12126 matches found
Design/Logic Flaw
eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via the user authentication dialogue, aka HMCCU-153. This leads to automatic login as admin...
Design/Logic Flaw
eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via an invalid login attempt to the RemoteApi account, aka HMCCU-154. This leads to automatic login as admin...
Buffer overflow
eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa ise GmbH HTTP-Server 2.0 component, aka HMCCU-179. This may lead to remote code execution...
Hardcoded credentials
On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration aka setAutoLogin can be achieved by continuing to use a session ID after a logout, aka HMCCU-154...
CVE-2019-10122
CVE-2019-10122 affects eQ-3 HomeMatic CCU2 (firmware < 2.41.9) and CCU3 (firmware
CVE-2019-10122
eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa ise GmbH HTTP-Server 2.0 component, aka HMCCU-179. This may lead to remote code execution...
CVE-2019-10121
eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via the user authentication dialogue, aka HMCCU-153. This leads to automatic login as admin...
CVE-2019-10121
CVE-2019-10121 affects eQ-3 HomeMatic CCU2 (before 2.41.8) and CCU3 (before 3.43.15): authentication uses session IDs without proper authorization checks, allowing an attacker to get an admin session via the user authentication dialogue (HMCCU-153). Mitigations/patches exist in the vendor changel...
CVE-2019-10119
The CVE-2019-10119 issue affects eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, where authentication relies on session IDs but lacks proper authorization checks. An attacker can obtain a valid session ID via an invalid login attempt to the RemoteApi account (HMCCU-154)...
CVE-2019-10119
eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via an invalid login attempt to the RemoteApi account, aka HMCCU-154. This leads to automatic login as admin...
CVE-2019-10120
The CVE-2019-10120 issue affects eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, where an active session ID can be reused after logout to enable automatic login (setAutoLogin). This is caused by session handling that does not invalidate the session on logout. Affected v...
CVE-2019-10120
On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration aka setAutoLogin can be achieved by continuing to use a session ID after a logout, aka HMCCU-154...
Description of the security update for the information disclosure vulnerability in Microsoft Visual Studio 2015 Update 3: July 9, 2019
None None...
OpenCats Cross-Site Scripting Vulnerability
OpenCats is an open source recruitment process management system. A cross-site scripting vulnerability exists in the lib/DocumentToText.php file in versions of OpenCats prior to 0.9.4-3. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attack...
Siemens SIMATIC SCALANCE M874-3 3G router
Binary data 764591.prm...
Siemens SCALANCE XM400 Layer 3 Key-Plug
Binary data 764608.prm...
Siemens SIMATIC SCALANCE M874-3 3G router
Binary data 764590.prm...
Siemens SIMATIC SCALANCE M876-3 3G router
Binary data 764593.prm...
openSUSE Security Update : phpMyAdmin (openSUSE-2019-1689)
This update for phpMyAdmin fixes the following issues : phpMyAdmin was updated to 4.9.0.1 : - Several issues with SYSTEM VERSIONING tables - Fixed json encode error in export - Fixed JavaScript events not activating on input sql bookmark issue - Show Designer combo boxes when adding a constraint ...