CVE-2014-0121: Improper Authentication

The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter...

CVE-2017-16684: Improper Authentication

SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does not perform authentication checks for functionalities that require user identity...

CVE-2017-17560: Improper Authentication

An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multiuploadify.php, provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file...

CVE-2017-16689: Improper Authentication

A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP KERNEL from 7.21 to 7.22, 7.45, 7.49, can be established to a different client or a different user on the same system, although no explicit Trusted/Trusting...

CVE-2017-17430: Improper Authentication

Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands via the web interface...

CVE-2017-17435: Improper Authentication

An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line without a valid PIN code. Even though the phone application requires it and there is a field to supply the PIN code in an authorization request,...

CVE-2017-14018

Affected product : Ethicon Endo-Surgery Generator Gen11 (all versions released before 2017-11-29). Vulnerability : Improper Authentication (CWE-287) where the security mechanism between Gen11 and single-patient use products can be bypassed, allowing unauthorized devices to connect and potentially...

CVE-2017-14018

An improper authentication issue was discovered in Johnson & Johnson Ethicon Endo-Surgery Generator Gen11, all versions released before November 29, 2017. The security authentication mechanism used between the Ethicon Endo-Surgery Generator Gen11 and single-patient use products can be bypassed,...

CVE-2017-14018: Improper Authentication

An improper authentication issue was discovered in Johnson & Johnson Ethicon Endo-Surgery Generator Gen11, all versions released before November 29, 2017. The security authentication mechanism used between the Ethicon Endo-Surgery Generator Gen11 and single-patient use products can be bypassed,...

PT-2017-13203

Name of the Vulnerable Software and Affected Versions Johnson & Johnson Ethicon Endo-Surgery Generator Gen11 versions prior to November 29, 2017 Description An issue with improper authentication was found, allowing the security authentication mechanism between the Ethicon Endo-Surgery Generator...

CVE-2017-10903

PTW-WMS1 firmware 2.000.012 has an improper authentication vulnerability (CVE-2017-10903) that lets remote attackers log in with root privileges and perform arbitrary operations via unspecified vectors. Affected product: Princeton PTW-WMS1 wireless storage; root cause is inadequate authentication...

Princeton PTW-WMS1 Improper Authentication Vulnerability

The Princeton PTW-WMS1 is a wireless storage device from Princeton Japan. A security vulnerability exists in the Princeton PTW-WMS1 using firmware version 2.000.012. A remote attacker can exploit the vulnerability to log in to the device with root privileges and perform arbitrary operations...

CRITICAL CODESYS VULNERABILITIES IN WAGO PFC 200 SERIES

VENDOR DESCRIPTION “The WAGO-I/O-SYSTEM is a flexible fieldbus-independent solution for decentralized automation tasks. With the relay, function and interface modules, as well as overvoltage protection, WAGO provides a suitable interface for any application.” Source:...

CVE-2017-10903: Improper Authentication

Improper authentication issue in PTW-WMS1 firmware version 2.000.012 allows remote attackers to log in to the device with root privileges and conduct arbitrary operations via unspecified vectors...

CVE-2017-16953: Improper Authentication

connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to modify the PPPoE configuration or set up a malicious configuration via a GET request...

Multiple vulnerabilities in Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1

Overview Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1 provided by Princeton Ltd. is a Wi-Fi storage. Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1 contains multiple vulnerabilities listed below. Improper Access Restriction CWE-284 - CVE-2017-10900 Buffer Overflow CWE-119 -...

Siemens SWT3000

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: SWT3000 Vulnerabilities: Improper Authentication, Authentication Bypass, Improper Input Validation. AFFECTED PRODUCTS Siemens reports that the vulnerabilities affect the following SWT 3000...

PT-2017-3355

Name of the Vulnerable Software and Affected Versions PTW-WMS1 firmware version 2.000.012 Description The issue is related to improper authentication in the firmware, allowing remote attackers to log in with root privileges and perform arbitrary operations. This can be exploited by an attacker to...

CVE-2017-13872: Improper Authentication

An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The issue involves the "Directory Utility" component. It allows attackers to obtain administrator access without a password via certain interactions involving entry of the root user...

Ethicon Endo-Surgery Generator G11 Vulnerability

OVERVIEW Johnson & Johnson, the parent company of Ethicon Endo-Surgery, LLC, reported an improper authentication vulnerability in the Ethicon Endo-Surgery Generator Gen11. EthiconEndo-Surgery, LLC has produced updates that mitigate this vulnerability in the affected product. AFFECTED PRODUCTS The...