CVE-2020-17475

Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP port 5000...

PT-2020-15015

Name of the Vulnerable Software and Affected Versions MEGVII Koala version 2.9.1-c3s Description The issue is related to a lack of authentication in network relays, allowing attackers to send packet data to UDP port 5000 and grant physical access to unauthorized individuals. Recommendations For...

CVE-2020-10930

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of URLs. The issue results from th...

CVE-2020-15391

The UI in DevSpace 4.13.0 allows web sites to execute actions on pods on behalf of a victim because of a lack of authentication for the WebSocket protocol. This leads to remote code execution...

CVE-2020-15391

The UI in DevSpace 4.13.0 allows web sites to execute actions on pods on behalf of a victim because of a lack of authentication for the WebSocket protocol. This leads to remote code execution...

CVE-2020-10284: Reliance on Security Through Obscurity

No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a password to the robot but as in xarmstudio 1.3.0 the option is missing from the menu. Assuming manual control, even by forcefully removing the...

PT-2020-12031

Name of the Vulnerable Software and Affected Versions MAVLink version 1.0 Description The Micro Air Vehicle Link MAVLink protocol lacks an authentication mechanism in version 1.0, leading to potential attacks such as identity spoofing, unauthorized access, and PITM attacks. Version 2.0 optionally...

The vulnerability of the Cisco Application Services Engine software component, which allows a hacker to alter event policies on a vulnerable device.

The vulnerability of the Cisco Application Services Engine software component is related to the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to alter event policies on the vulnerable device remotely...

PT-2020-18771

Name of the Vulnerable Software and Affected Versions BIG-IQ versions 5.2.0 through 7.0.0 Description The high availability HA synchronization mechanisms in the affected software do not use any form of authentication for connecting to the peer. Recommendations For BIG-IQ versions 5.2.0 through...

PT-2020-12676

Name of the Vulnerable Software and Affected Versions Tata Sonata Smart SF Rush version 1.12 Description An issue has been identified where the smart band operates with no pairing, utilizing mode 0 Bluetooth LE security level. This results in unencrypted data transmission over the air. Furthermor...

Drobo 5N2 4.1.1 - Remote Command Injection

Exploit Title: Drobo 5N2 4.1.1 - Remote Command Injection Date: 2020-03-12 Exploit Author: Rick Ramgattie, Ian Sindermann Vendor Homepage: https://www.drobo.com/ Version: 4.1.1 and lower. CVE: CVE-2018-14709, CVE-2018-14701 !/usr/bin/env python3 nasty.py - A proof-of-concept utility for malicious...

PT-2020-8535

Name of the Vulnerable Software and Affected Versions: Drobo 5N2 version 4.0.5 Description: The issue is related to the lack of authentication/authorization validation in all optional applications. This allows any user who can access the device over the network to interact with and control these...

Unspecified Vulnerability in CloudBees Jenkins

CloudBees Jenkins is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . There is a security vulnerability in...

CVE-2013-4859: Incorrect Default Permissions

INSTEON Hub 2242-222 lacks Web and API authentication...

PT-2019-6977

Name of the Vulnerable Software and Affected Versions INSTEON Hub version 2242-222 Description The issue concerns a lack of Web and API authentication. Recommendations For version 2242-222, consider disabling Web and API access until a patch is available. Restrict access to the API endpoints to...

PT-2019-15737

Name of the Vulnerable Software and Affected Versions Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb version 9290022656 Description The issue allows remote users to control the bulb's operation due to an unprotected API. This enables anyone with network access to the bulb to turn it ...

The vulnerability in the implementation of the interaction protocol between the “ARM Reliezer” software and the “Communication Server” software of the EKRASMS-SP software suite allows a violator to modify the list of servers.

The vulnerability of the interaction protocol between the “ARM Rielshchika” software and the “Server Connect” software of the EKRASMS-SP suite lies in the absence of authentication in the mechanism for extending the list of servers. Exploiting this vulnerability allows a malicious actor to modify...

The vulnerability of the syntax analysis function of the PowerDNS server allows a attacker to cause a service failure.

The vulnerability of the DNS server’s syntax analysis function in PowerDNS is related to the lack of an authentication mechanism. Exploiting this vulnerability could allow a malicious actor to cause a service failure when searching for NS/A/AAAA records on the server...

CVE-2019-9529

The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the device...

PT-2019-3365

Name of the Vulnerable Software and Affected Versions Cisco IOS XE and Cisco IOS affected versions not specified Description The issue is related to a lack of authentication in the Layer 2 Traceroute utility of Cisco IOS XE and Cisco IOS operating systems. This could allow a remote attacker to...