Design/Logic Flaw

eQ-3 Homematic Central Control Unit CCU2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory...

PT-2020-13281

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic Central Control Unit CCU versions 2 through 2.51.6 eQ-3 Homematic Central Control Unit CCU3 versions 3 through 3.51.6 Description The issue allows Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated...

CVE-2020-12834: Incorrect Default Permissions

eQ-3 Homematic Central Control Unit CCU2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory...

Authentication flaw

confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the autologin parameter...

PT-2020-7790

Name of the Vulnerable Software and Affected Versions: ATutor versions 2.2 and earlier Description: The issue allows remote attackers to bypass authentication and gain access as an existing user. This is achieved via the auto login parameter in the "confirm.php" file. Recommendations: For ATutor...

Nagios XI Cross-Site Scripting Vulnerability (CNVD-2019-23522)

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A cross-site scripting vulnerability exists in the Auto-Login administrator management page in Nagios XI...

CVE-2018-17147

Nagios XI before 5.5.4 has XSS in the auto login admin management page...

CVE-2018-17147

Nagios XI before 5.5.4 has XSS in the auto login admin management page...

CVE-2018-17147

Nagios XI before 5.5.4 has XSS in the auto login admin management page...

CVE-2018-17147

Nagios XI prior to version 5.5.4 contains a Cross-Site Scripting (XSS) vulnerability in the Auto-Login administrator management page. The root cause is described as insufficient validation of client-side data in the web application. Impact details in the provided sources indicate client-side code...

CVE-2018-17147: Improper Neutralization of Input During Web Page Generation

Nagios XI before 5.5.4 has XSS in the auto login admin management page...

CVE-2018-17146

A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page...

Auto Login URL - Less Critical - Access Bypass - DRUPAL-SA-CONTRIB-2017-034

This module lets you create auto login URLs programmatically on demand and through tokens. The module does not provide sufficient protection when generating login URLs. An attacker could rebuild login URLs independently thereby logging in as another user. This vulnerability is mitigated by the fa...

CVE-2017-6342: Improper Privilege Management

An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19. When SmartPSS Software is launched, while on the login screen, the software in the background automatically lo...

ATutor 2.2 Session Variable Overloading Vulnerability

ATutor versions 2.2 and below suffer from a session variable overloading vulnerability. ---------------------------------------------------------------------- ATutor = 2.2 confirm.php Session Variable Overloading Vulnerability ----------------------------------------------------------------------...

eFront 3.6.15.2 Cross Site Request Forgery

Advisory: Multiple CSRF vulnerabilities in eFront v. 3.6.15.2 CE Advisory ID: SROEADV-2015-09 Author: Steffen Rösemann Affected Software: eFront v. 3.6.15.2 CE Release-date: 05-Dec-2014, build 18021 Vendor URL: http://www.efrontlearning.net Vendor Status: patched CVE-ID: - Tested with/on: -Browse...

Pandora FMS SQL Injection Remote Code Execution Vulnerability

This Metasploit module attempts to exploit multiple issues in order to gain remote code execution under Pandora FMS versions equal to and prior to 5.0 SP2. First, an attempt to authenticate using default credentials is performed. If this method fails, a SQL injection vulnerability is leveraged in...

Bypassing Google Two Factor Authentication

Duo Security found a loophole in Google's authentication system that allowed them to Google's two factor authentication and gain full control over a user's Gmail account by abusing the unique passwords used to connect individual applications to Google accounts. Duo Security itself a two-factor...

Bypassing Google Two Factor Authentication

Duo Security found a loophole in Google's authentication system that allowed them to Google's two factor authentication and gain full control over a user's Gmail account by abusing the unique passwords used to connect individual applications to Google accounts. Duo Security itself a two-factor...

Researchers Bypass Google Two-Factor Authentication

For some time, attackers had the ability to bypass Google’s two-step authentication system through access to users’ app-specific passwords, giving them full access to victims’ Google accounts, including Gmail. The vulnerability that enables this attack, discovered by researchers from DuoSecurity,...