Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Improper Authentication (CVE-2018-1738)

Summary IBM Security Key Lifecycle Manager could allow an authenticated user to obtain highly sensitive information or jeopardize system integrity due to improper authentication mechanisms. Vulnerability Details CVEID: CVE-2018-1738 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow an...

CVE-2018-8852

Philips e-Alert Unit non-medical device, Version R2.1 and prior. When authenticating a user or otherwise establishing a new user session, the software gives an attacker the opportunity to steal authenticated sessions without invalidating any existing session identifier...

OpenAFS has an unspecified vulnerability

OpenAFS is a distributed file system that allows sharing of archives and resources between systems over LANs and WANs. A security vulnerability exists in OpenAFS versions prior to 1.6.23 and 1.8.x prior to 1.8.2, which stems from the backup tape controller process not requiring authentication for...

CVE-2018-17008

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for wireless wlanhost2g power...

RHEL 7 : ceph (RHSA-2016:1384)

An updated ceph package that fixes one security issue is now available for Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Cross site request forgery (csrf)

Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery CSRF in awx/api/authentication.py. An attacker could exploit this by tricking already authenticated users into visiting a malicious site and hijacking the authtoken cookie...

CVE-2018-10884

CVE-2018-10884 affects Ansible Tower before 3.1.8 and before 3.2.6, where a CSRF flaw in awx/api/authentication.py allows an attacker to trick authenticated users into visiting a malicious page and hijack the authtoken cookie. Evidence from multiple sources confirms the vulnerable versions and th...

Apache Tomcat Native Authentication Vulnerability

Apache Tomcat is the United States Apache Apache Software Foundation under the Jakarta project of a lightweight Web application server , it is mainly used for the development and debugging of JSP programs for small and medium-sized systems.Apache Tomcat Native is a support for the use of native...

Apache Tomcat Native Authentication Vulnerability (CNVD-2018-15547)

Apache Tomcat is the United States Apache Apache Software Foundation under the Jakarta project of a lightweight Web application server , it is mainly used for the development and debugging of JSP programs for small and medium-sized systems.Apache Tomcat Native is a support for the use of native...

Users without Overall/Read permission can have Jenkins reset parts of global configuration on the next restart

Unauthenticated users could provide maliciously crafted login credentials that cause Jenkins to move the config.xml file from the Jenkins home directory. This configuration file contains basic configuration of Jenkins, including the selected security realm and authorization strategy. If Jenkins i...

CVE-2018-13862

Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 FW 303 allow unauthorized remote attackers to reset the authentication via the "/xml/system/setAttribute.xml" URL, using the GET request "?id=0&attr=protectAccess&newValue=0" a successful attack will allow attackers to...

CVE-2016-9499

Accellion FTP server prior to version FTA912220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them...

CVE-2016-6544

CVE-2016-6544 affects iTrack Easy and concerns a missing authentication for a critical function: the getgps data can be modified by setting the parameter cmd:setothergps, enabling an unauthenticated attacker to alter GPS data of a lost device. The connected documents confirm the root cause is lac...

Hacker Sold Stolen U.S. Military Drone Documents On Dark Web For Just $200

You never know what you will find on the hidden Internet 'Dark Web.' Just about an hour ago we reported about someone selling remote access linked to security systems at a major International airport for $10. It has been reported that a hacker was found selling sensitive US Air Force documents on...

CVE-2018-7782

In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view passwords in clear text...

Unspecified Vulnerability in Instant Update CMS

Instant Update CMS is an open source content management system CMS based on the NO template engine. A security vulnerability exists in the /iu-application/controllers/administration/auth.php file in Instant Update CMS. An attacker can exploit the vulnerability to take control of an account...

CVE-2018-9024

CVE-2018-9024 concerns CA Privileged Access Manager 2.x where an improper authentication flaw allows an attacker to spoof IP addresses in a log file. The CNVD entry attributes the issue to the program failing to perform authentication properly, enabling IP impersonation. Other connected documents...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Improper Authentication Vulnerability (CVE-2016-0241)

Summary IBM Security Guardium Database Activity Monitor could allow a local attacker to bypass security authorization and masquerade as the administrator by manipulating the HTTP login request. Vulnerability Details CVEID: CVE-2016-0241 DESCRIPTION: IBM Security Guardium Database Activity Monitor...

Hikvision hik-connect.com Authentication Vulnerability

Hikvision is a provider of video-centric IoT solutions. An authentication vulnerability exists in Hikvision hik-connect.com. An attacker can exploit the vulnerability to change a cookie value to another person's user ID will result in logging in as that user...

CVE-2005-1758

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/imap/novellnetmailauth.rb 2025-10-23 21:12:55+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7 2026-09-08 06:52:05+00:00| seen|...