Sign-up

VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-202112-0344 CVE-2021-37074 plural  Huawei  Race Condition Vulnerability in Smartphone Products CVSS V2: 9.3
CVSS V3: 8.1
Severity: HIGH
There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to the user root privilege escalation. plural Huawei A race condition vulnerability exists in smartphone products.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202112-0391 CVE-2021-37061 Huawei  Resource Exhaustion Vulnerability in Smartphones CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
There is a Uncontrolled Resource Consumption vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Screen projection application denial of service. Huawei Smartphones have a resource exhaustion vulnerability.Service operation interruption (DoS) It may be in a state
VAR-202112-0253 CVE-2021-37060 Huawei  Input validation vulnerability in smartphones CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to SAMGR Heap Address Leakage. Huawei Smartphones contain a vulnerability related to input validation.Information may be obtained
VAR-202112-0256 CVE-2021-37057 Huawei  Vulnerability related to array index validation in smartphones CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
There is a Improper Validation of Array Index vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to restart the phone. Huawei Smartphones contain an array index validation vulnerability.Service operation interruption (DoS) It may be in a state
VAR-202112-0233 CVE-2021-37083 Huawei  in smartphone  NULL  Pointer dereference vulnerability CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
There is a NULL Pointer Dereference vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Denial of Service Attacks. Huawei HarmonyOS is an operating system of the Chinese company Huawei. Provide a microkernel-based full-scenario distributed operating system
VAR-202112-0251 CVE-2021-37063 Huawei  Vulnerabilities in smartphones CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
There is a Cryptographic Issues vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to read and delete images of Harmony devices. Huawei Smartphones have unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202112-0254 CVE-2021-37059 Huawei  Vulnerabilities in smartphones CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
There is a Weaknesses Introduced During Design. Huawei Smartphones have unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202112-0333 CVE-2021-37043 plural  Huawei  Authentication Vulnerability in Smartphone Products CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to malicious application processes occupy system resources. plural Huawei Smartphone products contain an authentication vulnerability.Service operation interruption (DoS) It may be in a state
VAR-202112-0247 CVE-2021-37067 Huawei  Information disclosure vulnerability in smartphones CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
There is a Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Confidentiality impacted. Huawei Smartphones are vulnerable to information disclosure.Information may be obtained
VAR-202112-0248 CVE-2021-37066 Huawei  Out-of-Bounds Read Vulnerability in Smartphones CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to process crash. Huawei Smartphones contain an out-of-bounds read vulnerability.Service operation interruption (DoS) It may be in a state
VAR-202112-0243 CVE-2021-37072 Huawei  Double free vulnerability in smartphones CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
There is a Incorrect Calculation of Buffer Size vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to memory crash. Huawei Smartphones have a double free vulnerability.Service operation interruption (DoS) It may be in a state
VAR-202109-1256 CVE-2021-38408 Advantech WebAccess BwFLApp Stack-based Buffer Overflow Remote Code Execution Vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied data may allow remote code execution. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of IOCTL 0x2711, which can be used to invoke BwFLApp.exe. An attacker can leverage this vulnerability to execute code in the context of Administrator. Advantech WebAccess is a set of browser-based HMI/SCADA software from Advantech. A stack buffer overflow vulnerability exists in Advantech WebAccess 9.02 and earlier. The software supports dynamic graphic display and real-time data control, and provides functions of remote control and management of automation equipment
VAR-202109-0207 CVE-2021-22790 plural  Schneider Electric  Product out-of-bounds read vulnerability CVSS V2: 4.0
CVSS V3: 6.5
Severity: MEDIUM
A CWE-125: Out-of-bounds Read vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions). plural Schneider Electric The product contains an out-of-bounds read vulnerability.Service operation interruption (DoS) It may be in a state
VAR-202109-0206 CVE-2021-22789 plural  Schneider Electric  Buffer error vulnerability in the product CVSS V2: 4.0
CVSS V3: 6.5
Severity: MEDIUM
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions). plural Schneider Electric The product contains a buffer error vulnerability.Service operation interruption (DoS) It may be in a state
VAR-202109-0204 CVE-2021-22792 plural  Schneider Electric  In the product  NULL  Pointer dereference vulnerability CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
A CWE-476: NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions). plural Schneider Electric The product has NULL There is a vulnerability in pointer dereference.Service operation interruption (DoS) It may be in a state
VAR-202109-0202 CVE-2021-22704 Multiple Schneider Electric Product Path Traversal Vulnerability CVSS V2: 6.4
CVSS V3: 9.1
Severity: CRITICAL
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP
VAR-202109-0203 CVE-2021-22791 plural  Schneider Electric  Out-of-bounds write vulnerabilities in the product CVSS V2: 4.0
CVSS V3: 6.5
Severity: MEDIUM
A CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions). plural Schneider Electric The product contains a vulnerability related to out-of-bounds writes.Service operation interruption (DoS) It may be in a state
VAR-202109-1854 CVE-2021-37733 Aruba Operating System Path traversal vulnerability CVSS V2: 4.0
CVSS V3: 4.9
Severity: MEDIUM
A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.11, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability
VAR-202109-1856 CVE-2021-37729 Aruba Operating System Path traversal vulnerability CVSS V2: 5.5
CVSS V3: 6.5
Severity: MEDIUM
A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.3, 8.6.0.9, 8.5.0.12, 8.3.0.16, 6.5.4.19, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability
VAR-202109-1855 CVE-2021-37731 Aruba Operating System Path traversal vulnerability CVSS V2: 7.2
CVSS V3: 6.2
Severity: MEDIUM
A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability