Authentication flaw

The standard access path of the IntelliBridge EC 40 and 60 Hub C.00.04 and prior requires authentication, but the product has an alternate path or channel that does not require authentication...

CVE-2021-33017 Philips IntelliBridge EC 40 and EC 80 Hub Authentication Bypass Using an Alternate Path or Channel

The standard access path of the IntelliBridge EC 40 and 60 Hub C.00.04 and prior requires authentication, but the product has an alternate path or channel that does not require authentication...

CVE-2021-33017

CVE-2021-33017 affects Philips IntelliBridge EC40 Hub (C.00.04 and prior) and EC80 Hub, exposing an authentication bypass via an alternate path or channel that does not require authentication. The ICS-CISA advisory documents an authentication bypass vulnerability (CWE-288) with CVSS v3 base score...

CVE-2021-32993

The CVE-2021-32993 issue affects Philips IntelliBridge EC 40 Hub (C.00.04 and prior) and EC 80 Hub (C.00.04 and prior). The vulnerability arises from hard-coded credentials used for inbound authentication, outbound communication to external components, or encryption of internal data (CWE-798). Re...

PT-2021-20021

Name of the Vulnerable Software and Affected Versions IntelliBridge EC 40 and 60 Hub versions C.00.04 and prior Description The issue concerns an alternate path or channel in the product that does not require authentication, despite the standard access path requiring authentication. Recommendatio...

PT-2021-20011

Name of the Vulnerable Software and Affected Versions IntelliBridge EC 40 and 60 Hub versions C.00.04 and prior Description The issue concerns hard-coded credentials, such as a password or a cryptographic key, used for inbound authentication, outbound communication to external components, or...

CVE-2021-33017: Authentication Bypass Using an Alternate Path or Channel

The standard access path of the IntelliBridge EC 40 and 60 Hub C.00.04 and prior requires authentication, but the product has an alternate path or channel that does not require authentication...

CVE-2021-32993: Use of Hard-coded Credentials

IntelliBridge EC 40 and 60 Hub C.00.04 and prior contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...

CVE-2021-21875

A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2021-21875

A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Cross site request forgery (csrf)

A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2021-21875

A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2021-21875

Lantronix PremierWave 2050 has OS command injection vulnerabilities in its Web Manager SSL Credential Upload feature. CVE-2021-21875 specifically allows authenticated attackers to inject commands via the EC keypasswd parameter, leading to arbitrary code execution with root privileges. The confirm...

CVE-2021-21875: Improper Neutralization of Special Elements used in an OS Command

A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

OpenSSL 3.0.0 < 3.0.1 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.1 advisory. - There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the...

GHSA-JC55-CRG7-PR35 EC-CUBE Improper access control in Management screen

Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...

EC-CUBE Improper access control in Management screen

Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...

CVE-2021-20841

Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...

CVE-2021-20842

Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...

CVE-2021-20842

Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...