PT-2017-3115

Name of the Vulnerable Software and Affected Versions Schneider Electric InduSoft Web Studio versions 8.0 SP2 and earlier Schneider Electric InTouch Machine Edition versions 8.0 SP2 and earlier Description A Missing Authentication for Critical Function issue allows a remote entity to bypass serve...

D-Link DIR Router Missing Authentication Check

The remote D-Link DIR router does not enforce authentication when a remote user requests registersend.php. An attacker can use this weakness to recover the administrator password. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid103219; scriptversion"1.5";...

CVE-2017-1002008: Unrestricted Upload of File with Dangerous Type

Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges...

CVE-2017-14417: Missing Authentication for Critical Function

registersend.php on D-Link DIR-850L REV. B with firmware through FW208WWb02 devices does not require authentication, which can result in unintended enrollment in mydlink Cloud Services...

CVE-2017-12733

A Missing Authentication for Critical Function issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles with the following software versions: older than V175, V175-V189, V191-V195, and V16Q3.1. An attacker may crea...

Authentication flaw

A Missing Authentication for Critical Function issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles with the following software versions: older than V175, V175-V189, V191-V195, and V16Q3.1. An attacker may crea...

CVE-2017-12733

CVE-2017-12733 affects OPW Fuel Management Systems SiteSentinel Integra 100, Integra 500, and SiteSentinel iSite ATG consoles with firmware older than V175, V175–V189, V191–V195, and V16Q3.1. The vulnerability arises from Missing Authentication for a Critical Function, allowing an attacker to cre...

CVE-2017-12733: Missing Authentication for Critical Function

A Missing Authentication for Critical Function issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles with the following software versions: older than V175, V175-V189, V191-V195, and V16Q3.1. An attacker may crea...

PT-2017-12671

Name of the Vulnerable Software and Affected Versions OPW Fuel Management Systems SiteSentinel Integra 100 versions older than V175 OPW Fuel Management Systems SiteSentinel Integra 100 versions V175 through V189 OPW Fuel Management Systems SiteSentinel Integra 100 versions V191 through V195 OPW...

CVE-2017-12440: Missing Authentication for Critical Function

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust ID...

CVE-2017-6872: Missing Authentication for Critical Function

A vulnerability was discovered in Siemens OZW672 all versions and OZW772 all versions that could allow an attacker with access to port 21/tcp to access or alter historical measurement data stored on the device...

CVE-2017-6873: Missing Authentication for Critical Function

A vulnerability was discovered in Siemens OZW672 all versions and OZW772 all versions that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle MITM attack on the integrated web server on port 443/tcp...

CVE-2017-4919: Missing Authentication for Critical Function

VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate...

Oracle MICROS POS missing authorisation check

Application: Oracle MICROS POS Versions Affected: Oracle Hospitality Simphony 2.7-2.9 Vendor URL: Oracle Bug: Missing Authentication for Critical Function Reported: 21.07.2017 Vendor response: 22.07.2017 Date of Public Advisory: 17.01.2018 Reference: Oracle CPU January 2018 Author: Dmitry Chastuh...

Junos OS Elevation of Privilege Vulnerability in Multiple Juniper Products

Juniper QFX5110 series and others are products of Juniper Networks, Inc. The QFX5110 series is a series of Ethernet switches; the Juniper vSRX series is a series of firewall emulator products; and the SRX1500 series is a series of firewall appliances. Junos OS is one of the operating systems. A...

Siemens OZW672 and OZW772

CVSS v3 7.4 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: OZW672 and OZW772 Vulnerabilities: Missing Authentication AFFECTED PRODUCTS Siemens reports that the vulnerability affects the following OZW672 and OZW772 devices for monitoring building controller...

HP SiteScope Multiple Vulnerabilities

HP SiteScope is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:hp:sitescope"; ifdescription...

CVE-2016-10364: Missing Authentication for Critical Function

With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions...

HPE SiteScope contains multiple vulnerabilities

Overview HPE's SiteScope is vulnerable to several cryptographic issues, insufficiently protected credentials, and missing authentication. Description HPE's SiteScope is vulnerable to several vulnerabilities. The researcher reports that version 11.31.461 is affected; other versions may also be...

CVE-2016-7830: Missing Authentication for Critical Function

Sony PCS-XG100, PCS-XG100S, PCS-XG100C, PCS-XG77, PCS-XG77S, PCS-XG77C devices with firmware versions prior to Ver.1.51 and PCS-XC1 devices with firmware version prior to Ver.1.22 allow an attacker on the same network segment to bypass authentication to perform administrative operations via...