Authorization

Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser...

CVE-2020-14944

Global RADAR BSA Radar 1.6.7234.24750 and earlier exposes ChangePassword, SaveUserProfile, and GetUser without proper authorization, enabling manipulation and potential takeover of user accounts. Exploitation details in connected sources show a Cross-Site Request Forgery/authorization bypass enab...

CVE-2020-3360

A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected...

CVE-2020-3245

A vulnerability in the web application of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an unauthenticated, remote attacker to create arbitrary user accounts. The vulnerability is due to the lack of authorization controls in the web application. An attacker could exploit this...

CVE-2020-3245

The CVE-2020-3245 issue affects Cisco Smart Software Manager On-Prem (SSM On-Prem) in its web application. A lack of authorization controls allows an unauthenticated, remote attacker to craft HTTP requests that add arbitrary user accounts to the device configuration (these will not be admin or op...

CVE-2020-3245 Cisco Smart Software Manager On-Prem Improper Access Control Vulnerability

A vulnerability in the web application of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an unauthenticated, remote attacker to create arbitrary user accounts. The vulnerability is due to the lack of authorization controls in the web application. An attacker could exploit this...

CVE-2020-3360 Cisco IP Phones Series 7800 and Series 8800 Call Log Information Disclosure Vulnerability

A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected...

CVE-2020-3360 Cisco IP Phones Series 7800 and Series 8800 Call Log Information Disclosure Vulnerability

A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected...

Johnson Controls exacqVision (Update A)

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Exploitable remotely Vendor: Exacq Technologies, a subsidiary of Johnson Controls Equipment: exacqVision Vulnerability: Improper Verification of Cryptographic Signature 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

BIOTRONIK CardioMessenger II

1. EXECUTIVE SUMMARY CVSS v3 4.6 ATTENTION: Exploitable with adjacent access/low skill level to exploit Vendor: BIOTRONIK Equipment: CardioMessenger II-S T-Line, CardioMessenger II-S GSM Vulnerabilities: Improper Authentication, Cleartext Transmission of Sensitive Information, Missing Encryption...

ZSQL: Content of DV_HBA Database

This script writes the complete database of DVHBA to KB. Note: this script only stores information for other Policy Controls. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Zero Trust—Part 1: Networking

Enterprises used to be able to secure their corporate perimeters with traditional network controls and feel confident that they were keeping hackers out. However, in a mobile- and cloud-first world, in which the rate and the sophistication level of security attacks are increasing, they can no...

CVE-2020-13850

Artica Pandora FMS 7.44 has inadequate access controls on a web folder...

CVE-2020-13850

Artica Pandora FMS 7.44 has inadequate access controls on a web folder...

CVE-2020-13850

Artica Pandora FMS 7.44 has inadequate access controls on a web folder...

Trend Micro Guardian: Protecting Your Kids On-the-Go

Some smart devices are not limited to use on the home network; for instance, your child’s mobile phone or tablet. Keeping your kids safe on these on-the-go devices means extending your security policies beyond the home. Trend Micro Home Network Security HNS makes it easy with its complementary ap...

Microsoft SharePoint Remote Code Execution Vulnerability (CNVD-2020-64010)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

Brizy - Page Builder < 1.0.126 - Improper Access Controls on AJAX Calls

The plugin does not properly check for access controls on AJAX calls, resulting in authenticated user with low privileges being able to gain access to the editor functions...

CVE-2020-1181

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'...

CVE-2020-1181

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'...