Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Aug 10, 2020FusionSphere OpenStack 8.0.0 have a protection mechanism failure vulnerability.CVE-2020-9079 · Other software · Huawei · reported by psirt@huawei.comHigh 8.8
FusionSphere OpenStack 8.0.0 have a protection mechanism failure vulnerability. The product incorrectly uses a protection mechanism. An attacker has to find a way to exploit the vulnerability to conduct directed attacks against the affected product.
- Product
- Fusionsphere Openstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2020FusionSphere OpenStack 6.5.1 have an improper permissions management vulnerability.CVE-2020-9225 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
FusionSphere OpenStack 6.5.1 have an improper permissions management vulnerability. The software does not correctly perform a privilege assignment when an actor attempts to perform an action. Successful exploit could allow certain user to do certain operations beyond its privilege.
- Product
- Fusionsphere Openstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2018There is an information leakage vulnerability on several Huawei products.CVE-2018-7977 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.5
There is an information leakage vulnerability on several Huawei products. Due to insufficient communication protection for specific services, a remote, unauthorized attacker can exploit this vulnerability to connect to specific services to obtain additional information. Successful exploitation of this vulnerability can lead to information leakage.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2018Huawei FusionSphere OpenStack V100R006C00SPC102(NFV) has a privilege escalation vulnerability.CVE-2017-8187 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.2
Huawei FusionSphere OpenStack V100R006C00SPC102(NFV) has a privilege escalation vulnerability. Due to improper privilege restrictions, an attacker with high privilege may obtain the other users' certificates. Successful exploit may cause privilege escalation.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2017Huawei FusionSphere OpenStack V100R006C000SPC102 (NFV) has an information leak vulnerability due to the use of a low version transmission protocol by default.CVE-2017-15321 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comLow 3.7
Huawei FusionSphere OpenStack V100R006C000SPC102 (NFV) has an information leak vulnerability due to the use of a low version transmission protocol by default. An attacker could intercept packets transferred by a target device. Successful exploit could cause an information leak.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017The FusionSphere OpenStack V100R006C00SPC102(NFV) has an improper authentication vulnerability.CVE-2017-8195 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
The FusionSphere OpenStack V100R006C00SPC102(NFV) has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017The FusionSphere OpenStack V100R006C00SPC102(NFV) has an improper authentication vulnerability.CVE-2017-8194 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
The FusionSphere OpenStack V100R006C00SPC102(NFV) has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuawei.comsecurityfocus.com
Nov 22, 2017The FusionSphere OpenStack V100R006C00SPC102(NFV) has a command injection vulnerability.CVE-2017-8193 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8
The FusionSphere OpenStack V100R006C00SPC102(NFV) has a command injection vulnerability. Due to the insufficient input validation on one port, an authenticated, local attacker may exploit the vulnerability to gain root privileges by sending message with malicious commands.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017FusionSphere OpenStack V100R006C00 has an improper authorization vulnerability.CVE-2017-8192 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
FusionSphere OpenStack V100R006C00 has an improper authorization vulnerability. Due to improper authorization, an attacker with low privilege may exploit this vulnerability to obtain the operation authority of some specific directory, causing privilege escalation.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017FusionSphere OpenStack V100R006C00SPC102(NFV)has a week cryptographic algorithm vulnerability.CVE-2017-8191 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.9
FusionSphere OpenStack V100R006C00SPC102(NFV)has a week cryptographic algorithm vulnerability. Attackers may exploit the vulnerability to crack the cipher text and cause information leak on the transmission links.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuawei.comsecurityfocus.com
Nov 22, 2017FusionSphere OpenStack V100R006C00SPC102(NFV)has an improper verification of cryptographic signature vulnerability.CVE-2017-8190 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6.7
FusionSphere OpenStack V100R006C00SPC102(NFV)has an improper verification of cryptographic signature vulnerability. The software does not verify the cryptographic signature. An attacker with high privilege may exploit this vulnerability to inject malicious software.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017FusionSphere OpenStack V100R006C00SPC102(NFV)has a path traversal vulnerability.CVE-2017-8189 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6
FusionSphere OpenStack V100R006C00SPC102(NFV)has a path traversal vulnerability. Due to insufficient path validation, an attacker with high privilege may exploit this vulnerability to cover some files, causing services abnormal.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017FusionSphere OpenStack V100R006C00SPC102(NFV)has a command injection vulnerability.CVE-2017-8188 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.2
FusionSphere OpenStack V100R006C00SPC102(NFV)has a command injection vulnerability. Due to lack of validation, an attacker with high privilege may inject malicious code into some module of the affected products, causing code execution.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017FusionSphere OpenStack with software V100R006C00SPC102(NFV) and V100R006C10 have an information leak vulnerability.CVE-2017-8168 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 4.3
FusionSphere OpenStack with software V100R006C00SPC102(NFV) and V100R006C10 have an information leak vulnerability. Due to an incorrect configuration item, the information transmitted by a transmission channel is not encrypted. An attacker accessing the internal network may obtain sensitive information transmitted.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP CVE-2017-8135 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuawei.comsecurityfocus.com
Nov 22, 2017The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP CVE-2017-8134 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP CVE-2017-8132 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP CVE-2017-8131 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017FusionSphere OpenStack V100R006C00 has an information exposure vulnerability.CVE-2017-2720 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.3
FusionSphere OpenStack V100R006C00 has an information exposure vulnerability. The software uses hard-coded cryptographic key to encrypt messages between certain components, which significantly increases the possibility that encrypted data may be recovered and results in information exposure.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input validation on one poCVE-2017-2719 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input validation on one port. An attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input validation on one poCVE-2017-2718 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input validation on one port. An attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017The GaussDB in FusionSphere OpenStack V100R005C10SPC705 and earlier versions has a buffer overflow vulnerability.CVE-2017-2714 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8
The GaussDB in FusionSphere OpenStack V100R005C10SPC705 and earlier versions has a buffer overflow vulnerability. An authenticated attacker on the LAN can exploit this vulnerability to execute arbitrary code or cause a denial of service (DoS) condition in the affected system.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.