Overview 80 matches · 1 in Waratek scope · 1 protected · 2 exploited · 2 CISA KEV · 8 public PoC · 2 EPSS ≥ 0.5
80matches
1in Waratek scope1.2%
1protected1.2%
2exploited2.5%
2CISA KEV2.5%
8public PoC10.0%
2EPSS ≥ 0.52.5%
Protected by Waratek
1
1.2%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
79
98.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
1.2%
partly blocked
0
0.0%
not blocked
79
98.8%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
2
2.5%
Working exploit published
6
7.5%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
72
90.0%
split by
peak 15 / year
20021
Not applicable1
Medium1
not blocked1
Working exploit published1
20030
20040
20050
20060
20070
20082
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
20090
20100
20111
Not applicable1
High1
not blocked1
No public exploit1
20120
20136
Not applicable6
High2
Medium4
not blocked6
No public exploit6
20147
Not applicable7
High2
Medium5
not blocked7
Working exploit published2
No public exploit5
20152
Not applicable2
Medium2
not blocked2
No public exploit2
20165
Not applicable5
Medium5
not blocked5
No public exploit5
201715
Not applicable15
Critical2
High6
Medium3
Low4
not blocked15
Working exploit published2
No public exploit13
20186
Not applicable6
High1
Medium5
not blocked6
No public exploit6
20193
Not applicable3
High2
Medium1
not blocked3
No public exploit3
20205
Protected by Waratek1
Not applicable4
Critical2
Medium3
blocked by ARMR today1
not blocked4
Exploited2
No public exploit3
20219
Not applicable9
Critical2
High4
Medium3
not blocked9
No public exploit9
20221
Not applicable1
High1
not blocked1
No public exploit1
20235
Not applicable5
High2
Medium3
not blocked5
No public exploit5
20243
Not applicable3
Critical1
Medium2
not blocked3
No public exploit3
20257
Not applicable7
Critical2
High4
Medium1
not blocked7
No public exploit7
20262
Not applicable2
High1
Medium1
not blocked2
No public exploit2
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-18085 | Medium | 2026-07-28 | Not applicable | No public exploit | An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service. |
| CVE-2026-18084 | High | 2026-07-28 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting (XSS). This issue affects UEM: 12.23.0 QF8 or earlier. |
| CVE-2025-12766 | Medium | 2025-11-19 | Not applicable | No public exploit | An Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of BlackBerry® AtHoc® (OnPrem) version 7.21 could allow an attacker to potentially gain unauthorized knowledge about other organizations hosted on the same Interactive Warning System (IWS). |
| CVE-2025-2474 | Critical | 2025-06-10 | Not applicable | No public exploit | Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition or execute code in the context of the process using the image codec. |
| CVE-2024-48858 | High | 2025-01-14 | Not applicable | No public exploit | Improper input validation in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition in the context of the process using the image codec. |
| CVE-2024-48857 | High | 2025-01-14 | Not applicable | No public exploit | NULL pointer dereference in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition in the context of the process using the image codec. |
| CVE-2024-48856 | Critical | 2025-01-14 | Not applicable | No public exploit | Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition or execute code in the context of the process using the image codec. |
| CVE-2024-48855 | High | 2025-01-14 | Not applicable | No public exploit | Out-of-bounds read in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the context of the process using the image codec. |
| CVE-2024-48854 | High | 2025-01-14 | Not applicable | No public exploit | Off-by-one error in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the context of the process using the image codec. |
| CVE-2024-51723 | Medium | 2024-11-25 | Not applicable | No public exploit | A Stored Cross-Site Scripting (XSS) vulnerability in the Management Console of BlackBerry AtHoc version 7.15 could allow an attacker to potentially execute actions in the context of the victim's session. |
| CVE-2024-35215 | Medium | 2024-10-08 | Not applicable | No public exploit | NULL pointer dereference in IP socket options processing of the Networking Stack in QNX Software Development Platform (SDP) version(s) 7.1 and 7.0 could allow an attacker with local access to cause a denial-of-service condition in the context of the Networking Stack process. |
| CVE-2024-35213 | Critical | 2024-06-11 | Not applicable | No public exploit | An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause a denial-of-service condition or execute code in the context of the image processing process. |
| CVE-2023-32701 | High | 2023-11-14 | Not applicable | No public exploit | Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause Information Disclosure or a Denial-of-Service condition. |
| CVE-2023-21523 | Medium | 2023-09-12 | Not applicable | No public exploit | A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the context of the affected user account. |
| CVE-2023-21522 | Medium | 2023-09-12 | Not applicable | No public exploit | A Reflected Cross-site Scripting (XSS) vulnerability in the Management Console (Reports) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially control a script that is executed in the victim's browser then they can execute script commands in the context of the affected user account. |
| CVE-2023-21521 | High | 2023-09-12 | Not applicable | No public exploit | An SQL Injection vulnerability in the Management Console (Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database, recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. |
| CVE-2023-21520 | Medium | 2023-09-12 | Not applicable | No public exploit | A PII Enumeration via Credential Recovery in the Self Service (Credential Recovery) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially associate a list of contact details with an AtHoc IWS organization. |
| CVE-2021-32025 | High | 2022-03-10 | Not applicable | No public exploit | An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Platform version(s) 6.4.0 to 7.0, QNX Momentics all 6.3.x versions, QNX OS for Safety versions 1.0.0 to 1.0.2, QNX OS for Safety versions 2.0.0 to 2.0.1, QNX for Medical versions 1.0.0 to 1.1.1, and QNX OS for Medical version 2.0.0 could allow an attacker to potentially access data, modify behavior, or permanently crash the system. |
| CVE-2021-32024 | Critical | 2021-12-13 | Not applicable | No public exploit | A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an attacker to potentially execute code in the context of the affected process. |
| CVE-2021-32023 | High | 2021-11-10 | Not applicable | No public exploit | An elevation of privilege vulnerability in the message broker of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allow an attacker to potentially execute code in the context of a BlackBerry Cylance service that has admin rights on the system. |
| CVE-2021-32022 | Medium | 2021-11-10 | Not applicable | No public exploit | A low privileged delete vulnerability using CEF RPC server of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allow an attacker to potentially execute code in the context of a BlackBerry Cylance service that has admin rights on the system and gaining the ability to delete data from the local system. |
| CVE-2021-32021 | High | 2021-11-10 | Not applicable | No public exploit | A denial of service vulnerability in the message broker of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allow an attacker to potentially execute code in the context of a BlackBerry Cylance service that has admin rights on the system. |
| CVE-2021-22156 | Critical | 2021-08-17 | Not applicable | No public exploit | An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP) version(s) 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to potentially perform a denial of service or execute arbitrary code. |
| CVE-2021-22155 | High | 2021-05-13 | Not applicable | No public exploit | An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 and earlier could allow an attacker to potentially gain access to the application in the context of the targeted user’s account. |
| CVE-2021-22154 | Medium | 2021-05-13 | Not applicable | No public exploit | An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially gain access to a victim's web history. |
| CVE-2021-22153 | High | 2021-05-13 | Not applicable | No public exploit | A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially cause the spreadsheet application to run commands on the victim’s local machine with the authority of the user. |
| CVE-2021-22152 | Medium | 2021-05-13 | Not applicable | No public exploit | A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially to prevent any new user connections. |
| CVE-2020-6933 | Medium | 2020-10-14 | Not applicable | No public exploit | An improper input validation vulnerability in the UEM Core of BlackBerry UEM version(s) 12.13.0, 12.12.1a QF2 (and earlier), and 12.11.1 QF3 (and earlier) could allow an attacker to potentially cause a Denial of Service (DoS) of the UEM Core service. |
| CVE-2020-6932 | Critical | 2020-08-12 | Not applicable | No public exploit | An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platform versions 6.4.0 to 6.6.0 could allow an attacker to potentially read arbitrary files and run arbitrary executables in the context of the web server. |
| CVE-2020-11652 | Medium | 2020-04-30 | Not applicable | Exploited | An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users. |
| CVE-2020-1938 | Critical | 2020-02-24 | Protected by Waratek | Exploited | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations. |
| CVE-2012-5828 | Medium | 2020-02-10 | Not applicable | No public exploit | BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error |
| CVE-2019-8998 | High | 2019-07-12 | Not applicable | No public exploit | An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the /proc filesystem) of BlackBerry QNX Software Development Platform version(s) 6.5.0 SP1 and earlier could allow an attacker to potentially gain unauthorized access to a chosen process address space. |
| CVE-2019-8999 | High | 2019-04-18 | Not applicable | No public exploit | An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access to files on any system reachable by the UEM service account. |
| CVE-2019-8997 | Medium | 2019-03-21 | Not applicable | No public exploit | An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or make requests on the network by entering maliciously crafted XML in an existing field. |
| CVE-2018-8892 | Medium | 2018-12-20 | Not applicable | No public exploit | A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modifications to the UEM settings in the context of a Management Console administrator. |
| CVE-2018-8891 | Medium | 2018-12-20 | Not applicable | No public exploit | Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator. |
| CVE-2018-8888 | Medium | 2018-12-20 | Not applicable | No public exploit | A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator. |
| CVE-2018-8890 | High | 2018-10-12 | Not applicable | No public exploit | An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session and perform administrative actions in the context of the user. |
| CVE-2018-8889 | Medium | 2018-09-19 | Not applicable | No public exploit | A directory traversal vulnerability in the Connect Service of the BlackBerry Enterprise Mobility Server (BEMS) 2.8.17.29 and earlier could allow an attacker to retrieve arbitrary files in the context of a BEMS administrator account. |
| CVE-2017-17442 | Medium | 2018-03-13 | Not applicable | No public exploit | In BlackBerry UEM Management Console version 12.7.1 and earlier, a reflected cross-site scripting vulnerability that could allow an attacker to execute script commands in the context of the affected UEM Management Console account by crafting a malicious link and then persuading a user with legitimate access to the Management Console to click on the malicious link. |
| CVE-2017-9371 | Low | 2017-11-14 | Not applicable | No public exploit | In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, a loss of integrity vulnerability in the default configuration of the QNX SDP could allow an attacker being able to reduce the entropy of the PRNG, making other blended attacks more practical by gaining control over environmental factors that influence seed generation. |
| CVE-2017-9369 | Low | 2017-11-14 | Not applicable | No public exploit | In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, an information disclosure vulnerability in the default configuration of the QNX SDP could allow an attacker to gain information relating to memory layout of higher privileged processes by manipulating environment variables that influence the loader. |
| CVE-2017-3893 | Low | 2017-11-14 | Not applicable | No public exploit | In BlackBerry QNX Software Development Platform (SDP) 6.6.0, the default configuration of the QNX SDP system did not in all circumstances prevent attackers from modifying the GOT or PLT tables with buffer overflow attacks. |
| CVE-2017-3892 | Low | 2017-11-14 | Not applicable | No public exploit | In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an information disclosure vulnerability in the default configuration of the QNX SDP could allow an attacker to gain information relating to memory layout that could be used in a blended attack by executing commands targeting procfs resources. |
| CVE-2017-3891 | Critical | 2017-11-14 | Not applicable | No public exploit | In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enabled on networks comprising two or more QNet nodes could allow an attacker to access local and remote files or take ownership of files on other QNX nodes regardless of permissions by executing commands targeting arbitrary nodes from a secondary QNX 6.6.0 QNet node. |
| CVE-2017-9368 | High | 2017-10-16 | Not applicable | No public exploit | An information disclosure vulnerability in the BlackBerry Workspaces Server could result in an attacker gaining access to source code for server-side applications by crafting a request for specific files. |
| CVE-2017-9367 | Critical | 2017-10-16 | Not applicable | No public exploit | A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files, or reveal the content of arbitrary files anywhere on the web server by crafting a URL with a manipulated POST request. |
| CVE-2017-9370 | High | 2017-08-09 | Not applicable | No public exploit | An information disclosure / elevation of privilege vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker who has legitimate access to BlackBerry Workspaces to gain access to another user's workspace by making multiple login requests to the server. |
| CVE-2017-3894 | Medium | 2017-05-10 | Not applicable | No public exploit | A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BES12, allows attackers to execute actions in the context of a Management Console administrator by uploading a malicious script and then persuading a target administrator to view the specific location of the malicious script within the Management Console. |
| CVE-2016-1915 | Medium | 2017-04-13 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4 allow remote attackers to inject arbitrary web script or HTML via the locale parameter to (1) mydevice/index.jsp or (2) mydevice/loggedOut.jsp. |
| CVE-2016-1914 | High | 2017-04-13 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in the com.rim.mdm.ui.server.ImageServlet servlet in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4 allow remote attackers to execute arbitrary SQL commands via the imageName parameter to (1) mydevice/client/image, (2) admin/client/image, (3) myapps/client/image, (4) ssam/client/image, or (5) all/client/image. |
| CVE-2016-3127 | High | 2017-03-03 | Not applicable | No public exploit | An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allows remote attackers to gain and use logged encryption keys to access certain resources within a customer's Good deployment by gaining access to certain diagnostic log files through either a valid logon or an unrelated compromise of the server. |
| CVE-2017-3890 | Medium | 2017-01-13 | Not applicable | No public exploit | A reflected cross-site scripting vulnerability in the BlackBerry WatchDox Server components Appliance-X, version 1.8.1 and earlier, and vAPP, versions 4.6.0 to 5.4.1, allows remote attackers to execute script commands in the context of the affected browser by persuading a user to click an attacker-supplied malicious link. |
| CVE-2016-3130 | High | 2017-01-13 | Not applicable | No public exploit | An information disclosure vulnerability in the Core and Management Console in BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to obtain local or domain credentials of an administrator or user account by sniffing traffic between the two elements during a login attempt. |
| CVE-2016-3128 | High | 2017-01-13 | Not applicable | No public exploit | A spoofing vulnerability in the Core of BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to enroll an illegitimate device to the BES, gain access to device parameters for the BES, or send false information to the BES by gaining access to specific information about a device that was legitimately enrolled on the BES. |
| CVE-2016-3129 | Medium | 2016-12-16 | Not applicable | No public exploit | A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server (GEMS) implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf command shell. |
| CVE-2016-3126 | Medium | 2016-04-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. |
| CVE-2016-1918 | Medium | 2016-04-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-1917. |
| CVE-2016-1917 | Medium | 2016-04-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-1918. |
| CVE-2016-1916 | Medium | 2016-04-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote authenticated users to inject arbitrary web script or HTML by leveraging basic administrative access to create a crafted policy, leading to improper rendering on a certain Export IT screen. |
| CVE-2015-4112 | Medium | 2015-11-19 | Not applicable | No public exploit | The Management Console in BlackBerry Enterprise Server (BES) 12 before 12.2 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site, related to a "cross frame scripting" issue. |
| CVE-2015-4111 | Medium | 2015-07-20 | Not applicable | No public exploit | mc_demux_mp4_ds.ax in an unspecified third-party codec demux in BlackBerry Link before 1.2.3.53 with installer before 1.1.0.22 allows remote attackers to execute arbitrary code via a crafted MP4 file. |
| CVE-2014-6611 | Medium | 2014-10-25 | Not applicable | No public exploit | The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS 10.3.0 does not properly validate download/update requests, which allows user-assisted man-in-the-middle attackers to spoof servers and trigger the download of a crafted app by modifying the client-server data stream. |
| CVE-2014-2388 | Medium | 2014-08-18 | Not applicable | No public exploit | The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for SMB filesystem access, which allows context-dependent attackers to read arbitrary files via (1) a session over a Wi-Fi network or (2) a session over a USB connection in Development Mode. |
| CVE-2014-1469 | Medium | 2014-08-18 | Not applicable | No public exploit | BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterprise Service 10.x before 10.2.2 log cleartext credentials during exception handling, which allows local users to obtain sensitive information by reading the exception log file. |
| CVE-2014-2389 | High | 2014-04-12 | Not applicable | No public exploit | Stack-based buffer overflow in a certain decryption function in qconnDoor on BlackBerry Z10 devices with software 10.1.0.2312, when developer-mode has been previously enabled, allows remote attackers to execute arbitrary code via a crafted packet in a TCP session on a wireless network. |
| CVE-2014-2534 | Medium | 2014-03-18 | Not applicable | Working exploit published | /sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messages, as demonstrated by reading the root password hash in /etc/shadow. |
| CVE-2014-2533 | High | 2014-03-18 | Not applicable | Working exploit published | /sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arbitrary program name as a command-line argument. |
| CVE-2014-1467 | Medium | 2014-02-14 | Not applicable | No public exploit | BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for Exchange through 5.0.4, Enterprise Server for Domino through 5.0.4 MR6, Enterprise Server for Exchange through 5.0.4 MR6, and Enterprise Server for GroupWise through 5.0.4 MR6 log cleartext credentials during exception handling, which might allow context-dependent attackers to obtain sensitive information by reading a log file. |
| CVE-2013-6798 | Medium | 2013-11-18 | Not applicable | No public exploit | BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not properly determine the user account for execution of Peer Manager in certain situations involving successive logins with different accounts, which allows context-dependent attackers to bypass intended restrictions on remote file-access folders via IPv6 WebDAV requests, a different vulnerability than CVE-2013-3694. |
| CVE-2013-3694 | Medium | 2013-11-18 | Not applicable | No public exploit | BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding. |
| CVE-2013-3693 | High | 2013-10-11 | Not applicable | No public exploit | The BlackBerry Universal Device Service in BlackBerry Enterprise Service (BES) 10.0 through 10.1.2 does not properly restrict access to the JBoss Remote Method Invocation (RMI) interface, which allows remote attackers to upload and execute arbitrary packages via a request to port 1098. |
| CVE-2013-3692 | Medium | 2013-07-13 | Not applicable | No public exploit | BlackBerry 10 OS before 10.0.10.648 on BlackBerry Z10 smartphones uses weak permissions for a BlackBerry Protect object, which allows physically proximate attackers to bypass intended access restrictions by leveraging a user's BlackBerry Protect password-reset request and a user's installation of a crafted application. |
| CVE-2013-2688 | Medium | 2013-07-12 | Not applicable | No public exploit | Buffer overflow in phrelay in BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted packets to TCP port 4868 that leverage improper handling of the /dev/photon device file. |
| CVE-2013-2687 | High | 2013-07-12 | Not applicable | No public exploit | Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2) QNX Momentics Tool Suite through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted packets to TCP port 4868. |
| CVE-2011-0291 | High | 2011-12-08 | Not applicable | No public exploit | The BlackBerry PlayBook service on the Research In Motion (RIM) BlackBerry PlayBook tablet with software before 1.0.8.6067 allows local users to gain privileges via a crafted configuration file in a backup archive. |
| CVE-2008-3246 | High | 2008-07-21 | Not applicable | No public exploit | Unspecified vulnerability in the PDF distiller component in the BlackBerry Attachment Service in BlackBerry Unite! 1.0 SP1 (1.0.1) before bundle 36 and BlackBerry Enterprise Server 4.1 SP3 (4.1.3) through 4.1 SP5 (4.1.5) allows user-assisted remote attackers to execute arbitrary code via a crafted PDF file attachment. |
| CVE-2008-3024 | High | 2008-07-07 | Not applicable | Working exploit published | Stack-based buffer overflow in phgrafx in QNX Momentics (aka RTOS) 6.3.2 and earlier allows local users to gain privileges via a long .pal filename in palette/. |
| CVE-2002-0793 | Medium | 2002-08-12 | Not applicable | Working exploit published | Hard link and possibly symbolic link following vulnerabilities in QNX RTOS 4.25 (aka QNX4) allow local users to overwrite arbitrary files via (1) the -f argument to the monitor utility, (2) the -d argument to dumper, (3) the -c argument to crttrap, or (4) using the Watcom sample utility. |