CVE-2019-12660

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to write values to the underlying memory of an affected device. The vulnerability is due to improper input validation and authorization of specific commands that a user can execute within the CLI. An...

DrayTek routers cross-site request forgery vulnerability

DrayTek routers are router products from DrayTek Taiwan, China. A cross-site request forgery vulnerability exists in versions of DrayTek routers prior to 2018-05-23. A remote attacker could exploit the vulnerability to change DNS or DHCP settings...

Design/Logic Flaw

TRENDnet TEW-827DRU with firmware up to and including 2.04B03 allows an unauthenticated attacker to execute setup wizard functionality, giving this attacker the ability to change configuration values, potentially leading to a denial of service. The request can be made on the local intranet or...

Darktrace Enterprise Immune System 3.0.9 / 3.0.10 Cross Site Request Forgery Vulnerability

Darktrace Enterprise Immune System versions 3.0.9 and 3.0.10 contain multiple cross site request forgery vulnerabilities. It is highly likely that older versions are affected as well, but this has not been confirmed. An attacker can whitelist domains and/or change core Darktrace configuration. 1 ...

Security Bulletin: IBM StoredIQ is affected by potential Host Header Injection (CVE-2019-4166)

Summary IBM StoredIQ is affected by potential Host Header Injection on StoredIQ Dataserver Vulnerability Details CVEID: CVE-2019-4166 DESCRIPTION: IBM StoredIQ could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a...

Sierra Wireless AirLink ES450 ACEManager upload.cgi Unverified Password Change Vulnerability

Summary An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password ...

CVE-2019-7392

An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gain sensitive information or alter configuration...

Security Bulletin: Vulnerabilities in SSLv3 and OpenSSL affect System x Integrated Management Module (IMM1) (CVE-2014-3566, CVE-2014-3568)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. This bulletin addresses the POODLE issue which affected the IMM1 as well as another issue in OpenSSL disclosed in October 2014. Vulnerability Details Abstract SSLv...

Authorization

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions...

CVE-2018-14666

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Satellite, independent of the organization the host belongs to. This flaw affects all Satellite 6 versions...

NUUO CMS Code Execution Vulnerability (CNVD-2018-24251)

NUUO CMS is a set of centralized software management platform from NUUO. The platform is used to centrally manage devices such as NVRs hard disk recorders and IP cameras, and provides functions such as user management and alarm management. A security vulnerability exists in NUUO CMS 3.3 and...

JVN#55263945: Multiple vulnerabilities in RICOH Interactive Whiteboard

RICOH Interactive Whiteboard provided by RICOH COMPANY, LTD. contains multiple vulnerabilities listed below. Command injection CWE-94 - CVE-2018-16184 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H| Base Score: 9.8 CVSS v2| AV:N/AC:L/AU:N/C:C/I:C/A:C| Bas...

CVE-2018-0681

Denbun by NEOJAPAN Inc. Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier uses hard-coded credentials, which may allow remote attackers to login to the Management page and change the configuration...

Hardcoded credentials

Denbun by NEOJAPAN Inc. Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier uses hard-coded credentials, which may allow remote attackers to login to the Management page and change the configuration...

CVE-2018-0681

Denbun by NEOJAPAN Inc. is affected (Denbun POP v3.3P R4.0 and earlier; Denbun IMAP v3.3I R4.0 and earlier). The issue is hard-coded credentials that may allow remote attackers to login to the Management page and modify configuration. This CVE is also listed with high/critical impact in sources t...

CVE-2018-0680

Denbun by NEOJAPAN Inc. Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier uses hard-coded credentials, which may allow remote attackers to read/send mail or change the configuration...

Multiple Roche Device Permission License and Access Control Vulnerabilities (CNVD-2018-25430)

The Roche Accu-Chek Inform II Instrument, among others, is a handheld blood testing medical device from Roche, Switzerland. A privilege-permission and access-control vulnerability exists in a number of Roche devices, which could be exploited by an attacker to change the configuration...

Unrestricted file upload

The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN Impact: An attacker once authenticated can change configurations, upload new configuration files, and upload executable co...

CVE-2018-5402

CVE-2018-5402 concerns the Auto‑Maskin DCU 210E, RP‑210E, and Marine Pro Observer Android App where the embedded web server transmits the administrator PIN in cleartext. The vulnerability allows an authenticated attacker to change configurations, upload new configuration files, and upload executa...

CVE-2018-10502

The vulnerability CVE-2018-10502 affects Samsung Galaxy Apps, where the staging mode handling allows a local attacker who can run low-privileged code to modify configuration based on a file’s presence in a user-controlled location, enabling privilege escalation to protected resources. A fix is av...