Blackberry
69 CVEs across 55 Blackberry products. Browse Blackberry vulnerabilities, severities, and proof-of-concept exploits.
Blackberry products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18247 | | 2026-08-11 | A Cross Site Scripting (XSS) vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute… | |
CVE-2026-18085 | Medium | 6.9 | 2026-07-28 | An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential De… |
CVE-2026-18084 | Medium | 6.1 | 2026-07-28 | Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting (X… |
CVE-2025-12766 | Medium | 5.0 | 2025-11-19 | An Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of BlackBerry® AtHoc® (OnPrem) version 7.21 could allow an attacker to poten… |
CVE-2025-2474 | Critical | 9.8 | 2025-06-10 | Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition… |
CVE-2025-3945 | High | 7.2 | 2025-05-22 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterpris… |
CVE-2025-3944 | High | 7.2 | 2025-05-22 | Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File… |
CVE-2025-3943 | Medium | 4.1 | 2025-05-22 | Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security o… |
CVE-2025-3942 | Medium | 4.3 | 2025-05-22 | Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linu… |
CVE-2025-3940 | Medium | 5.3 | 2025-05-22 | Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux… |
CVE-2025-3939 | Medium | 5.3 | 2025-05-22 | Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX a… |
CVE-2025-3938 | Medium | 6.8 | 2025-05-22 | Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows… |
CVE-2025-3937 | High | 7.7 | 2025-05-22 | Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Secur… |
CVE-2024-48858 | High | 7.5 | 2025-01-14 | Improper input validation in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service cond… |
CVE-2024-48857 | High | 7.5 | 2025-01-14 | NULL pointer dereference in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condi… |
CVE-2024-48856 | Critical | 9.8 | 2025-01-14 | Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition… |
CVE-2024-48855 | Medium | 5.3 | 2025-01-14 | Out-of-bounds read in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in t… |
CVE-2024-48854 | Medium | 5.3 | 2025-01-14 | Off-by-one error in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the… |
CVE-2024-51723 | Medium | 4.6 | 2024-11-25 | A Stored Cross-Site Scripting (XSS) vulnerability in the Management Console of BlackBerry AtHoc version 7.15 could allow an attacker to potentially execute act… |
CVE-2024-51722 | Medium | 6.4 | 2024-11-12 | A local privilege escalation vulnerability in the SecuSUITE Server (System Configuration) of SecuSUITE versions 5.0.420 and earlier could allow a successful at… |
CVE-2024-51721 | High | 7.3 | 2024-11-12 | A code injection vulnerability in the SecuSUITE Server Web Administration Portal of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potential… |
CVE-2024-51720 | Medium | 4.8 | 2024-11-12 | An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attac… |
CVE-2024-35215 | Medium | 6.2 | 2024-10-08 | NULL pointer dereference in IP socket options processing of the Networking Stack in QNX Software Development Platform (SDP) version(s) 7.1 and 7.0 could allow… |
CVE-2024-35214 | | 2024-08-20 | A tampering vulnerability in the CylanceOPTICS Windows Installer Package of CylanceOPTICS for Windows version 3.2 and 3.3 could allow an attacker to potentiall… | |
CVE-2024-35213 | Critical | 9.0 | 2024-06-11 | An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause a denial… |
CVE-2023-32701 | High | 7.1 | 2023-11-14 | Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause Information Disclosure o… |
CVE-2023-21523 | Medium | 5.4 | 2023-09-12 | A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerry AtHoc version 7.1… |
CVE-2023-21520 | Medium | 5.3 | 2023-09-12 | A PII Enumeration via Credential Recovery in the Self Service (Credential Recovery) of BlackBerry AtHoc version 7.15 could allow an atta… |
CVE-2023-21522 | Medium | 6.1 | 2023-09-12 | A Reflected Cross-site Scripting (XSS) vulnerability in the Management Console (Reports) of BlackBerry AtHoc version 7.15 could allow an attacker to potential… |
CVE-2023-21521 | High | 7.2 | 2023-09-12 | An SQL Injection vulnerability in the Management Console (Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially read… |
CVE-2021-32025 | High | 8.1 | 2022-03-10 | An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Platform version(s) 6.4.0 to 7.0, QNX Momen… |
CVE-2021-32024 | Critical | 9.8 | 2021-12-13 | A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an attacker to potentially execute code in… |
CVE-2021-32023 | High | 7.8 | 2021-11-10 | An elevation of privilege vulnerability in the message broker of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allow an attacker to… |
CVE-2021-32022 | Medium | 5.5 | 2021-11-10 | A low privileged delete vulnerability using CEF RPC server of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allow an attacker to po… |
CVE-2021-32021 | High | 7.8 | 2021-11-10 | A denial of service vulnerability in the message broker of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allow an attacker to poten… |
CVE-2020-36486 | Medium | 6.1 | 2021-10-22 | Swift File Transfer Mobile v1.1.2 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the 'path' parameter of the 'list' and 'do… |
CVE-2021-22156 | Critical | 9.0 | 2021-08-17 | An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP)… |
CVE-2021-22154 | Medium | 5.3 | 2021-05-13 | An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier c… |
CVE-2021-22153 | High | 7.3 | 2021-05-13 | A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier cou… |
CVE-2021-22152 | Medium | 5.5 | 2021-05-13 | A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and… |
CVE-2021-22155 | High | 8.8 | 2021-05-13 | An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 an… |
CVE-2020-6933 | Medium | 5.5 | 2020-10-14 | An improper input validation vulnerability in the UEM Core of BlackBerry UEM version(s) 12.13.0, 12.12.1a QF2 (and earlier), and 12.11.1 QF3 (and earlier) coul… |
CVE-2020-6932 | Critical | 10.0 | 2020-08-12 | An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platform versions 6.4.0… |
CVE-2020-11652 | Medium | 6.5 | 2020-04-30 | An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that i… |
CVE-2020-1938 | Critical | 9.8 | 2020-02-24 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having hig… |
CVE-2012-5828 | Medium | 6.5 | 2020-02-10 | BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error |
CVE-2019-9506 | High | 8.1 | 2019-08-14 | The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influen… |
CVE-2019-8998 | High | 7.8 | 2019-07-12 | An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the /proc filesystem) of BlackBerry QNX Sof… |
CVE-2019-8999 | High | 7.5 | 2019-04-18 | An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access… |
CVE-2019-8997 | Medium | 5.9 | 2019-03-21 | An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an att… |
CVE-2018-8892 | Medium | 6.5 | 2018-12-20 | A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modi… |
CVE-2018-8891 | Medium | 4.8 | 2018-12-20 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to… |
CVE-2018-8888 | Medium | 4.8 | 2018-12-20 | A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an attacker to store sc… |
CVE-2018-8890 | High | 7.5 | 2018-10-12 | An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session… |
CVE-2018-8889 | Medium | 4.7 | 2018-09-19 | A directory traversal vulnerability in the Connect Service of the BlackBerry Enterprise Mobility Server (BEMS) 2.8.17.29 and earlier could allow an attacker to… |
CVE-2017-17442 | Medium | 6.1 | 2018-03-13 | In BlackBerry UEM Management Console version 12.7.1 and earlier, a reflected cross-site scripting vulnerability that could allow an attacker to execute script… |
CVE-2017-9371 | Low | 2.6 | 2017-11-14 | In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, a loss of integrity vulnerability in the default configuration of the QN… |
CVE-2017-9369 | Low | 3.8 | 2017-11-14 | In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, an information disclosure vulnerability in the default configuration of… |
CVE-2017-3893 | Low | 1.9 | 2017-11-14 | In BlackBerry QNX Software Development Platform (SDP) 6.6.0, the default configuration of the QNX SDP system did not in all circumstances prevent attackers fro… |
CVE-2017-3892 | Low | 3.8 | 2017-11-14 | In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an information disclosure vulnerability in the default configuration of the QNX SDP could allow an… |
CVE-2017-3891 | Critical | 9.6 | 2017-11-14 | In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enab… |
CVE-2017-9368 | High | 7.5 | 2017-10-16 | An information disclosure vulnerability in the BlackBerry Workspaces Server could result in an attacker gaining access to source code for server-side applicati… |
CVE-2017-9367 | Critical | 9.8 | 2017-10-16 | A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files, or reveal the… |
CVE-2017-9370 | High | 8.8 | 2017-08-09 | An information disclosure / elevation of privilege vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker who has legitimate acc… |
CVE-2017-3894 | Medium | 6.1 | 2017-05-10 | A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BE… |
CVE-2016-1915 | Medium | 6.1 | 2017-04-13 | Multiple cross-site scripting (XSS) vulnerabilities in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4 allow remote attackers to inject arbitr… |
CVE-2016-1914 | High | 8.8 | 2017-04-13 | Multiple SQL injection vulnerabilities in the com.rim.mdm.ui.server.ImageServlet servlet in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4 al… |
CVE-2016-3127 | High | 7.5 | 2017-03-03 | An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allows remote attackers… |
CVE-2017-3890 | Medium | 6.1 | 2017-01-13 | A reflected cross-site scripting vulnerability in the BlackBerry WatchDox Server components Appliance-X, version 1.8.1 and earlier, and vAPP, versions 4.6.0 to… |
CVE-2016-3130 | High | 8.1 | 2017-01-13 | An information disclosure vulnerability in the Core and Management Console in BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to o… |
CVE-2016-3128 | High | 8.2 | 2017-01-13 | A spoofing vulnerability in the Core of BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to enroll an illegitimate device to the BE… |
CVE-2016-3129 | Medium | 6.6 | 2016-12-16 | A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server (GEMS) implementation of the Apache Karaf command shell in GEMS versio… |
CVE-2016-3126 | Medium | 6.1 | 2016-04-22 | Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arb… |
CVE-2016-1918 | Medium | 6.1 | 2016-04-22 | Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arb… |
CVE-2016-1917 | Medium | 6.1 | 2016-04-22 | Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arb… |
CVE-2016-1916 | Medium | 5.4 | 2016-04-22 | Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote authenticated users to… |
CVE-2015-4112 | | 2015-11-19 | The Management Console in BlackBerry Enterprise Server (BES) 12 before 12.2 does not properly restrict use of FRAME elements, which makes it easier for remote… | |
CVE-2015-4111 | | 2015-07-20 | mc_demux_mp4_ds.ax in an unspecified third-party codec demux in BlackBerry Link before 1.2.3.53 with installer before 1.1.0.22 allows remote attackers to execu… | |
CVE-2014-6611 | | 2014-10-25 | The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS 10.3… | |
CVE-2014-2388 | | 2014-08-18 | The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for SMB file… | |
CVE-2014-1469 | | 2014-08-18 | BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterprise Service 10.x before 10.2.2 log cleartext credentials during exception handling, which allows l… | |
CVE-2014-2389 | | 2014-04-12 | Stack-based buffer overflow in a certain decryption function in qconnDoor on BlackBerry Z10 devices with software 10.1.0.2312, when developer-mode has been pre… | |
CVE-2014-2534 | | 2014-03-18 | /sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error mes… | |
CVE-2014-2533 | | 2014-03-18 | /sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arbitrary program name as a command-line a… | |
CVE-2014-1467 | | 2014-02-14 | BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for E… | |
CVE-2013-3694 | | 2013-11-18 | BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows r… | |
CVE-2013-6798 | | 2013-11-18 | BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not properly determine the user account for execution of Peer Manager in… | |
CVE-2013-3693 | | 2013-10-11 | The BlackBerry Universal Device Service in BlackBerry Enterprise Service (BES) 10.0 through 10.1.2 does not properly restrict access to the JBoss Remote Method… | |
CVE-2013-3692 | | 2013-07-13 | BlackBerry 10 OS before 10.0.10.648 on BlackBerry Z10 smartphones uses weak permissions for a BlackBerry Protect object, which allows physically proximate atta… | |
CVE-2013-2688 | | 2013-07-12 | Buffer overflow in phrelay in BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial… | |
CVE-2013-2687 | | 2013-07-12 | Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2) QNX Momentics Tool Suite through 6.5.0… | |
CVE-2011-0291 | | 2011-12-08 | The BlackBerry PlayBook service on the Research In Motion (RIM) BlackBerry PlayBook tablet with software before 1.0.8.6067 allows local users to gain privilege… | |
CVE-2008-3246 | | 2008-07-21 | Unspecified vulnerability in the PDF distiller component in the BlackBerry Attachment Service in BlackBerry Unite! 1.0 SP1 (1.0.1) before bundle 36 and BlackBe… | |
CVE-2008-3024 | | 2008-07-07 | Stack-based buffer overflow in phgrafx in QNX Momentics (aka RTOS) 6.3.2 and earlier allows local users to gain privileges via a long .pal filename in palette/. | |
CVE-2002-0793 | Medium | 5.5 | 2002-08-12 | Hard link and possibly symbolic link following vulnerabilities in QNX RTOS 4.25 (aka QNX4) allow local users to overwrite arbitrary files via (1) the -f argume… |