223 matches found
CVE-2019-18342
CVE-2019-18342 affects Siemens/PKE Control Center Server (CCS). All versions prior to v1.5.0 are vulnerable. The CCS SFTP service on port 22 does not properly limit its capabilities to the intended function. In conjunction with CVE-2019-18341, an unauthenticated remote attacker with network acces...
CVE-2019-18338
CVE-2019-18338 describes a directory traversal vulnerability in Siemens/SiNVR CCS, affecting all versions before v1.5.0. The flaw exists in the XML-based communication protocol exposed by default on ports 5444/tcp and 5440/tcp, allowing an authenticated remote attacker with network access to list...
CVE-2019-18340
The CVE-2019-18340 vulnerability concerns weak cryptography used to store user and device passwords in both Siemens/ PKE SiNVR/SiVMS Video Server and the Control Center Server (CCS). A local attacker could extract passwords from the user database or device configuration files. Affected products i...
CVE-2019-18341
CVE-2019-18341 / 18342 (Siemens CCS) affects Control Center Server (CCS) with versions prior to 1.5.0. The SFTP service (default port 22) contains an authentication bypass (CVE-2019-18341) and, combined with CVE-2019-18342, an issue where capabilities are not properly limited, enabling an unauthe...
CVE-2019-13947
Summary (CVE-2019-13947) : In Siemens/SiNVR/CCS Control Center Server, versions prior to v1.5.0 expose a vulnerability where the web GUI transfers user passwords in clear text to the browser. An authenticated administrator can read other users’ passwords, not just reset them. The issue is documen...
CVE-2019-18337: Improper Authentication
A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The Control Center Server CCS contains an authentication bypass vulnerability in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. A remote attacker with network access ...
CVE-2019-13947: Cleartext Storage of Sensitive Information in GUI
A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The user configuration menu in the web interface of the Control Center Server CCS transfers user passwords in clear to the client browser. An attacker with administrative privileges for the web interface could b...
CVE-2019-13415
Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users can gain read access to data they are not authorized to see...
Cross site scripting
Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote clusters...
CVE-2019-13415
CVE-2019-13415 affects floragunn Search Guard (pre-24.3) where Cross Cluster Search (CCS) enabled allows authenticated users to read data they are not authorized to see. Root cause is an authorization issue in versions before 24.3; impact is unauthorized data exposure when CCS is used. Connected ...
CVE-2019-13415
Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users can gain read access to data they are not authorized to see...
CVE-2019-13416
Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote clusters...
CVE-2019-13416
CVE-2019-13416 affects floragunn Search Guard (Search Guard) prior to version 24.3. When Cross Cluster Search (CCS) is enabled, authenticated users can be authorized on the local cluster regardless of their roles on remote clusters, effectively bypassing remote-role checks. Affected component: Se...
Solaris 10 (sparc) : 148423-01
SunOS 5.10: /usr/ccs/bin/error patch. Date this patch was last updated by Sun : Feb/06/13 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...
Man-in-the-Middle (MitM)
OpenSSL is vulnerable to man in the middle MitM attacks. These attacks are possible because an attacker can force OpenSSL to use a zero-length master key. This allows attackers to hijack sessions and obtain sensitive information. This is also known as the "CCS Injection"...
MassBleed - Mass SSL Vulnerability Scanner
USAGE sh massbleed.sh CIDR|IP single|port|subnet port proxy ABOUT This script has four main functions with the ability to proxy all connections: 1. To mass scan any CIDR range for OpenSSL vulnerabilities via port 443/tcp https example: sh massbleed.sh 192.168.0.0/16 2. To scan any CIDR range for...
ccsdisabilityaction.org.nz XSS vulnerability
Vulnerable URL: http://www.ccsdisabilityaction.org.nz/regions/northern-region/support-in-your-area/early-intervention/192-case-studies-northern/early-intervention/562-galaxi-story? Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 17:49 GMT...
Whisper: CVE-2014-0224 openssl ccs vulnerability
your site is vulnerable to CVE-2014-0224 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL...
Oracle Solaris Third-Party Patch Update : wanboot (cve_2014_0224_cryptographic_issues)
The remote Solaris system is missing necessary patches to address security updates : - OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length...
F5 Networks BIG-IP : OpenSSL vulnerability (K15325)
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessio...