Vulnerabilities > Sierrawireless > Medium

DATE CVE VULNERABILITY TITLE RISK
2023-12-04 CVE-2023-40460 Cross-site Scripting vulnerability in Sierrawireless Aleos
The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authenticated user to perform client-side script execution within ACEManager, altering the device functionality until the device is restarted.
network
low complexity
sierrawireless CWE-79
5.4
2023-12-04 CVE-2023-40461 Cross-site Scripting vulnerability in Sierrawireless Aleos
The ACEManager component of ALEOS 4.16 and earlier allows an authenticated user with Administrator privileges to access a file upload field which does not fully validate the file name, creating a Stored Cross-Site Scripting condition.
network
low complexity
sierrawireless CWE-79
4.8
2023-12-04 CVE-2023-40464 Use of Hard-coded Credentials vulnerability in Sierrawireless Aleos
Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key.
network
high complexity
sierrawireless CWE-798
6.8
2023-12-04 CVE-2023-40465 Out-of-bounds Write vulnerability in Sierrawireless Aleos
Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the local area network, resulting in a Denial of Service condition for the captive portal.
local
low complexity
sierrawireless CWE-787
5.5
2023-02-10 CVE-2022-46650 Information Exposure vulnerability in Sierrawireless Aleos
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page.
network
low complexity
sierrawireless CWE-200
4.9
2020-08-21 CVE-2019-11862 Incorrect Authorization vulnerability in Sierrawireless Aleos
The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying.
local
low complexity
sierrawireless CWE-863
4.6
2020-08-21 CVE-2019-11858 Classic Buffer Overflow vulnerability in Sierrawireless Aleos
Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9.
network
low complexity
sierrawireless CWE-120
6.5
2020-08-21 CVE-2019-11857 Improper Input Validation vulnerability in Sierrawireless Aleos
Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information.
network
low complexity
sierrawireless CWE-20
4.0
2020-08-21 CVE-2019-11856 Authentication Bypass by Capture-replay vulnerability in Sierrawireless Aleos
A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay.
network
low complexity
sierrawireless CWE-294
5.5
2020-08-21 CVE-2019-11853 Command Injection vulnerability in Sierrawireless Aleos
Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4.
network
low complexity
sierrawireless CWE-77
6.5