Lenovo Patches Arbitrary Code Execution Flaw

Lenovo issued a pair of security advisories on Friday for its popular ThinkPad line and System x servers. One bug is tied to an authentication flaw in the Secure Boot process; and the other to a vulnerability that would allow for arbitrary code execution. The company’s internal testing team...

CVE-2017-3775

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code...

Authentication flaw

Philips Brilliance CT software Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and Brilliance CT Big Bore 2.3.5 and prior contains fixed credentials, such as a password or cryptographic key, which it uses for its own inbou...

Authentication flaw

A vulnerability in Central Web Authentication CWA with FlexConnect Access Points APs for Cisco Aironet 1560, 1810, 1810w, 1815, 1830, 1850, 2800, and 3800 Series APs could allow an authenticated, adjacent attacker to bypass a configured FlexConnect access control list ACL. The vulnerability is du...

Authentication flaw

A vulnerability in Web Authentication WebAuth clients for the Cisco Wireless LAN Controller WLC and Aironet Access Points running Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass authentication and pass traffic. The vulnerability is due to incorrect implementation of...

Authentication flaw

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentication handling by the native Access Point web UI allows authentication using a local system account instead of the dedicated web-only user...

Authentication Flaw Vulnerability in CMS Made Simple Version 2.2.7

CMS Made Simple is an open source content management system. It is built using PHP and Smarty Engine , which separates content , functionality and templates . CMS Made Simple version 2.2.7 suffers from an authentication flaw vulnerability, which can be exploited by an attacker to elevate an...

Authentication flaw

The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be compromised or bypassed, which may allow a nearby attacker to issue unauthorized commands to the pacemaker via RF communications. CVSS v3...

Design/Logic Flaw

In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master...

Authentication flaw

The ActiveMQ admin user interface in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote attackers to bypass authentication by leveraging knowledge of the port number and webapp path. IBM X-Force ID: 92259...

Authentication flaw

Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard database via unspecified vectors...

Authentication flaw

Cybozu Garoon 3.5.0 to 4.6.1 allows remote authenticated attackers to bypass access restriction to view the closed title of "Cabinet" via unspecified vectors...

Authentication flaw

Cybozu Garoon 4.0.0 to 4.6.0 allows remote authenticated attackers to bypass access restriction to view the closed title of "Space" via unspecified vectors...

Authentication flaw

Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authentication via unspecified vectors...

ATI Systems Emergency Mass Notification Systems False Alert Vulnerability

ATI Systems designs, builds and installs mass notification systems for the community, campus, industrial and military markets.Emergency Mass Notification Systems is an emergency mass notification system. ATI Systems Emergency Mass Notification Systems Unauthorized Operation Vulnerability An...

The vulnerability of the microprogramming software of the TIM 1531 IRC communication module, related to authentication errors, allows a perpetrator to gain access to the device with administrator privileges.

The vulnerability of the microprogramming software for the TIM 1531 IRC communication module is related to the improper implementation of the authentication algorithm. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device with administrator...

Authentication flaw

Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors...

Authentication flaw

The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication...

Authentication flaw

An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves a JavaScriptCore...

SUSE-SU-2018:0844-1 Security update for python-paramiko

This update for python-paramiko fixes the following issues: - CVE-2018-7750: Fixed transport.py in the SSH server implementation of Paramiko that does not properly check whether authentication is completed before processing other requests bsc1085276...