Vulnerabilities

Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow.

Keysight IxChariot Endpoint before 9.5.102 contains a stack-based buffer overflow.

Keysight IxChariot Endpoint before 9.5.102 contains a heap-based buffer overflow.

Keysight Ixia Vision has an issue with hardcoded cryptographic material which may allow an attacker to intercept or decrypt payloads sent to the device via API calls or user authentication if the end user does not replac…

Path traversal may lead to arbitrary file deletion.

Path traversal may lead to arbitrary file download.

External XML entity injection allows arbitrary download of files.

Path traversal may allow remote code execution using privileged account (requires device admin account, cannot be performed by a regular user).

​In Keysight Geolocation Server v2.4.2 and prior, a low privileged attacker could create a local ZIP file containing a malicious script in any location.

In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM privileges due to an improper path validation, which could result i…

Keysight N8844A Data Analytics Web Service deserializes untrusted data without sufficiently verifying the resulting data will be valid.

A vulnerability was found in Keysight IXIA Hawkeye 3.3.16.28.

N6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate privileges in the affected device’s default configuration and achieve remote code e…

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS.

A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (SMS).

The affected products are vulnerable to directory traversal, which may allow an attacker to obtain arbitrary operating system files.

The affected products are vulnerable of untrusted data due to deserialization without prior authorization/authentication, which may allow an attacker to remotely execute arbitrary code.

An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence.

An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence.