Authentication flaw

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated,...

PT-2019-10021

Name of the Vulnerable Software and Affected Versions: Teracue ENC-400 devices with firmware 2.56 and below Description: An issue was discovered where a large portion of the HTTP endpoints are missing authentication, allowing an attacker to view these pages before being authenticated. Some of the...

CVE-2018-20220: Missing Authentication for Critical Function

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated,...

CVE-2018-11787

Prior to Karaf 3.0.9, Karaf 4.0.9, and Karaf 4.1.1, HTTP endpoints published by Karaf features may also be published under the HTTP web root, in addition to the paths specifically configured by the installed feature. Authentication and access control rules may not cover this additional path,...