Vulnerabilities > Airspan
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-08-16 | CVE-2022-36306 | Files or Directories Accessible to External Parties vulnerability in Airspan Airvelocity 1500 Firmware 15.18.00.2511/9.3.0.01249 An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configuration file. | 6.5 |
| 2022-08-08 | CVE-2022-36266 | Cross-site Scripting vulnerability in Airspan Airspot 5410 Firmware 0.3.4.14 In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a stored XSS vulnerability. | 6.1 |
| 2022-08-08 | CVE-2022-36267 | Unspecified vulnerability in Airspan Airspot 5410 Firmware 0.3.4.14 In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. | 9.8 |
| 2022-02-18 | CVE-2022-0138 | Deserialization of Untrusted Data vulnerability in Airspan products MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserialization function that does not validate or check the data, allowing arbitrary classes to be created. | 5.0 |
| 2022-02-18 | CVE-2022-21141 | Incorrect Authorization vulnerability in Airspan products MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization checks on multiple API functions. | 10.0 |
| 2022-02-18 | CVE-2022-21143 | OS Command Injection vulnerability in Airspan products MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input on several locations, which may allow an attacker to inject arbitrary commands. | 10.0 |
| 2022-02-18 | CVE-2022-21176 | SQL Injection vulnerability in Airspan products MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input, which may allow an attacker to perform a SQL injection and obtain sensitive information. | 5.0 |
| 2022-02-18 | CVE-2022-21196 | Unspecified vulnerability in Airspan products MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. | 9.8 |
| 2022-02-18 | CVE-2022-21215 | Server-Side Request Forgery (SSRF) vulnerability in Airspan products This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. | 10.0 |
| 2022-02-18 | CVE-2022-21800 | Inadequate Encryption Strength vulnerability in Airspan products MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. | 6.5 |