CVE Vulnerability Catalog

FusionSphere OpenStack versions V100R006C00 and V100R006C10RC2 have two command injection vulnerabilities due to insufficient input validation on one port. An attacker can exploit these vulnerabilities to gain root privileges by sending messages with malicious commands.

FusionSphere OpenStack versions V100R006C00 and V100R006C10RC2 have two command injection vulnerabilities due to insufficient input validation on one port. An attacker can exploit these vulnerabilities to gain root privileges by sending messages with malicious commands.

The camerafs driver in Mate 9 Versions earlier than MHA-AL00BC00B173 has a buffer overflow vulnerability. An attacker can trick a user into installing a malicious application, leading to a system crash or privilege escalation.

The Files APP 7.1.1.309 and earlier versions in some Huawei mobile phones has a brute-force password cracking vulnerability due to the improper design of the Safe key database. An unauthorized attacker could access sensitive database information and may crack users' Safe passwords, leading to information leak.

GaussDB in FusionSphere OpenStack versions V100R005C10SPC705 and earlier has a buffer overflow vulnerability. An authenticated attacker on the LAN can exploit this vulnerability to execute arbitrary code or cause a denial of service (DoS) condition in the affected system.

Mate 9 smartphones with software MHA-AL00AC00B125 have a privilege escalation vulnerability in the Push module. An attacker can trick a user into saving rich media in a message, which could be exploited to allow the attacker to delete messages or impersonate the user to send messages.

Mate 9 smartphones with software MHA-AL00AC00B125 have a directory traversal vulnerability in the Push module. The system does not verify the file name during decompression, allowing traversal of system directories.

Smarthome 1.0.2.364 and earlier versions, along with other listed applications, have an information exposure vulnerability. Encryption keys are stored in the system, allowing an attacker to obtain them through reverse engineering.

The AC6005 and AC6605 devices with software V200R006C10 have a DoS vulnerability. An attacker can send malformed packets to the device, leading to memory leaks and DoS attacks.

The Huawei Themes APP in versions earlier than PLK-UL00C17B385, CRR-L09C432B380, and LYO-L21C577B128 has a privilege elevation vulnerability. An attacker could exploit this vulnerability to upload theme packs containing malicious files, potentially leading to the execution of arbitrary code.

The ddr_devfreq driver in versions earlier than GRA-UL00C00B197 has a buffer overflow vulnerability. An attacker with root privileges on the Android system can trick a user into installing a malicious application, leading to system crashes or privilege escalation.

The goldeneye driver in NMO-L31C432B120 and earlier versions, NEM-L21C432B100 and earlier versions, NEM-L51C432B120 and earlier versions, KNT-AL10C746B160 and earlier versions, VNS-L21C185B142 and earlier versions, CAM-L21C10B130 and earlier versions, and CAM-L21C185B141 and earlier versions has a buffer overflow vulnerability. An attacker with root privileges on the Android system can trick a user into installing a malicious application, leading to system crashes or privilege escalation.

The emerg_data driver in versions CAM-L21C10B130 and earlier, CAM-L21C185B141 and earlier has a buffer overflow vulnerability. An attacker with root privileges on the Android system can trick a user into installing a malicious application, which can lead to system crashes or privilege escalation.

CVE-2017-2693 vulnerability affects multiple device versions that may be susceptible to unauthorized access or data manipulation attacks.

The Keyguard application in the listed versions of devices is vulnerable to an attack that may lead to unauthorized access to the system.

Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.

CVE-2017-13071 allows a remote attacker to execute arbitrary commands on QNAP Video Station versions 5.1.3 (for QTS 4.3.3), 5.2.0 (for QTS 4.3.4), and earlier.

Client-side enforcement using JavaScript on the Cohu 3960HD camera allows an attacker to manipulate options sent to the camera, potentially leading to malfunction or code execution.

CVE-2017-8863 allows information disclosure of .esp source code on the Cohu 3960, enabling an attacker to view sensitive information such as application logic using a simple web browser.

The webupgrade function on the Cohu 3960HD does not verify the firmware upgrade files, allowing an attacker to upload a specially crafted postinstall.sh file that will be executed with 'root' privileges.