Vulnerabilities > Sierrawireless > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-12-04 | CVE-2023-40460 | Cross-site Scripting vulnerability in Sierrawireless Aleos The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authenticated user to perform client-side script execution within ACEManager, altering the device functionality until the device is restarted. | 5.4 |
| 2023-12-04 | CVE-2023-40461 | Cross-site Scripting vulnerability in Sierrawireless Aleos The ACEManager component of ALEOS 4.16 and earlier allows an authenticated user with Administrator privileges to access a file upload field which does not fully validate the file name, creating a Stored Cross-Site Scripting condition. | 4.8 |
| 2023-12-04 | CVE-2023-40464 | Use of Hard-coded Credentials vulnerability in Sierrawireless Aleos Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. | 6.8 |
| 2023-12-04 | CVE-2023-40465 | Out-of-bounds Write vulnerability in Sierrawireless Aleos Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the local area network, resulting in a Denial of Service condition for the captive portal. | 5.5 |
| 2023-02-10 | CVE-2022-46650 | Information Exposure vulnerability in Sierrawireless Aleos Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page. | 4.9 |
| 2022-12-26 | CVE-2019-13988 | Unspecified vulnerability in Sierrawireless Mgos Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request (aka Forced Browsing). low complexity sierrawireless | 6.5 |
| 2020-08-21 | CVE-2019-11857 | Improper Input Validation vulnerability in Sierrawireless Aleos Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information. | 4.9 |
| 2020-08-21 | CVE-2019-11850 | Out-of-bounds Write vulnerability in Sierrawireless Aleos A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0. | 6.7 |
| 2020-08-21 | CVE-2019-11849 | Out-of-bounds Write vulnerability in Sierrawireless Aleos A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. | 6.7 |
| 2019-05-06 | CVE-2018-4067 | Information Exposure vulnerability in Sierrawireless Airlink Es450 Firmware 4.9.3 An exploitable information disclosure vulnerability exists in the ACEManager template_load.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. | 6.5 |