Nokia vulnerabilities
156 vulnerabilities
Known vulnerabilities in Nokia products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 83 products.
Products
50 of 83- Netact12 vulnerabilities
- 1350 Optical Management System10 vulnerabilities
- Hit 73007 vulnerabilities
- Impact7 vulnerabilities
- Network Functions Manager For Transport7 vulnerabilities
- Nokia Single RAN7 vulnerabilities
- G 040W Q6 vulnerabilities
- I 240W Q Gpon Ont6 vulnerabilities
- Mantaray Nm6 vulnerabilities
- G425 vulnerabilities
- Infinera Mtc 95 vulnerabilities
- Affix4 vulnerabilities
- Asika Airscale4 vulnerabilities
- Transcend Network Management System4 vulnerabilities
- 6131 Nfc3 vulnerabilities
- ASIK Airscale3 vulnerabilities
- Asik Airscale 474021A.1013 vulnerabilities
- Electronic Documentation3 vulnerabilities
- Fastmile3 vulnerabilities
- Heif3 vulnerabilities
- Intellisync Mobile Suite3 vulnerabilities
- Wavesuite Noc3 vulnerabilities
- Asik Airscale 474021A.1022 vulnerabilities
- Broadcast Message Center2 vulnerabilities
- Cbis,Ncs2 vulnerabilities
- Impact Mobile2 vulnerabilities
- NSP2 vulnerabilities
- SR Linux2 vulnerabilities
- SR OS (7250 IXR, 7450 ESS, 7750 SR, 7950 IXR, Vsr), 7705 SAR OS, 7210 SAS OS2 vulnerabilities
- Symbian2 vulnerabilities
- 1830 Photonic Service Switch 161 vulnerabilities
- 1830 Photonic Service Switch 321 vulnerabilities
- 1830 Photonic Service Switch 41 vulnerabilities
- 6210 Handset1 vulnerabilities
- 8810 4G1 vulnerabilities
- Access Management System1 vulnerabilities
- Airframe Bmc Web Gui R181 vulnerabilities
- Bts Trs Web Console1 vulnerabilities
- E751 vulnerabilities
- Fastmile 5G Receiver1 vulnerabilities
- Firewall Appliance1 vulnerabilities
- G 120W F1 vulnerabilities
- G 2425G A1 vulnerabilities
- Ggsn1 vulnerabilities
- Infinera Dna1 vulnerabilities
- Ip440 Firewall Vpn Appliance1 vulnerabilities
- Ipso1 vulnerabilities
- Multimedia Player1 vulnerabilities
- N951 vulnerabilities
- Nokia ONT1 vulnerabilities
CVE-2003-1189nokiaipso
EPSS score1.59%
Unknown vulnerability in Nokia IPSO 3.7, configured as IP Clusters, allows remote attackers to cause a denial of service via unknown attack vectors.CVE-2003-0103nokia6210_handsetEPSS score1.74%
Format string vulnerability in Nokia 6210 handset allows remote attackers to cause a denial of service (crash, lockup, or restart) via a Multi-Part vCard with fields containing a large number of format string specifiers.CVE-2003-0802nokiaelectronic_documentationEPSS score6.64%
Nokia Electronic Documentation (NED) 5.0 allows remote attackers to obtain a directory listing of the WebLogic web root, and the physical path of the NED server, via a "retrieve" action with a location parameter of . (dot).CVE-2003-0368nokiaggsnEPSS score2.01%
Nokia Gateway GPRS support node (GGSN) allows remote attackers to cause a denial of service (kernel panic) via a malformed IP packet with a 0xFF TCP option.CVE-2003-0803nokiaelectronic_documentationEPSS score5.61%
Nokia Electronic Documentation (NED) 5.0 allows remote attackers to use NED as an open HTTP proxy via a URL in the location parameter, which NED accesses and returns to the user.CVE-2003-0801nokiaelectronic_documentationEPSS score12.20%
Cross-site scripting (XSS) vulnerability in Nokia Electronic Documentation (NED) 5.0 allows remote attackers to execute arbitrary web script and steal cookies via a URL to the docs/ directory that contains the script.CVE-2021-41487nokiavitalsuiteEPSS score1.76%
NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'.CVE-2021-26596nokianetactEPSS score0.74%
An issue was discovered in Nokia NetAct 18A. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. Here, the /netact/sct filename parameter is used.CVE-2021-26597nokianetactEPSS score1.44%
An issue was discovered in Nokia NetAct 18A. A remote user, authenticated to the NOKIA NetAct Web Page, can visit the Site Configuration Tool web site section and arbitrarily upload potentially dangerous files without restrictions via the /netact/sct dir parameter in conjunction with the operation=upload value.CVE-2021-31932nokiabts_trs_web_consoleEPSS score21.64%
Nokia BTS TRS web console FTM_W20_FP2_2019.08.16_0010 allows Authentication Bypass. A malicious unauthenticated user can get access to all the functionalities exposed via the web panel, circumventing the authentication process, by using URL encoding for the . (dot) character.CVE-2021-45896nokiafastmile_firmwareEPSS score1.58%
Nokia FastMile 3TG00118ABAD52 devices allow privilege escalation by an authenticated user via is_ctc_admin=1 to login_web_app.cgi and use of Import Config File.CVE-2021-32288nokiaheifEPSS score1.06%
An issue was discovered in heif through v3.6.2. A global-buffer-overflow exists in the function HevcDecoderConfigurationRecord::getPicHeight() located in hevcdecoderconfigrecord.cpp. It allows an attacker to cause code Execution.CVE-2021-32289nokiaheifEPSS score0.64%
An issue was discovered in heif through through v3.6.2. A NULL pointer dereference exists in the function convertByteStreamToRBSP() located in nalutil.cpp. It allows an attacker to cause Denial of Service.CVE-2021-32287nokiaheifEPSS score1.05%
An issue was discovered in heif through v3.6.2. A global-buffer-overflow exists in the function HevcDecoderConfigurationRecord::getPicWidth() located in hevcdecoderconfigrecord.cpp. It allows an attacker to cause code Execution.CVE-2021-30003nokiag-120w-f_firmwareEPSS score0.61%
An issue was discovered on Nokia G-120W-F 3FE46606AGAB91 devices. There is Stored XSS in the administrative interface via urlfilter.cgi?add url_address.CVE-2021-35486nokiaimpact_mobileEPSS score0.19%
A Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10-20210118042150283 allows a remote attacker to import and overwrite the entire application configuration. Specifically, in /ui/rest-proxy/entity/import, neither the X-CSRF-NONCE HTTP header nor the CSRF-NONCE cookie is validated.CVE-2021-35484nokiaimpactEPSS score0.24%
Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTTP GET parameter. This allows an attacker to access sensitive data from the database and obtain access to the database user, database name, and database version information.CVE-2021-35483nokiaimpactEPSS score0.23%
The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one. If an authenticated user visits the web page where the file is published, the JavaScript code is executed.CVE-2021-35485nokiaimpactEPSS score0.24%
The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload server-side executable files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one.CVE-2021-35487nokiabroadcast_message_centerEPSS score1.03%
Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint /owui/block/send-receive-updates (for the Manage Alerts page) via the extIdentifier HTTP POST parameter. This allows an attacker to obtain the database user, database name, and database version information, and potentially database data.