2899 matches found
Authentication flaw
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1 web handler /DownloadFile does not require authentication to read arbitrary files from the system. IBM...
The vulnerability of the embedded web-server software module of the APC MGE SNMP/Web Card Transverse 66074 allows a intruder to modify the device’s settings.
The vulnerability of the embedded web-server-based microprogramming software module for managing uninterruptible power supplies, the APC MGE SNMP/Web Card Transverse 66074, is caused by authentication errors. Exploiting this vulnerability could allow a malicious actor to remotely alter device...
Authentication flaw
An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /goform/vpnBasicSettings do not require authentication. For example, when an HTTP POST request is made to /cgi-bin/ExportSettings.sh, the username, password, and...
Lenovo Patches Arbitrary Code Execution Flaw
Lenovo issued a pair of security advisories on Friday for its popular ThinkPad line and System x servers. One bug is tied to an authentication flaw in the Secure Boot process; and the other to a vulnerability that would allow for arbitrary code execution. The company’s internal testing team...
CVE-2017-3775
Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code...
Authentication flaw
Philips Brilliance CT software Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and Brilliance CT Big Bore 2.3.5 and prior contains fixed credentials, such as a password or cryptographic key, which it uses for its own inbou...
Authentication flaw
A vulnerability in Central Web Authentication CWA with FlexConnect Access Points APs for Cisco Aironet 1560, 1810, 1810w, 1815, 1830, 1850, 2800, and 3800 Series APs could allow an authenticated, adjacent attacker to bypass a configured FlexConnect access control list ACL. The vulnerability is du...
Authentication flaw
A vulnerability in Web Authentication WebAuth clients for the Cisco Wireless LAN Controller WLC and Aironet Access Points running Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass authentication and pass traffic. The vulnerability is due to incorrect implementation of...
Authentication flaw
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentication handling by the native Access Point web UI allows authentication using a local system account instead of the dedicated web-only user...
Authentication Flaw Vulnerability in CMS Made Simple Version 2.2.7
CMS Made Simple is an open source content management system. It is built using PHP and Smarty Engine , which separates content , functionality and templates . CMS Made Simple version 2.2.7 suffers from an authentication flaw vulnerability, which can be exploited by an attacker to elevate an...
Authentication flaw
The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be compromised or bypassed, which may allow a nearby attacker to issue unauthorized commands to the pacemaker via RF communications. CVSS v3...
Design/Logic Flaw
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master...
Authentication flaw
The ActiveMQ admin user interface in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote attackers to bypass authentication by leveraging knowledge of the port number and webapp path. IBM X-Force ID: 92259...
Authentication flaw
Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard database via unspecified vectors...
Authentication flaw
Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authentication via unspecified vectors...
Authentication flaw
Cybozu Garoon 3.5.0 to 4.6.1 allows remote authenticated attackers to bypass access restriction to view the closed title of "Cabinet" via unspecified vectors...
Authentication flaw
Cybozu Garoon 4.0.0 to 4.6.0 allows remote authenticated attackers to bypass access restriction to view the closed title of "Space" via unspecified vectors...
ATI Systems Emergency Mass Notification Systems False Alert Vulnerability
ATI Systems designs, builds and installs mass notification systems for the community, campus, industrial and military markets.Emergency Mass Notification Systems is an emergency mass notification system. ATI Systems Emergency Mass Notification Systems Unauthorized Operation Vulnerability An...
The vulnerability of the microprogramming software of the TIM 1531 IRC communication module, related to authentication errors, allows a perpetrator to gain access to the device with administrator privileges.
The vulnerability of the microprogramming software for the TIM 1531 IRC communication module is related to the improper implementation of the authentication algorithm. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device with administrator...