Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Dec 27, 2024There is an improper interface design vulnerability in Huawei product.CVE-2020-9236 · Other software · Huawei · reported by psirt@huawei.comHigh 8.8
There is an improper interface design vulnerability in Huawei product. A module interface of the impated product does not deal with some operations properly. Attackers can exploit this vulnerability to perform malicious operatation to compromise module service. (Vulnerability ID: HWPSIRT-2020-05010) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9236.
- Product
- FusionCompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2024There is a privilege escalation vulnerability in Huawei FusionCompute product.CVE-2020-9222 · Other software · Huawei · reported by psirt@huawei.comHigh 7
There is a privilege escalation vulnerability in Huawei FusionCompute product. Due to insufficient verification on specific files that need to be deserialized, local attackers can exploit this vulnerability to elevate permissions. (Vulnerability ID: HWPSIRT-2020-05241) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9222.
- Product
- FusionCompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file.CVE-2021-37102 · Other software · Huawei · reported by psirt@huawei.comHigh 8.8
There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands to the system. Affected product versions include: FusionCompute 6.0.0, 6.3.0, 6.3.1, 6.5.0, 6.5.1, 8.0.0.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10.CVE-2021-37036 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10. Due to the improperly storage of specific information in the log file, the attacker can obtain the information when a user logs in to the device. Successful exploit may cause the information leak.
- Product
- Ecns280 TD Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2021There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when processing the default certificate file.CVE-2021-37106 · Other software · Huawei · reported by psirt@huawei.comHigh 7.2
There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands to the system.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2021There is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0.CVE-2021-37105 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0. Due to the improper verification of file to be uploaded and does not strictly restrict the file access path, attackers may upload malicious files to the device, resulting in the service abnormal.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2021There is an insufficient input validation vulnerability in FusionCompute 8.0.0.CVE-2021-22358 · Other software · Huawei · reported by psirt@huawei.comMedium 4.3
There is an insufficient input validation vulnerability in FusionCompute 8.0.0. Due to the input validation is insufficient, an attacker can exploit this vulnerability to upload any files to the device. Successful exploit may cause the service abnormal.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2020FusionCompute versions 6.3.0, 6.3.1, 6.5.0, 6.5.1 and 8.0.0 have a privilege escalation vulnerability.CVE-2020-9114 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
FusionCompute versions 6.3.0, 6.3.1, 6.5.0, 6.5.1 and 8.0.0 have a privilege escalation vulnerability. Due to improper privilege management, an attacker with common privilege may access some specific files and get the administrator privilege in the affected products. Successful exploit will cause privilege escalation.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2020Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability.CVE-2020-9116 · Other software · Huawei · reported by psirt@huawei.comHigh 7.2
Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability. An authenticated, remote attacker can craft specific request to exploit this vulnerability. Due to insufficient verification, this could be exploited to cause the attackers to obtain higher privilege.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2020FusionCompute versions 8.0.0 have an insecure encryption algorithm vulnerability.CVE-2020-9128 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
FusionCompute versions 8.0.0 have an insecure encryption algorithm vulnerability. Attackers with high permissions can exploit this vulnerability to cause information leak.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2020FusionCompute 8.0.0 has an information leak vulnerability.CVE-2020-9246 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
FusionCompute 8.0.0 has an information leak vulnerability. A module does not launch strict access control and information protection. Attackers with low privilege can get some extra information. This can lead to information leak.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2020FusionCompute 8.0.0 have an insufficient authentication vulnerability.CVE-2020-9233 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
FusionCompute 8.0.0 have an insufficient authentication vulnerability. An attacker may exploit the vulnerability to delete some files and cause some services abnormal.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2020FusionCompute 8.0.0 have a command injection vulnerability.CVE-2020-9242 · Other software · Huawei · reported by psirt@huawei.comHigh 8.8
FusionCompute 8.0.0 have a command injection vulnerability. The software does not sufficiently validate certain parameters post from user, successful exploit could allow an authenticated attacker to launch a command injection attack.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2020FusionCompute 8.0.0 has an information disclosure vulnerability.CVE-2020-9229 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information, attackers may exploit this vulnerability to obtain certain information.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2020FusionCompute 8.0.0 has an information disclosure vulnerability.CVE-2020-9228 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information, attackers may exploit this vulnerability to obtain certain information.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2020FusionCompute 8.0.0 have local privilege escalation vulnerability.CVE-2020-9078 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
FusionCompute 8.0.0 have local privilege escalation vulnerability. A local, authenticated attacker could perform specific operations to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege and compromise the service.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2020Huawei FusionComput 8.0.0 have an improper authorization vulnerability.CVE-2020-9248 · Other software · Huawei · reported by psirt@huawei.comMedium 6.7
Huawei FusionComput 8.0.0 have an improper authorization vulnerability. A module does not verify some input correctly and authorizes files with incorrect access. Attackers can exploit this vulnerability to launch privilege escalation attack. This can compromise normal service.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017FusionCompute V100R005C00 and V100R005C10 have an improper authorization vulnerability due to improper permission settings for a certain file on the host machinCVE-2017-8158 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6.5
FusionCompute V100R005C00 and V100R005C10 have an improper authorization vulnerability due to improper permission settings for a certain file on the host machine. An authenticated attacker could create a large number of virtual machine (VM) processes to exhaust system resources. Successful exploit could make new VMs unavailable.
- Product
- FusionCompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2016Huawei FusionCompute before V100R005C10CP7002 stores cleartext AES keys in a file, which allows remote authenticated users to obtain sensitive information via uCVE-2016-6827 · Other software · Huawei · reported by MITREMedium 6.5
Huawei FusionCompute before V100R005C10CP7002 stores cleartext AES keys in a file, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuawei.comsecurityfocus.com
Jun 30, 2016Huawei FusionCompute before V100R005C10SPC700 allows remote authenticated users to cause a denial of service (resource consumption) via a large number of crafteCVE-2016-4057 · Other software · Huawei · reported by MITREMedium 6.5
Huawei FusionCompute before V100R005C10SPC700 allows remote authenticated users to cause a denial of service (resource consumption) via a large number of crafted packets.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuawei.comsecurityfocus.com
Apr 14, 2016Huawei FusionCompute with software before V100R005C10SPC700 allows remote authenticated users to obtain sensitive "role and permission" information via unspecifCVE-2015-8336 · Other software · Huawei · reported by MITREMedium 4.3
Huawei FusionCompute with software before V100R005C10SPC700 allows remote authenticated users to obtain sensitive "role and permission" information via unspecified vectors.
- Product
- Fusioncompute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww1.huawei.comwww1.huawei.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.