Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Jun 4, 2019There is an information disclosure vulnerability on Mate 9 Pro Huawei smartphones versions earlier than LON-AL00B9.0.1.150 (C00E61R1P8T8).CVE-2019-5217 · Other software · Huawei · reported by psirt@huawei.comMedium 4.6
There is an information disclosure vulnerability on Mate 9 Pro Huawei smartphones versions earlier than LON-AL00B9.0.1.150 (C00E61R1P8T8). An attacker could view the photos after a series of operations without unlocking the screen lock. Successful exploit could cause an information disclosure condition.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2019Mate 9 Pro Huawei smartphones earlier than LON-L29C 8.0.0.361(C636) versions have an information leak vulnerability due to the lack of input validation.CVE-2019-5244 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Mate 9 Pro Huawei smartphones earlier than LON-L29C 8.0.0.361(C636) versions have an information leak vulnerability due to the lack of input validation. An attacker tricks the user who has root privilege to install an application on the smart phone, and the application can read some process information, which may cause sensitive information leak.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2018The hardware security module of Mate 9 and Mate 9 Pro Huawei smart phones with the versions earlier before MHA-AL00BC00B156, versions earlier before MHA-CL00BC0CVE-2017-17176 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6.7
The hardware security module of Mate 9 and Mate 9 Pro Huawei smart phones with the versions earlier before MHA-AL00BC00B156, versions earlier before MHA-CL00BC00B156, versions earlier before MHA-DL00BC00B156, versions earlier before MHA-TL00BC00B156, versions earlier before LON-AL00BC00B156, versions earlier before LON-CL00BC00B156, versions earlier before LON-DL00BC00B156, versions earlier before LON-TL00BC00B156 has a arbitrary memory read/write vulnerability due to the input parameters validation. An attacker with the root privilege of the Android system could exploit this vulnerability to read and write memory data anywhere or execute arbitrary code in the TrustZone.
- Product
- Mate 9, Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2018Mdapt Driver of Huawei MediaPad M3 BTV-W09C128B353CUSTC128D001; Mate 9 Pro versions earlier than 8.0.0.356(C00); P10 Plus versions earlier than 8.0.0.357(C00) hCVE-2018-7992 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.5
Mdapt Driver of Huawei MediaPad M3 BTV-W09C128B353CUSTC128D001; Mate 9 Pro versions earlier than 8.0.0.356(C00); P10 Plus versions earlier than 8.0.0.357(C00) has a buffer overflow vulnerability. The driver does not sufficiently validate the input, an attacker could trick the user to install a malicious application which would send crafted parameters to the driver. Successful exploit could cause a denial of service condition.
- Product
- MediaPad M3; Mate 9 Pro; P10 Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2018Short Message Service (SMS) module of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.354(C00) has a Denial of Service (DoS) vulnerabiliCVE-2017-17175 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6.5
Short Message Service (SMS) module of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.354(C00) has a Denial of Service (DoS) vulnerability. An unauthenticated attacker may set up a pseudo base station, and send special malware text message to the phone, causing the mobile phone to fail to make calls and send and receive text messages.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2018Due to insufficient parameters verification GPU driver of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.356(C00) has an arbitrary memoCVE-2017-17173 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
Due to insufficient parameters verification GPU driver of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.356(C00) has an arbitrary memory free vulnerability. An attacker can tricks a user into installing a malicious application on the smart phone, and send given parameter to driver to release special kernel memory resource. Successful exploit may result in phone crash or arbitrary code execution.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2018The Near Field Communication (NFC) module in Mate 9 Huawei mobile phones with the versions before MHA-L29B 8.0.0.366(C567) has an information leak vulnerabilityCVE-2018-7930 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.7
The Near Field Communication (NFC) module in Mate 9 Huawei mobile phones with the versions before MHA-L29B 8.0.0.366(C567) has an information leak vulnerability due to insufficient validation on data transfer requests. When an affected mobile phone sends files to an attacker's mobile phone using the NFC function, the attacker can obtain arbitrary files from the mobile phone, causing information leaks.
- Product
- Mate 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2018Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerability.CVE-2017-17320 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerability. The system does not manage the memory properly, that frees on the same memory address twice. An attacker tricks the user who has root privilege to install a crafted application, successful exploit could result in malicious code execution.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2018Huawei Mate 9 Pro Smartphones with software of LON-AL00BC00B139D; LON-AL00BC00B229 have an activation lock bypass vulnerability.CVE-2017-17326 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 4.6
Huawei Mate 9 Pro Smartphones with software of LON-AL00BC00B139D; LON-AL00BC00B229 have an activation lock bypass vulnerability. The smartphone is supposed to be activated by the former account after reset if find my phone function is on. The software does not have a sufficient protection of activation lock. Successful exploit could allow an attacker to bypass the activation lock and activate the smartphone by a new account after a series of operation.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2018Huawei Mate 9 Pro smartphones with software LON-AL00BC00B139D; LON-AL00BC00B229 have an integer overflow vulnerability.CVE-2017-17324 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
Huawei Mate 9 Pro smartphones with software LON-AL00BC00B139D; LON-AL00BC00B229 have an integer overflow vulnerability. The camera driver does not validate the external input parameters and causes an integer overflow, which in the after processing results in a buffer overflow. An attacker tricks the user to install a crafted application, successful exploit could cause malicious code execution.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2018The soundtrigger module in Huawei Mate 9 Pro smart phones with software of the versions before LON-AL00B 8.0.0.343(C00) has an authentication bypass vulnerabiliCVE-2017-17279 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.5
The soundtrigger module in Huawei Mate 9 Pro smart phones with software of the versions before LON-AL00B 8.0.0.343(C00) has an authentication bypass vulnerability due to the improper design of the module. An attacker tricks a user into installing a malicious application, and the application can exploit the vulnerability and make attacker bypass the authentication, the attacker can control the phone to sent short messages and make call within audio range to the phone.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuawei.comsecurityfocus.com
Mar 9, 2018The Near Field Communication (NFC) module in Huawei Mate 9 Pro mobile phones with the versions before LON-AL00B 8.0.0.340a(C00) has a buffer overflow vulnerabilCVE-2017-17225 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
The Near Field Communication (NFC) module in Huawei Mate 9 Pro mobile phones with the versions before LON-AL00B 8.0.0.340a(C00) has a buffer overflow vulnerability due to the lack of input validation. An attacker may use an NFC card reader or another device to inject malicious data into a target mobile phone. Successful exploit could lead to system restart or arbitrary code execution.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2018Mate 9 Huawei smart phones with versions earlier than MHA-AL00BC00B233 have a sensitive information leak vulnerability.CVE-2017-8165 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.5
Mate 9 Huawei smart phones with versions earlier than MHA-AL00BC00B233 have a sensitive information leak vulnerability. An attacker can trick a user to install a malicious application to exploit this vulnerability. Successful exploitation may cause sensitive information leak.
- Product
- Mate 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2018Huawei Mate 9 and Mate 9 pro smart phones with software the versions before MHA-AL00B 8.0.0.334(C00); the versions before LON-AL00B 8.0.0.334(C00) have a informCVE-2017-17139 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.5
Huawei Mate 9 and Mate 9 pro smart phones with software the versions before MHA-AL00B 8.0.0.334(C00); the versions before LON-AL00B 8.0.0.334(C00) have a information leak vulnerability in the date service proxy implementation. An attacker may trick a user into installing a malicious application and application can exploit the vulnerability to get kernel date which may cause sensitive information leak.
- Product
- Mate 9; Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2018Huawei Mate 9 Pro mobile phones with software of versions earlier than LON-AL00BC00B235 have a use after free (UAF) vulnerability.CVE-2017-15347 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.5
Huawei Mate 9 Pro mobile phones with software of versions earlier than LON-AL00BC00B235 have a use after free (UAF) vulnerability. An attacker tricks a user into installing a malicious application, and the application can riggers access memory after free it. A local attacker may exploit this vulnerability to cause the mobile phone to crash.
- Product
- Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2017The GPU driver of Mate 9 Huawei smart phones with software before MHA-AL00B 8.0.0.334(C00) and Mate 9 Pro Huawei smart phones with software before LON-AL00B 8.0CVE-2017-15316 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
The GPU driver of Mate 9 Huawei smart phones with software before MHA-AL00B 8.0.0.334(C00) and Mate 9 Pro Huawei smart phones with software before LON-AL00B 8.0.0.334(C00) has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can call special API, which triggers double free and causes a system crash or arbitrary code execution.
- Product
- Mate 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2017The baseband modules of Mate 10, Mate 10 Pro, Mate 9, Mate 9 Pro Huawei smart phones with software before ALP-AL00 8.0.0.120(SP2C00), before BLA-AL00 8.0.0.120(CVE-2017-15311 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
The baseband modules of Mate 10, Mate 10 Pro, Mate 9, Mate 9 Pro Huawei smart phones with software before ALP-AL00 8.0.0.120(SP2C00), before BLA-AL00 8.0.0.120(SP2C00), before MHA-AL00B 8.0.0.334(C00), and before LON-AL00B 8.0.0.334(C00) have a stack overflow vulnerability due to the lack of parameter validation. An attacker could send malicious packets to the smart phones within radio range by special wireless device, which leads stack overflow when the baseband module handles these packets. The attacker could exploit this vulnerability to perform a denial of service attack or remote code execution in baseband module.
- Product
- Mate 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017The Trusted Execution Environment (TEE) module driver of Mate 9 and Mate 9 Pro smart phones with software versions earlier than MHA-AL00BC00B221 and versions eaCVE-2017-8142 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
The Trusted Execution Environment (TEE) module driver of Mate 9 and Mate 9 Pro smart phones with software versions earlier than MHA-AL00BC00B221 and versions earlier than LON-AL00BC00B221 has a use after free (UAF) vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to create and free specific memory, which could triggers access memory after free it and causes a system crash or arbitrary code execution.
- Product
- Mate 9, Mate 9 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017The camerafs driver in Mate 9 Versions earlier than MHA-AL00BC00B173 has buffer overflow vulnerability.CVE-2017-2716 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
The camerafs driver in Mate 9 Versions earlier than MHA-AL00BC00B173 has buffer overflow vulnerability. An attacker tricks a user into installing a malicious application which has the system privilege of the Android system and sends a specific parameter to the driver of the smart phone, causing a system crash or privilege escalation.
- Product
- Mate 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017Mate 9 smartphones with software MHA-AL00AC00B125 have a privilege escalation vulnerability in Push module.CVE-2017-2707 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.1
Mate 9 smartphones with software MHA-AL00AC00B125 have a privilege escalation vulnerability in Push module. An attacker tricks a user to save a rich media into message on the smart phone, which could be exploited to cause the attacker to delete message or fake user to send message.
- Product
- Mate 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017Mate 9 smartphones with software MHA-AL00AC00B125 have a directory traversal vulnerability in Push module.CVE-2017-2706 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.1
Mate 9 smartphones with software MHA-AL00AC00B125 have a directory traversal vulnerability in Push module. Since the system does not verify the file name during decompression, system directories are traversed. It could be exploited to cause the attacker to replace files and impact the service.
- Product
- Mate 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017Phone Finder in versions earlier before MHA-AL00BC00B156,Versions earlier before MHA-CL00BC00B156,Versions earlier before MHA-DL00BC00B156,Versions earlier befoCVE-2017-2703 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6.8
Phone Finder in versions earlier before MHA-AL00BC00B156,Versions earlier before MHA-CL00BC00B156,Versions earlier before MHA-DL00BC00B156,Versions earlier before MHA-TL00BC00B156,Versions earlier before EVA-AL10C00B373,Versions earlier before EVA-CL10C00B373,Versions earlier before EVA-DL10C00B373,Versions earlier before EVA-TL10C00B373 can be bypass. An attacker can bypass the Phone Finder by special steps and enter the System Setting.
- Product
- Mate 9, P9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuawei.comsecurityfocus.com
Nov 22, 2017Phone Finder in versions earlier before MHA-AL00C00B170 can be bypass.CVE-2017-2702 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 6.8
Phone Finder in versions earlier before MHA-AL00C00B170 can be bypass. An attacker can bypass the Phone Finder by special steps and obtain the owner of the phone.
- Product
- Mate 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017Mate 9 with software MHA-AL00AC00B125 has a denial of service (DoS) vulnerability.CVE-2017-2701 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comLow 3.3
Mate 9 with software MHA-AL00AC00B125 has a denial of service (DoS) vulnerability. An attacker tricks a user into installing a malicious application. Since the system does not verify the broadcasting message from the application, it could be exploited to cause some functions of system unavailable.
- Product
- Mate 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.