CVE-2017-14349

CVE-2017-14349 affects HPE SiteScope versions 11.2x and 11.3x. The issue allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data. The vulnerability’s root cause is described as an authentication weakness enabling broader read access; exploitati...

CVE-2017-13985

The CVE-2017-13985 issue affects HPE BSM Platform Application Performance Management System Health (versions 9.26, 9.30, 9.40). The vulnerability is a path traversal/authentication flaw in the Email Servlet that leads to information disclosure. The ZDI advisory notes that exploitation requires au...

The software of the remote monitoring system Advantech WebAccess is vulnerable, as a lack of measures to protect the structure of the web page during authentication allows a intruder to inject any desired web script or HTML code.

The software of the remote monitoring system Advantech WebAccess is vulnerable because measures are not taken to protect the structure of the web page during authentication cross-site scripting attacks. Exploiting this vulnerability allows a malicious actor to inject arbitrary web scripts or HTML...

The vulnerability of the authentication module of the Cisco Identity Services Engine allows a hacker to gain Super Admin privileges for the ISE Admin portal.

The vulnerability of the Cisco Identity Services Engine’s authentication module arises from incorrect processing of authentication requests and improper determination of security policies for users who have passed the verification. Exploiting this vulnerability can allow a malicious actor,...

Multiple DenyAll Product Authentication Vulnerabilities

DenyAll i-Suite LTS and others are Web firewall products from DenyAll France. An authentication vulnerability exists in several DenyAll products. A remote attacker can exploit this vulnerability by sending a typeOf=debug request to the /webservices/download/index.php file and reading the iToken...

LDAP Injection Vulnerability in Joomla!

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. Joomla! 3.7.5 and previous versions of the system in the case of open LDAP authentication injection vulnerability, the vulnerability stems from the LDAP validation used ldapsearch...

FreeRDP Remote Code Execution Vulnerability

FreeRDP is a is a FreeRDP team developed a Windows, OSX and Linux platform based on the free, open source implementation of the Remote Desktop Protocol RDP. A remote code execution vulnerability exists in the authentication feature in FreeRDP 2.0.0-beta1+android1. A remote attacker could exploit...

Cross site request forgery (csrf)

IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sharing to cease through the use of cross-site request forgery. IBM X-Force ID: 111895...

SUSE-SU-2017:2267-1 Security update for jabberd

This update for jabberd fixes the following issues: - CVE-2017-10807: SASLANONYMOUS authentication method allowed anyone to authentication even if option was disabled bsc1047282...

SUSE-SU-2017:2200-1 Security update for subversion

This update for subversion fixes the following issues: - CVE-2017-9800: A malicious, compromised server or MITM may cause svn client to execute arbitrary commands by sending repository content with svn:externals definitions pointing to crafted svn+ssh URLs. bsc1051362 - Malicious user may commit...

Authentication flaw

A vulnerability in the authentication module of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass local authentication. The vulnerability is due to improper handling of authentication requests and policy assignment for externally authenticated users. An...

Default credentials

DISPUTED An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. This hashing algorithm can be cracked relatively easily. An attacker will likely be able to crack the password using offline cracker...

CVE-2017-9857

An issue was discovered in SMA Solar Technology products. The SMAdata2+ communication protocol does not properly use authentication with encryption: it is vulnerable to man in the middle, packet injection, and replay attacks. Any setting change, authentication packet, scouting packet, etc. can be...

Moderate: Red Hat Security Advisory: pki-core security update

An update for pki-core is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

UBUNTU-CVE-2017-2834

An exploitable code execution vulnerability exists in the authentication functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middle...

JVN#48823557: Multiple Buffalo wireless LAN access point devices do not properly perform authentication

WAPM-1166D and WAPM-APG600H provided by BUFFALO INC. are wireless LAN access point devices. WAPM-1166D and WAPM-APG600H do not properly perform authentication CWE-287. Impact An attacker who can access the device may log in via telnet without authentication and access the configuration interface ...

IBM Emptoris Strategic Supply Management Platform Denial of Service Vulnerability

IBM Emptoris Strategic Supply Management is a common Web-based portal access to the Emptoris suite of products management platform from IBM. A security vulnerability exists in the authentication feature in IBM Emptoris Strategic Supply Management versions 10.0.0.x through 10.1.1.x. The...

CVE-2017-1000069

CSRF in Bitly oauth2proxy 2.1 during authentication flow...

CVE-2017-6722

A vulnerability in the Extensible Messaging and Presence Protocol XMPP service of Cisco Unified Contact Center Express UCCx could allow an unauthenticated, remote attacker to masquerade as a legitimate user, aka a Clear Text Authentication Vulnerability. More Information: CSCuw86638. Known Affect...

BSA-2017-316

Security Advisory ID : BSA-2017-316 Component : SNMP Revision : 1.0: Interim In SNMP version 1 & 2 authentication should only accept the value stored in the SNMP agent authentication mechanism. With this vulnerability an attacker can use any value string or integer in order to authenticate the SN...