Vendor

Blackberry

Products

CVEs

Across products

Status

Private

Products

Enterprise Server
7 CVEs
Qnx Software Development Platform
7 CVEs
Blackberry Os
4 CVEs
Enterprise Service
4 CVEs
Qnx Neutrino Rtos
4 CVEs
Blackberry Link
3 CVEs
Workspaces Vapp
3 CVEs
Z10
3 CVEs
Enterprise Server Express
2 CVEs
Workspaces Appliance X
2 CVEs
Appliance X
1 CVE
Blackberry Tablet Os
1 CVE
Blackberry Universal Device Service
1 CVE
Blackberry World
1 CVE
Good Control Server
1 CVE
Q10
1 CVE
Q5
1 CVE
Qnx Momentics
1 CVE
Qnx Momentics Tool Suite
1 CVE
Qnx Neutrino Real Time Operating System
1 CVE
Unified Endpoint Manager
1 CVE
Unite
1 CVE
Workspaces
1 CVE
Z30
1 CVE

Recent CVEs

CVE	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2017-9367	Cri	0.64	9.8	0.01	Oct 16, 2017	A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files, or reveal the content of arbitrary files anywhere on the web server by crafting a URL with a manipulated POST request.
CVE-2017-3891	Cri	0.62	9.6	0.00	Nov 14, 2017	In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enabled on networks comprising two or more QNet nodes could allow an attacker to access local and remote files or take ownership of files on other QNX nodes regardless of permissions by executing commands targeting arbitrary nodes from a secondary QNX 6.6.0 QNet node.
CVE-2017-9370	Hig	0.57	8.8	0.00	Aug 9, 2017	An information disclosure / elevation of privilege vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker who has legitimate access to BlackBerry Workspaces to gain access to another user's workspace by making multiple login requests to the server.
CVE-2017-9368	Hig	0.49	7.5	0.00	Oct 16, 2017	An information disclosure vulnerability in the BlackBerry Workspaces Server could result in an attacker gaining access to source code for server-side applications by crafting a request for specific files.
CVE-2016-3127	Hig	0.49	7.5	0.00	Mar 3, 2017	An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allows remote attackers to gain and use logged encryption keys to access certain resources within a customer's Good deployment by gaining access to certain diagnostic log files through either a valid logon or an unrelated compromise of the server.
CVE-2017-3894	Med	0.40	6.1	0.00	May 10, 2017	A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BES12, allows attackers to execute actions in the context of a Management Console administrator by uploading a malicious script and then persuading a target administrator to view the specific location of the malicious script within the Management Console.
CVE-2017-3890	Med	0.40	6.1	0.00	Jan 13, 2017	A reflected cross-site scripting vulnerability in the BlackBerry WatchDox Server components Appliance-X, version 1.8.1 and earlier, and vAPP, versions 4.6.0 to 5.4.1, allows remote attackers to execute script commands in the context of the affected browser by persuading a user to click an attacker-supplied malicious link.
CVE-2016-3126	Med	0.40	6.1	0.00	Apr 22, 2016	Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2016-1918	Med	0.40	6.1	0.00	Apr 22, 2016	Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-1917.
CVE-2016-1917	Med	0.40	6.1	0.00	Apr 22, 2016	Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-1918.
CVE-2002-0793	Med	0.39	5.5	0.00	Aug 12, 2002	Hard link and possibly symbolic link following vulnerabilities in QNX RTOS 4.25 (aka QNX4) allow local users to overwrite arbitrary files via (1) the -f argument to the monitor utility, (2) the -d argument to dumper, (3) the -c argument to crttrap, or (4) using the Watcom sample utility.
CVE-2017-9369	Low	0.25	3.8	0.00	Nov 14, 2017	In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, an information disclosure vulnerability in the default configuration of the QNX SDP could allow an attacker to gain information relating to memory layout of higher privileged processes by manipulating environment variables that influence the loader.
CVE-2017-3892	Low	0.25	3.8	0.00	Nov 14, 2017	In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an information disclosure vulnerability in the default configuration of the QNX SDP could allow an attacker to gain information relating to memory layout that could be used in a blended attack by executing commands targeting procfs resources.
CVE-2017-9371	Low	0.17	2.6	0.00	Nov 14, 2017	In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, a loss of integrity vulnerability in the default configuration of the QNX SDP could allow an attacker being able to reduce the entropy of the PRNG, making other blended attacks more practical by gaining control over environmental factors that influence seed generation.
CVE-2017-3893	Low	0.12	1.9	0.00	Nov 14, 2017	In BlackBerry QNX Software Development Platform (SDP) 6.6.0, the default configuration of the QNX SDP system did not in all circumstances prevent attackers from modifying the GOT or PLT tables with buffer overflow attacks.
CVE-2014-2533		0.05	—	0.26	Mar 18, 2014	/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arbitrary program name as a command-line argument.
CVE-2014-2534		0.03	—	0.01	Mar 18, 2014	/sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messages, as demonstrated by reading the root password hash in /etc/shadow.
CVE-2008-3024		0.03	—	0.01	Jul 7, 2008	Stack-based buffer overflow in phgrafx in QNX Momentics (aka RTOS) 6.3.2 and earlier allows local users to gain privileges via a long .pal filename in palette/.
CVE-2008-3246		0.02	—	0.25	Jul 21, 2008	Unspecified vulnerability in the PDF distiller component in the BlackBerry Attachment Service in BlackBerry Unite! 1.0 SP1 (1.0.1) before bundle 36 and BlackBerry Enterprise Server 4.1 SP3 (4.1.3) through 4.1 SP5 (4.1.5) allows user-assisted remote attackers to execute arbitrary code via a crafted PDF file attachment.
CVE-2014-2389		0.01	—	0.15	Apr 12, 2014	Stack-based buffer overflow in a certain decryption function in qconnDoor on BlackBerry Z10 devices with software 10.1.0.2312, when developer-mode has been previously enabled, allows remote attackers to execute arbitrary code via a crafted packet in a TCP session on a wireless network.