Fujitsu vulnerabilities
78 vulnerabilities
Known vulnerabilities in Fujitsu products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 367 products.
Products
50 of 367- M10 113 vulnerabilities
- M10 413 vulnerabilities
- M10 4S13 vulnerabilities
- M12 113 vulnerabilities
- M12 213 vulnerabilities
- M12 2S13 vulnerabilities
- Interstage Application Server7 vulnerabilities
- Arconte Aurea5 vulnerabilities
- Serverview4 vulnerabilities
- E Pares3 vulnerabilities
- Interstage Application Server Enterprise3 vulnerabilities
- Interstage Application Server Standard J3 vulnerabilities
- Interstage Studio3 vulnerabilities
- Lx3903 vulnerabilities
- Sparc Enterprise M30003 vulnerabilities
- Sparc Enterprise M40003 vulnerabilities
- Sparc Enterprise M50003 vulnerabilities
- Sparc Enterprise M80003 vulnerabilities
- Sparc Enterprise M90003 vulnerabilities
- Systemcastwizard Lite3 vulnerabilities
- Eternus Cs80002 vulnerabilities
- Interstage Application Server Plus2 vulnerabilities
- Interstage Apworks2 vulnerabilities
- Interstage Apworks Enterprise2 vulnerabilities
- Interstage Apworks Modelers J2 vulnerabilities
- Interstage Apworks Standard J2 vulnerabilities
- Interstage Studio Enterprise2 vulnerabilities
- Interstage Studio Standard J2 vulnerabilities
- Ipcom Ex2 Dc 32002 vulnerabilities
- Ipcom Ex2 Dc 35002 vulnerabilities
- Ipcom Ex2 In 32002 vulnerabilities
- Ipcom Ex2 In 35002 vulnerabilities
- Ipcom Ex2 Lb 32002 vulnerabilities
- Ipcom Ex2 Lb 35002 vulnerabilities
- Ipcom Ex2 Sc 32002 vulnerabilities
- Ipcom Ex2 Sc 35002 vulnerabilities
- Ipcom Ve2 Ls 1002 vulnerabilities
- Ipcom Ve2 Ls 2002 vulnerabilities
- Ipcom Ve2 Ls 2202 vulnerabilities
- Ipcom Ve2 Ls Plus 1002 vulnerabilities
- Ipcom Ve2 Ls Plus 2002 vulnerabilities
- Ipcom Ve2 Ls Plus 2202 vulnerabilities
- Ipcom Ve2 Ls Plus2 2002 vulnerabilities
- Ipcom Ve2 Ls Plus2 2202 vulnerabilities
- Ipcom Ve2 Sc Plus 1002 vulnerabilities
- Ipcom Ve2 Sc Plus 2002 vulnerabilities
- Ipcom Ve2 Sc Plus 2202 vulnerabilities
- Lifebook A35102 vulnerabilities
- Lifebook E55102 vulnerabilities
- Lifebook U73102 vulnerabilities
CVE-2018-16156fujitsupaperstream_ip_\(twain\)
EPSS score2.56%
In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over the FjtwMkic_Fjicube_32 named pipe. One of these message processing functions attempts to dynamically load the UninOldIS.dll library and executes an exported function named ChangeUninstallString. The default install does not contain this library and therefore if any DLL with that name exists in any directory listed in the PATH variable, it can be used to escalate to SYSTEM level privilege.CVE-2018-1000007canonicalubuntu_linux+24EPSS score6.58%
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.CVE-2018-20685alpinedropbear+27EPSS score3.68%
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.CVE-2018-3693armcortex-a+244EPSS score8.63%
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis.CVE-2003-1528fujitsusiemens_networkerEPSS score0.40%
nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file.CVE-2013-2566canonicalubuntu_linux+15EPSS score84.42%
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.CVE-2013-2251apachearchiva+4KEVEPSS score100.00%
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.CVE-2013-7105fujitsuinterstage_application_server+1EPSS score1.82%
Buffer overflow in the Interstage HTTP Server log functionality, as used in Fujitsu Interstage Application Server 9.0.0, 9.1.0, 9.2.0, 9.3.1, and 10.0.0; and Interstage Studio 9.0.0, 9.1.0, 9.2.0, and 10.0.0, has unspecified impact and attack vectors related to "ihsrlog/rotatelogs."CVE-2021-20722fujitsu limited and pfu limitedthe installers of scansnap manager and the software download installer+1EPSS score0.44%
Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prior to WinSSInst2JP.exe and WinSSInst2iX1500JP.exe allows an attacker to gain privileges and execute arbitrary code with the privilege of the user invoking the installer via a Trojan horse DLL in an unspecified directory.CVE-2021-3326debianglibc+13EPSS score3.78%
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.CVE-2021-23840alpineopenssl+28EPSS score50.73%
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).CVE-2015-2808canonicalubuntu_linux+62EPSS score73.85%
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.CVE-2007-1505fujitsufence+1EPSS score0.25%
Fujitsu FENCE-Pro before V5L01, and Systemwalker Desktop Encryption V12.0L10, V12.0L10A, V12.0L10B, V12.0L20 and V13.0.0 allows local users to obtain sensitive information by extracting the decoding password from certain "self-decoding" file types.CVE-2007-1504fujitsuinterstage_application_server+1EPSS score1.60%
Cross-site scripting (XSS) vulnerability in the Servlet Service in Fujitsu Interstage Application Server (IJServer) 8.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving web.xml and HTTP 404 and 500 status codes.CVE-2007-5366fujitsuinterstage_application_server+2EPSS score2.17%
The Tomcat 4.1-based Servlet Service in Fujitsu Interstage Application Server 7.0 through 9.0.0 and Interstage Apworks/Studio 7.0 through 9.0.0 allows remote attackers to obtain sensitive information (web root path) via unspecified vectors that trigger an error message, probably related to enabling the useCanonCaches Java Virtual Machine (JVM) option.CVE-2007-3011fujitsuserverviewEPSS score4.17%
The DBAsciiAccess CGI Script in the web interface in Fujitsu-Siemens Computers ServerView before 4.50.09 allows remote attackers to execute arbitrary commands via shell metacharacters in the Servername subparameter of the ParameterList parameter.CVE-2016-8610debianopenssl+49EPSS score39.66%
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.CVE-2025-65001fujitsufbiosdrv.sysEPSS score0.16%
Fujitsu fbiosdrv.sys before 2.5.0.0 allows an attacker to potentially affect system confidentiality, integrity, and availability.CVE-2020-13817debianntp+26EPSS score3.25%
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.CVE-2020-1968canonicalubuntu_linux+22EPSS score4.90%
The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).