with versions earlier before ALP-AL00B 8.0.0.110(C00) have a Factory Reset Protection (FRP) bypass vulnerability.CVE-2018-7991 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 4.6
Huawei smartphones Mate10 with versions earlier before ALP-AL00B 8.0.0.110(C00) have a Factory Reset Protection (FRP) bypass vulnerability. The system does not sufficiently verify the permission, an attacker uses a data cable to connect the smartphone to the computer and then perform some specific operations. Successful exploit could allow the attacker bypass the FRP protection to access the system setting page.
- Product
- Mate10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2018Huawei Mate RS smartphones with the versions before NEO-AL00D 8.1.0.167(C786) have a lock-screen bypass vulnerability.CVE-2018-7929 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6.8
Huawei Mate RS smartphones with the versions before NEO-AL00D 8.1.0.167(C786) have a lock-screen bypass vulnerability. An attacker could unlock and use the phone through certain operations.
- Product
- Mate RS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2018Huawei smart phones G9 Lite, Honor 5A, Honor 6X, Honor 8 with the versions before VNS-L53C605B120CUSTC605D103, the versions before CAM-L03C605B143CUSTC605D008, CVE-2018-7939 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 4.6
Huawei smart phones G9 Lite, Honor 5A, Honor 6X, Honor 8 with the versions before VNS-L53C605B120CUSTC605D103, the versions before CAM-L03C605B143CUSTC605D008, the versions before CAM-L21C10B145, the versions before CAM-L21C185B156, the versions before CAM-L21C223B133, the versions before CAM-L21C432B210, the versions before CAM-L21C464B170, the versions before CAM-L21C636B245, the versions before Berlin-L21C10B372, the versions before Berlin-L21C185B363, the versions before Berlin-L21C464B137, the versions before Berlin-L23C605B161, the versions before FRD-L09C10B387, the versions before FRD-L09C185B387, the versions before FRD-L09C432B398, the versions before FRD-L09C636B387, the versions before FRD-L19C10B387, the versions before FRD-L19C432B399, the versions before FRD-L19C636B387 have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can disable the boot wizard by enable the talkback function. As a result, the FRP function is bypassed.
- Product
- G9 Lite, Honor 5A, Honor 6X, Honor 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2018Huawei ALP-L09 smart phones with versions earlier than ALP-L09 8.0.0.150(C432) have an insufficient input validation vulnerability due to lack of parameter checCVE-2018-7923 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
Huawei ALP-L09 smart phones with versions earlier than ALP-L09 8.0.0.150(C432) have an insufficient input validation vulnerability due to lack of parameter check. An attacker tricks the user who has root privilege to install a crafted application, the application may modify the specific data to exploit the vulnerability. Successful exploit could allow the attacker to execute arbitrary code.
- Product
- ALP-L09
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2018Huawei ALP-L09 smart phones with versions earlier than ALP-L09 8.0.0.150(C432) have an insufficient input validation vulnerability due to lack of parameter checCVE-2018-7922 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
Huawei ALP-L09 smart phones with versions earlier than ALP-L09 8.0.0.150(C432) have an insufficient input validation vulnerability due to lack of parameter check. An attacker tricks the user who has root privilege to install a crafted application, the application may modify the specific data to exploit the vulnerability. Successful exploit could allow the attacker to execute arbitrary code.
- Product
- ALP-L09
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2018Some Huawei smart phones with software of Leland-AL00 8.0.0.114(C636), Leland-AL00A 8.0.0.171(C00) have a denial of service (DoS) vulnerability.CVE-2018-7906 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.5
Some Huawei smart phones with software of Leland-AL00 8.0.0.114(C636), Leland-AL00A 8.0.0.171(C00) have a denial of service (DoS) vulnerability. An attacker can trick a user to install a malicious application to exploit this vulnerability. Due to insufficient verification of the parameter, successful exploitation can cause the smartphone black screen until restarting the phone.
- Product
- Leland-AL00, Leland-AL00A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2018Mate10 Pro Huawei smart phones with the versions before 8.1.0.326(C00) have a FRP bypass vulnerability.CVE-2018-7990 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 4.6
Mate10 Pro Huawei smart phones with the versions before 8.1.0.326(C00) have a FRP bypass vulnerability. During the mobile phone reseting process, an attacker could bypass "Find My Phone" protect after a series of voice and keyboard operations. Successful exploit could allow an attacker to bypass FRP.
- Product
- Mate10 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2018P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission validation.CVE-2018-7938 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comLow 3.3
P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can read some hardware serial number, which may cause sensitive information leak.
- Product
- P10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2018Mate 10 Pro Huawei smart phones with the versions before BLA-L29 8.0.0.148(C432) have a Factory Reset Protection (FRP) bypass security vulnerability.CVE-2018-7936 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 4.6
Mate 10 Pro Huawei smart phones with the versions before BLA-L29 8.0.0.148(C432) have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can connect the phone with PC and send special instructions to install third party desktop and disable the boot wizard. As a result, the FRP function is bypassed.
- Product
- Mate 10 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2018HUAWEI Mate 10 smartphones with versions earlier than ALP-AL00 8.1.0.311 have a use after free vulnerability on mediaserver component.CVE-2018-7993 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
HUAWEI Mate 10 smartphones with versions earlier than ALP-AL00 8.1.0.311 have a use after free vulnerability on mediaserver component. An attacker tricks the user install a malicious application, which make the software to reference memory after it has been freed. Successful exploit could cause execution of arbitrary code.
- Product
- HUAWEI Mate 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2018Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability.CVE-2018-7957 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comLow 3.3
Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability. Because an interface does not verify authorization correctly, attackers can exploit an application with the authorization of phone state to obtain user location additionally.
- Product
- Victoria-AL00
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2018Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability.CVE-2018-7947 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comLow 3.9
Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific function. Successful exploit may cause some malicious applications to be installed in the mobile phones.
- Product
- Emily-AL00A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2018The content://wappush content provider in com.android.provider.telephony, as found in some custom ROMs for Android phones, allows SQL injection.CVE-2018-14066 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
The content://wappush content provider in com.android.provider.telephony, as found in some custom ROMs for Android phones, allows SQL injection. One consequence is that an application without the READ_SMS permission can read SMS messages. This affects Infinix X571 phones, as well as various Lenovo phones (such as the A7020) that have since been fixed by Lenovo.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhacked0x90.wordpress.comhacked0x90.wordpress.com
Jul 5, 2018Huawei smart phones Emily-AL00A with software 8.1.0.106(SP2C00) and 8.1.0.107(SP5C00) have a Factory Reset Protection (FRP) bypass vulnerability.CVE-2018-7944 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6.8
Huawei smart phones Emily-AL00A with software 8.1.0.106(SP2C00) and 8.1.0.107(SP5C00) have a Factory Reset Protection (FRP) bypass vulnerability. An attacker gets some user's smart phone and performs some special operations in the guide function. The attacker may exploit the vulnerability to bypass FRP function and use the phone normally.
- Product
- Emily-AL00A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2018Short Message Service (SMS) module of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.354(C00) has a Denial of Service (DoS) vulnerabiliCVE-2017-17175 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6.5
Short Message Service (SMS) module of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.354(C00) has a Denial of Service (DoS) vulnerability. An unauthenticated attacker may set up a pseudo base station, and send special malware text message to the phone, causing the mobile phone to fail to make calls and send and receive text messages.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2018Due to insufficient parameters verification GPU driver of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.356(C00) has an arbitrary memoCVE-2017-17173 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
Due to insufficient parameters verification GPU driver of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.356(C00) has an arbitrary memory free vulnerability. An attacker can tricks a user into installing a malicious application on the smart phone, and send given parameter to driver to release special kernel memory resource. Successful exploit may result in phone crash or arbitrary code execution.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2018Huawei smart phones LYO-L21 with software LYO-L21C479B107, LYO-L21C479B107 have a privilege escalation vulnerability.CVE-2017-17172 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.3
Huawei smart phones LYO-L21 with software LYO-L21C479B107, LYO-L21C479B107 have a privilege escalation vulnerability. An authenticated, local attacker can crafts malformed packets after tricking a user to install a malicious application and exploit this vulnerability when in the exception handling process. Successful exploitation may cause the attacker to obtain a higher privilege of the smart phones.
- Product
- LYO-L21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2018A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 6800, 7800, and 8800 Series Phones with Multiplatform FirCVE-2018-0316 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 6800, 7800, and 8800 Series Phones with Multiplatform Firmware could allow an unauthenticated, remote attacker to cause an affected phone to reload unexpectedly, resulting in a temporary denial of service (DoS) condition. The vulnerability exists because the firmware of an affected phone incorrectly handles errors that could occur when an incoming phone call is not answered. An attacker could exploit this vulnerability by sending a set of maliciously crafted SIP packets to an affected phone. A successful exploit could allow the attacker to cause the affected phone to reload unexpectedly, resulting in a temporary DoS condition. This vulnerability affects Cisco IP Phone 6800, 7800, and 8800 Series Phones with Multiplatform Firmware if they are running a Multiplatform Firmware release prior to Release 11.1(2). Cisco Bug IDs: CSCvi24718.
- Product
- IP Phone Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comtools.cisco.com
Jun 1, 2018Some Huawei smart phones have the denial of service (DoS) vulnerability due to the improper processing of malicious parameters.CVE-2017-17171 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 4.2
Some Huawei smart phones have the denial of service (DoS) vulnerability due to the improper processing of malicious parameters. An attacker may trick a target user into installing a malicious APK and launch attacks using a pre-installed app with specific permissions. Successful exploit could allow the app to send specific parameters to the smart phone driver, which will result in system restart.
- Product
- HUAWEI Mate 8; HUAWEI P9; HUAWEI P9 Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2018Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the veCVE-2017-17158 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 4.6
Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the versions before Prague-AL00CC00B223; the versions before Prague-L31C432B208; the versions before Prague-TL00AC01B223; the versions before Prague-TL00AC01B223 have an information exposure vulnerability. When the user's smart phone connects to the malicious device for charging, an unauthenticated attacker may activate some specific function by sending some specially crafted messages. Due to insufficient input validation of the messages, successful exploit may cause information exposure.
- Product
- Berlin-L21HN; Prague-AL00A; Prague-AL00B; Prague-AL00C; Prague-L31; Prague-TL00A; Prague-TL10A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.