CVE-2020-9208

There is an information leak vulnerability in iManager NetEco 6000 versions V600R021C00. A module is lack of authentication. Attackers without access to the module can exploit this vulnerability to obtain extra information, leading to information leak...

Apache Solr Remote Code Execution Vulnerability (CNVD-2020-57571)

Apache Solr is the United States Apache Apache Software Foundation of a Lucene a full-text search engine based on the search server . The product supports level search , vertical search , highlighting search results and so on. Apache Solr suffers from a remote code execution vulnerability that...

The vulnerability in the web interface of the Cisco Data Center Network Manager system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Web interface for controlling the Cisco Data Center Network Manager DCNM system is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected informatio...

GitLab Authentication Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An authentication vulnerability was discovered in GitLab...

CVE-2020-17475

Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP port 5000...

CVE-2020-17475

Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP port 5000...

CVE-2020-10930

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of URLs. The issue results from th...

CVE-2020-15391

The UI in DevSpace 4.13.0 allows web sites to execute actions on pods on behalf of a victim because of a lack of authentication for the WebSocket protocol. This leads to remote code execution...

The vulnerability of the Cisco Application Services Engine software component, which allows a hacker to alter event policies on a vulnerable device.

The vulnerability of the Cisco Application Services Engine software component is related to the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to alter event policies on the vulnerable device remotely...

Drobo 5N2 4.1.1 - Remote Command Injection

Exploit Title: Drobo 5N2 4.1.1 - Remote Command Injection Date: 2020-03-12 Exploit Author: Rick Ramgattie, Ian Sindermann Vendor Homepage: https://www.drobo.com/ Version: 4.1.1 and lower. CVE: CVE-2018-14709, CVE-2018-14701 !/usr/bin/env python3 nasty.py - A proof-of-concept utility for malicious...

Unspecified Vulnerability in CloudBees Jenkins

CloudBees Jenkins is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . There is a security vulnerability in...

The vulnerability in the implementation of the interaction protocol between the “ARM Reliezer” software and the “Communication Server” software of the EKRASMS-SP software suite allows a violator to modify the list of servers.

The vulnerability of the interaction protocol between the “ARM Rielshchika” software and the “Server Connect” software of the EKRASMS-SP suite lies in the absence of authentication in the mechanism for extending the list of servers. Exploiting this vulnerability allows a malicious actor to modify...

The vulnerability of the syntax analysis function of the PowerDNS server allows a attacker to cause a service failure.

The vulnerability of the DNS server’s syntax analysis function in PowerDNS is related to the lack of an authentication mechanism. Exploiting this vulnerability could allow a malicious actor to cause a service failure when searching for NS/A/AAAA records on the server...

CVE-2019-9529

The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the device...

CVE-2019-11019

Lack of authentication in case-exporting components in DDRT Dashcom Live through 2019-05-08 allows anyone to remotely access all claim details by visiting easily guessable exportpdf/allclaimdetail.php?claimid= URLs...

CVE-2019-11019

CVE-2019-11019 describes an authentication flaw in the DDRT Dashcom Live platform’s case-exporting components, allowing remote access to all claim details via easily guessable exportpdf/all_claim_detail.php?claim_id= URLs. The linked records consistently state a lack of authentication as the issu...

The vulnerability of the information protection system against unauthorized access: The Strife NT, due to the lack of authentication mechanisms in critical functions, allows attackers to gain access to the file system.

The vulnerability of the information protection system against unauthorized access in the Strife NT system is related to the absence of authentication mechanisms in critical functions. Exploiting this vulnerability allows a malicious actor, operating locally, to gain access to the file system by...

Smart Lock Turns Out to be Not So Smart, or Secure

Researchers are warning a keyless smart door lock made by U-tec, called Ultraloq, could allow attackers to track down where the device is being used and easily pick the lock – either virtually or physically. Ultraloq is a Bluetooth fingerprint and touchscreen door lock sold for about $200. It...

SUPRA Smart TV Flaw Lets Attackers Hijack Screens With Any Video

I have said it before, and I will say it again — Smart devices are one of the dumbest technologies, so far, when it comes to protecting users' privacy and security. As more and more smart devices are being sold worldwide, consumers should be aware of security and privacy risks associated with the...

Medtronic's Implantable Defibrillators Vulnerable to Life-Threatening Hacks

The U.S. Department of Homeland Security Thursday issued an advisory warning people of severe vulnerabilities in over a dozen heart defibrillators that could allow attackers to fully hijack them remotely, potentially putting lives of millions of patients at risk. Cardioverter Defibrillator is a...