547 matches found
CVE-2020-35517
A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to create a device special file in the shared directory and use it to r/w access host devices...
The vulnerability of the CmtViewer application for controlling programmable panels stems from the use of a less secure encryption algorithm, allowing an attacker to gain full access to the device.
The vulnerability of the CmtViewer application for controlling programmable panels is related to the use of a less secure encryption algorithm. Exploiting this vulnerability allows a malicious actor, operating remotely, to intercept the data transmitted over the network, decrypt it, and gain full...
The vulnerability of the CmtViewer application, which manages programmable panels, stems from the lack of limits on authentication attempts. This allows a perpetrator to gain full access to the device.
The vulnerability of the CmtViewer application for controlling programmable panels is related to the lack of restrictions on the number of authentication attempts. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full access to the device...
Authentication flaw
An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device...
PT-2020-16337 · Rlx +1 · Rlx-Linux +1
Name of the Vulnerable Software and Affected Versions: Askey AP5100W Dual SIG versions 1.01.097 and all prior versions Description: The issue allows an attacker to gain unauthorized access as an admin or root user to the device Operating System via Telnet or SSH, due to a weak password used at th...
Authentication flaw
An authentication bypass in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with physical access to device hardware to obtain system information...
Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid
An out-of-bounds memory write issue was found in the way the Linux kernel's KVM hypervisor handled the 'KVMGETEMULATEDCPUID' ioctl2 request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulti...
CVE-2020-0394
In onCreate of BluetoothPairingDialog.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege and untrusted devices accessing contact lists with no additional execution privileges needed. User interaction is needed for...
Kernel: vfio: access to disabled MMIO space of some devices may lead to DoS scenario
A flaw was found in the Linux kernel, where it allows userspace processes, for example, a guest VM, to directly access h/w devices via its VFIO driver modules. The VFIO modules allow users to enable or disable access to the devices' MMIO memory address spaces. If a user attempts to access the...
Kernel: vfio: access to disabled MMIO space of some devices may lead to DoS scenario
A flaw was found in the Linux kernel, where it allows userspace processes, for example, a guest VM, to directly access h/w devices via its VFIO driver modules. The VFIO modules allow users to enable or disable access to the devices' MMIO memory address spaces. If a user attempts to access the...
The vulnerability of the software for configuring Schneider Electric Easergy Builder lies in the use of a less secure encryption algorithm, which allows an attacker to gain full access to the device.
The vulnerability of the Schneider Electric Easergy Builder software for configuring controllers is related to the use of a less secure encryption algorithm. Exploiting this vulnerability could allow an attacker to gain access to the user credentials of the device, thereby granting full control...
rConfig SQL Injection Vulnerability (CNVD-2020-38217)
rConfig is an open source network configuration management utility . A SQL injection vulnerability exists in rConfig 3.9.4 and earlier versions, which stems from the program storing node passwords in plaintext. An attacker can exploit this vulnerability to access a listened network device...
rConfig SQL Injection Vulnerability (CNVD-2020-38219)
rConfig is an open source network configuration management utility . A SQL injection vulnerability exists in rConfig 3.9.4 and earlier versions, which stems from the program storing node passwords in plaintext. An attacker can exploit this vulnerability to access a listened network device...
rConfig SQL Injection Vulnerability (CNVD-2020-38218)
rConfig is an open source network configuration management utility . A SQL injection vulnerability exists in rConfig 3.9.4 and earlier versions, which stems from the program storing node passwords in plaintext. An attacker can exploit this vulnerability to access a listened network device...
CVE-2020-10549
rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...
The vulnerability in the web-based administration interface of the PAN-OS operating system allows a hacker to gain access to the device.
The vulnerability of the PAN-OS operating system’s administrative web interface is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device...
CVE-2020-3125
A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to impersonate the Kerberos key distribution center KDC and bypass authentication on an affected device that is configured to perform Kerberos...
File Explorer v1.4 iOS - Multiple Persistent Vulnerabilities
Document Title: =============== File Explorer v1.4 iOS - Multiple Persistent Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2219 Release Date: ============= 2020-05-03 Vulnerability Laboratory ID VL-ID:...
EulerOS Virtualization for ARM 64 3.0.2.0 : glusterfs (EulerOS-SA-2020-1525)
According to the versions of the glusterfs packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in RPC request using gfs3renamereq in glusterfs server. An authenticated attacker could use this...
Security Bulletin: Sensitive Information Disclosed in Logs (CVE-2019-4286)
Summary IBM Maximo Anywhere discloses sensitive information such as usernames, passwords, session token and other cookies in device/console logs. Vulnerability Details CVEID: CVE-2019-4286 DESCRIPTION: IBM Maximo Anywhere could disclose highly senstiive user information to an authenticated user...