Advantech WebAccess < 8.2_20170817 Multiple Vulnerabilities

Binary data scadaadvantechwebaccess8220170817.nbin...

PT-2017-13280

Name of the Vulnerable Software and Affected Versions FiberHome User End Routers version AN1020-25 Description An issue was discovered that could allow an attacker to easily restore a router to its factory settings by browsing to the "http://Default-Router-IP/restoreinfo.cgi" API endpoint and...

CVE-2017-14147: Improper Authentication

An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a router to its factory settings by simply browsing to the link http://Default-Router-IP/restoreinfo.cgi & execute it. Due to improper authentication on this page,...

CVE-2017-12213: Improper Authentication

A vulnerability in the dynamic access control list ACL feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches could allow an unauthenticated, adjacent attacker to cause dynamic ACL assignment to fail and the port to fail open. This could allow the attacker to pass traffic...

CVE-2015-3442: Improper Authentication

Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call...

CVE-2015-7225

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...

CVE-2017-14117: Improper Authentication

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01...

Huawei FusionSphere OpenStack Improper Authentication Vulnerability

Huawei FusionSphere OpenStack FSO is FusionSphere's cloud platform software for ICT scenarios. An improper authentication vulnerability exists in FusionSphere OpenStack, which can be successfully exploited by an attacker to perform additional operations by forging a rest message due to improper...

Huawei FusionSphere OpenStack Improper Authentication Vulnerability (CNVD-2017-30767)

Huawei FusionSphere OpenStack FSO is FusionSphere's cloud platform software for ICT scenarios. An improper authentication vulnerability exists in FusionSphere OpenStack. Due to improper authentication of the privileges of the accessing user, an attacker can perform additional operations after...

Authentication flaw

An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.220170817. Specially crafted requests allow a possible authentication bypass that could allow remote code execution...

CVE-2017-12698

An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.220170817. Specially crafted requests allow a possible authentication bypass that could allow remote code execution...

CVE-2017-12698

An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.220170817. Specially crafted requests allow a possible authentication bypass that could allow remote code execution...

CVE-2017-12698

CVE-2017-12698 affects Advantech WebAccess prior to V8.2_20170817. The vulnerability is an improper authentication bypass that could allow remote code execution. Public sources (NVD entry and ICS-CERT/Nessus plugin) confirm the issue and indicate that updating to WebAccess version V8.2_20170817 m...

CVE-2017-14032: Improper Authentication

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL...

Security Advisory - Two Vulnerabilities in The FusionSphere OpenStack

The FusionSphere OpenStack has a command injection vulnerability. Due to the insufficient input validation on one port, an authenticated, local attacker may exploit the vulnerability to gain root privileges by sending message with malicious commands. Vulnerability ID: HWPSIRT-2017-06001 This...

Security Advisory - Improper Authentication Vulnerability in The FusionSphere OpenStack

FusionSphere OpenStack has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message. Vulnerability ID: HWPSIRT-2017-06002 This vulnerability has...

ICSMA-17-241-01_Abbott Laboratories ' Accent/Anthem, Accent MRI, Assurity/Allure, and Assurity MRI Pacemaker Vulnerabilities

OVERVIEW MedSec Holdings Ltd has identified vulnerabilities in Abbott Laboratories’ formerly St. Jude Medical pacemakers. Abbott has produced a firmware patch to help mitigate the identified vulnerabilities in their pacemakers that utilize radio frequency RF communications. A third-party security...

Authentication flaw

Improper Authentication vulnerability in the "LDAP / SSO Authentication" igldapssoauth extension 2.0.0 for TYPO3...

CVE-2015-1401

Improper Authentication vulnerability in the "LDAP / SSO Authentication" igldapssoauth extension 2.0.0 for TYPO3...

CVE-2015-1401

CVE-2015-1401 affects TYPO3’s ig_ldap_sso_auth extension (v2.0.0). The vulnerability is an improper authentication/bypass issue due to insufficient authentication against LDAP/AD. Impact is evaluated as high to critical (CVSSv2 base 7.5; CVSSv3 base 9.8). Remedy: upgrade to 2.0.1 (or later) per T...