VARIoT IoT vulnerabilities database

Improper input validation check logic vulnerability in SECRIL prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. Google of Android There is an input validation vulnerability in.Service operation interruption (DoS) It may be in a state. Samsung mobile is a mobile phone from Samsung (Samsung) in South Korea. An attacker could exploit this vulnerability to trigger a crash

An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and 6.0.x; FortiSandbox 4.0.x, 3.2.x and 3.1.x may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the listed products and some external peers

Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message information from device. Google of Android Exists in a vulnerability in handling exceptional conditions.Information may be obtained. Samsung mobile is a mobile phone from Samsung (Samsung) in South Korea. An information disclosure vulnerability exists in Samsung mobile DisplayToast

PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent. Samsung's Android for SmartThings There is a vulnerability in improper default permissions.Information may be obtained. SmartThings is a powerful Samsung smart home mobile app. There is a PendingIntent hijacking vulnerability in Samsung SmartThings versions prior to 1.7.85.25

Memory corruption in bluetooth host due to integer overflow while processing BT HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionError function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of the connected Bluetooth device. Google of Android Exists in a vulnerability in handling exceptional conditions.Information may be obtained. Samsung mobile Bluetooth is a Bluetooth device on Samsung mobile phones. There is an information disclosure vulnerability in Samsung mobile Bluetooth

Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API. Samsung's Android for SmartThings Exists in a vulnerability related to the lack of authentication.Information may be obtained

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAuthenticator OWA Agent for Microsoft version 2.2 and 2.1 may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests. FortiAuthenticator OWA Agent for Microsoft Exists in a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. Fortinet FortiAuthenticator is a centralized user identity management solution from Fortinet. Fortinet FortiAuthenticator has a cross-site scripting vulnerability caused by insufficient sanitization of user-supplied data. A remote attacker could exploit this vulnerability to trick a victim into following a specially crafted link and execute arbitrary HTML and script code in a vulnerable browser

An execution with unnecessary privileges vulnerability [CWE-250] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.10 may allow a local attacker to perform an arbitrary file write on the system. FortiClientWindows Exists in a permission management vulnerability.Information is tampered with and service operation is interrupted (DoS) It may be in a state

A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device. FortiDDoS API Contains a vulnerability in the use of hard-coded credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Fortinet FortiDDoS is the only inspectable DDoS mitigation platform from Fortinet USA. Fortinet FortiDDoS has a security flaw that stems from the use of hard-coded encryption keys

Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information. Samsung mobile is a mobile phone from Samsung (Samsung) in South Korea. An information disclosure vulnerability exists in Samsung mobile ScanPool, which arises from a misconfiguration of the network system or product during operation

Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCompleted function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of the connected Bluetooth device. Google of Android Exists in a vulnerability in handling exceptional conditions.Information may be obtained. Samsung mobile Bluetooth is a Bluetooth device on Samsung mobile phones. There is an information disclosure vulnerability in Samsung mobile Bluetooth. address

Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera functions via deeplink. Google of Android Exists in unspecified vulnerabilities.Information may be tampered with. Samsung mobile is a mobile phone of South Korea's Samsung (Samsung) company. Samsung mobile AR Emoji has a design flaw

Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. Google of Android There is an input validation vulnerability in.Service operation interruption (DoS) It may be in a state. Samsung mobile is a mobile phone of South Korea's Samsung (Samsung) company

Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity

Potential out of Bounds read in FIPS event processing due to improper validation of the length from the firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

There is an improper input verification vulnerability in Huawei printer product. Successful exploitation of this vulnerability may cause service abnormal. (Vulnerability ID: HWPSIRT-2022-87185) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-32204. Huawei of cv81-wdm There are unspecified vulnerabilities in the firmware.Service operation interruption (DoS) It may be in a state. Huawei CV81-WDM FW is a laser multifunction printer produced by Huawei, China. There is a security vulnerability in Huawei CV81-WDM FW 01.70.49.29.46

There is a command injection vulnerability in Huawei terminal printer product. Successful exploitation could result in the highest privileges of the printer. (Vulnerability ID: HWPSIRT-2022-51773) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-32203. Huawei of cv81-wdm Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Huawei CV81-WDM FW is a laser multifunction printer produced by Huawei, China

MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected. Users should upgrade to RELEASE.2022-06-02T02-11-04Z to receive a patch. One possible workaround is to use a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from such malicious clients. Minio Inc. of Minio Exists in a resource exhaustion vulnerability.Service operation interruption (DoS) It may be in a state

An out-of-bounds write can occur due to an incorrect input check in the camera driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables