Cross site request forgery (csrf)

The Comcast firmware on Cisco DPC3939B firmware version dpc3939b-v303r204217-150321a-CMCST devices allows configuration changes via CSRF...

Cross site request forgery (csrf)

The Comcast firmware on Arris TG1682G eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG16822.2p7s2PRODsey devices allows configuration changes via CSRF...

CVE-2017-9490

The Comcast firmware on Arris TG1682G eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG16822.2p7s2PRODsey devices allows configuration changes via CSRF...

CVE-2017-9490

The Comcast firmware on Arris TG1682G eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG16822.2p7s2PRODsey devices allows configuration changes via CSRF...

CVE-2017-9490

CVE-2017-9490 concerns the Comcast firmware in Arris TG1682G (eMTA&DOCSIS 10.0.132.SIP.PC20.CT; TG1682_2.2p7s2_PROD_sey). The connected CNVD entry describes a Cross-Site Request Forgery (CSRF) vulnerability that enables a remote attacker to change device configuration via the firmware. The issue ...

Televes COAXDATA GATEWAY 1Gbps Device Unauthorized Operation Vulnerability

The Televes COAXDATA GATEWAY 1Gbps devices is a wireless router device from the Spanish company Televes. A security vulnerability exists in the Televes COAXDATA GATEWAY 1Gbps devices that stems from a lack of access control for the backup/restore feature. An attacker could exploit the vulnerabili...

AWS Auditing & Hardening Tool: Zeus

Zeus is a powerful tool for AWS EC2 / S3 / CloudTrail / CloudWatch / KMS best hardening practices. It checks security settings according to the profiles the user creates and changes them to recommended settings based on the CIS AWS Benchmark source at request of the user. Identity and Access...

Cambium Networks ePMP Elevation of Privilege Vulnerability

Cambium Networks ePMP is a suite of wireless network access platforms from Cambium Networks, USA. The platform provides video surveillance, Wi-Fi hotspot and sensor connectivity. An elevation of privilege vulnerability exists in Cambium Networks ePMP that stems from a failure to properly restrict...

Input validation

An Improper Privilege Management issue was discovered in Cambium Networks ePMP. The privileges for SNMP community strings are not properly restricted, which may allow an attacker to gain access to sensitive information and possibly allow for configuration changes...

CVE-2017-7918

An Improper Access Control issue was discovered in Cambium Networks ePMP. After a valid user has used SNMP configuration export, an attacker is able to remotely trigger device configuration backups using specific MIBs. These backups lack proper access control and may allow access to sensitive...

CVE-2017-7922

An Improper Privilege Management issue was discovered in Cambium Networks ePMP. The privileges for SNMP community strings are not properly restricted, which may allow an attacker to gain access to sensitive information and possibly allow for configuration changes...

CVE-2017-7922

CVE-2017-7922 concerns Cambium Networks ePMP devices. The issue is an improper privilege management in SNMP where privileges for SNMP community strings are not properly restricted, potentially allowing an attacker to access sensitive information and possibly alter device configuration. Public dis...

CVE-2017-7922

An Improper Privilege Management issue was discovered in Cambium Networks ePMP. The privileges for SNMP community strings are not properly restricted, which may allow an attacker to gain access to sensitive information and possibly allow for configuration changes...

Cambium Networks ePMP

CVSS v3 7.6 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Cambium Networks Equipment: ePMP Vulnerabilities: Improper Access Control, Improper Privilege Management AFFECTED PRODUCTS Cambium reports that the vulnerabilities affect the following ePMP Network Access Control...

Jenkins CI Server Multiple Cross-Site Request Forgery (CVE-2017-1000356)

Multiple Cross-Site Request Forgery vulnerabilities exists in Jenkins CI. The vulnerabilities are due to a lack of CSRF protections on certain types of requests. A remote, unauthenticated attacker can exploit these vulnerabilities by enticing an authenticated user to click a maliciously crafted...

CVE-2017-8930

Multiple cross-site request forgery CSRF vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can 1 create new administrator user accounts and take over the entire application, 2 create regular user accounts, or 3 change...

Authentication flaw

A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges. The vulnerability is due to improper implementation of authentication for...

CVE-2017-3831

A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges. The vulnerability is due to improper implementation of authentication for...

Cross site request forgery (csrf)

An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. There is no CSRF Token generated to authenticate the user during a session. Successful exploitation of this vulnerability ca...

Design/Logic Flaw

An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. No authentication is configured by default. An unauthorized user can access the device management portal and make...