CVE-2020-15346

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key...

CVE-2020-15347

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account...

CVE-2020-15331

Zyxel CloudCNM SecuManager 3.1.0–3.1.1 is affected by a hardcoded OAUTH_SECRET_KEY located at /opt/axess/etc/default/axess. The vulnerability stems from embedding a static secret, enabling potential unauthorized access if the key is exposed. Connected documents confirm the affected software and p...

PT-2020-14366 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns a hardcoded APP KEY located in the /opt/axess/etc/default/axess file. Recommendations: For versions 3.1.0 and 3.1.1, consider removing or modifying the...

PT-2020-14377 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API endpoint, specifically the "zy get user id and key" API. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting access...

PT-2020-14365 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to weak Data.fs permissions in the affected software. Recommendations: For versions 3.1.0 and 3.1.1, update the permissions of the Data.fs file to ensur...

PT-2020-6758 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to insufficient protection of credentials in the Zyxel CloudCNM SecuManager software, which can allow a remote attacker to gain full access to devices o...

PT-2020-14376 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API, specifically the "zy install user key" API endpoint. This allows for unauthorized access. Recommendations: For versions 3.1.0 and...

PT-2020-14374 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API endpoint, specifically the "update all realm license" API. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting acce...

PT-2020-14379 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns a /live/GLOBALS API endpoint with the CLOUDCNM key. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting access to the /live/GLOBALS API...

PT-2020-14362 · Zyxel +1 · Zyxel Cloudcnm Secumanager +1

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns a hardcoded certificate for Ejabberd, which is located in the ejabberd.pem file. Recommendations: For versions 3.1.0 and 3.1.1, consider removing or...

PT-2020-14375 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API, specifically the "zy install user" API endpoint. This allows for unauthorized access. Recommendations: For versions 3.1.0 and 3.1....

PT-2020-14378 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API endpoint, specifically the "zy get instances for update" API. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting...

PT-2020-14371 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to the use of GET request method with sensitive query strings for /registerCpe requests. This can potentially expose sensitive information...

MQTT Resource Management Error Vulnerability

MQTT Message Queuing Telemetry Transport is an ISO standard ISO/IEC PRF 20922 based on the Publish/Subscribe paradigm of messaging protocols, which works on the TCP/IP family of protocols, and is designed for remote devices with low hardware performance and poor network conditions. It works on th...

CVE-2020-13849

The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to cause a denial of service loss of the ability to establish new connections, as demonstrated by SlowITe...

CVE-2020-13849

The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to cause a denial of service loss of the ability to establish new connections, as demonstrated by SlowITe...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft

This is a PoC exploit for CVE-2020-0796, a SMBv3 RCE vulnerability. The exploit is a simple scanner that checks if a server is vulnerable by sending a specially crafted SMB request. The scanner is designed to test whether a server is vulnerable, not for research or development. It checks for SMB...

CVE-2020-8792

The CVE-2020-8792 entry concerns the OKLOK 3.1.1 mobile companion app for the Fingerprint Bluetooth Padlock FB50 (2.3), where an information-disclosure flaw allows an attacker to learn arbitrary users’ emails and lock names by supplying valid, guessable barcodes through the app interface. Technic...

Signotec signoPAD-API/Web Denial of Service Vulnerability

Signotec signoPAD-API/Web is a web interface for integrating signotec signature pads from Signotec Germany. The product includes features such as document management and memory management. A denial of service vulnerability exists in signotec signoPAD-API/Web versions prior to 3.1.1 Windows, which...