Vulnerabilities > ARM

DATE CVE VULNERABILITY TITLE RISK
2020-01-23 CVE-2019-18222 Information Exposure Through Discrepancy vulnerability in multiple products
The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.
local
high complexity
arm fedoraproject debian CWE-203
4.7
2019-11-04 CVE-2019-17210 Improper Input Validation vulnerability in ARM Mbed-Mqtt and Mbed-Os
A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02.
network
low complexity
arm CWE-20
5.0
2019-09-26 CVE-2019-16910 Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times.
network
high complexity
arm fedoraproject debian
5.3
2019-01-30 CVE-2018-19440 Information Exposure vulnerability in ARM Trusted Firmware-A
ARM Trusted Firmware-A allows information disclosure.
network
low complexity
arm CWE-200
5.0
2018-12-18 CVE-2017-15031 Information Exposure vulnerability in ARM Arm-Trusted-Firmware
In all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving/restoring the PMCR_EL0 register can leak secure world timing information.
network
low complexity
arm CWE-200
5.0
2018-12-05 CVE-2018-19608 Improper Privilege Management vulnerability in ARM Mbed TLS
Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plaintext of RSA decryption, which is used in RSA-without-(EC)DH(E) cipher suites.
local
arm CWE-269
1.9
2018-10-08 CVE-2018-5402 Cryptographic Issues vulnerability in Auto-Maskin products
The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN Impact: An attacker once authenticated can change configurations, upload new configuration files, and upload executable code via file upload for firmware updates.
network
low complexity
auto-maskin arm CWE-310
6.5
2018-10-08 CVE-2018-5401 Cleartext Transmission of Sensitive Information vulnerability in Auto-Maskin products
The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
4.3
2018-10-08 CVE-2018-5400 Origin Validation Error vulnerability in Auto-Maskin DCU 210E Firmware and RP 210E Firmware
The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices.
network
low complexity
auto-maskin arm CWE-346
6.4
2018-07-28 CVE-2018-0498 ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows local users to achieve partial plaintext recovery (for a CBC based ciphersuite) via a cache-based side-channel attack.
local
arm debian
1.9