Gemalto: Security Vulnerabilities
SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vulnerable when configured as a service. This vulnerability may allow an attacker with local access to create, write, and/or delete files in system folder using symbolic links, leading to a privilege escalation. This vulnerability could also be used by an attacker to execute a malicious DLL, which could impact the integrity and availability of the system.
CVSS Score
7.8
EPSS Score
0.002
Published
2019-12-11
Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle (MITM) attack and replace original language pack by malicious one.
CVSS Score
5.3
EPSS Score
0.001
Published
2019-06-07
Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it.
CVSS Score
6.5
EPSS Score
0.003
Published
2019-06-07
Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection.
CVSS Score
8.0
EPSS Score
0.013
Published
2019-06-05
Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure.
CVSS Score
5.7
EPSS Score
0.001
Published
2019-06-05
Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control.
CVSS Score
5.7
EPSS Score
0.001
Published
2019-06-05
The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker to load and execute a malicious file.
CVSS Score
7.8
EPSS Score
0.007
Published
2019-04-11
A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.
CVSS Score
7.5
EPSS Score
0.004
Published
2018-08-18
The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center (ACC) for cross-site scripting (XSS) vulnerability.
CVSS Score
6.1
EPSS Score
0.003
Published
2018-05-02
Stack overflow in custom XML-parser in Gemalto's Sentinel LDK RTE version before 7.65 leads to remote denial of service
CVSS Score
7.5
EPSS Score
0.008
Published
2018-03-13
Page 1