CVE-2020-27268

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass checks for default PINs via Bluetooth Low Energy...

CVE-2017-10709

The lockscreen on Elephone P9000 devices running Android 6.0 allows physically proximate attackers to bypass a wrong-PIN lockout feature by pressing backspace after each PIN guess...

Alibaba Cloud Linux 3 : 0026: opensc (ALINUX3-SA-2024:0026)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0026 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-40660: A flaw was found in OpenSC...

CBL Mariner 2.0 Security Update: opensc (CVE-2023-40660)

The version of opensc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-40660 advisory. - A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by...

Azure Linux 3.0 Security Update: opensc (CVE-2023-40660)

The version of opensc installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-40660 advisory. - A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by...

CVE-2024-52327

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed...

CVE-2024-52327

CVE-2024-52327 affects ECOVACS cloud service for robot lawnmowers/vacuums; authenticated attackers can bypass PIN to access live video feed. Documented in multiple feeds with CVSS metrics (AV:N/AC:L/PR:L/UI:N/S:U for CVSS 3.1, and related CS metrics). The connected sources confirm the vulnerabili...

CVE-2024-52327 ECOVACS lawnmower and vacuum cloud service live video PIN bypass

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed...

Debian dla-4004 : opensc - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4004 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4004-1 [email protected]...

PT-2024-8879

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 133 Description: The issue is related to the bypass of device PIN authentication, potentially allowing unauthorized access to protected information. On Android devices, Firefox may have inadvertently allowed viewing...

CVE-2023-51629

The CVE-2023-51629 entry concerns the D-Link DCS-8300LHV2 ONVIF API, where a hardcoded PIN in the configuration enables authentication bypass. The vulnerability affects the DCS-8300LHV2 IP camera and allows network-adjacent attackers to bypass authentication without user interaction. The issue is...

CentOS 9 : opensc-0.23.0-3.el9

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the opensc-0.23.0-3.el9 build changelog. - Potential PIN bypass CVE-2023-40660 - Dynamic analyzers reports in pkcs15init CVE-2023-40661 - Out-of-bounds read in MyEID driver handlin...

CVE-2023-6317 PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction

A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN. Full versions and TV models affected: webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA webOS 5.5.0 - 04.50.51...

PT-2024-21290 · Element · Element Android

Name of the Vulnerable Software and Affected Versions: Element Android versions 1.4.3 through 1.6.10 Description: The issue allows a third-party malicious application to start any internal activity by passing some extra parameters, potentially making Element Android display an arbitrary web page,...

CentOS 8 : opensc (CESA-2023:7876)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:7876 advisory. - A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographi...

Fedora 38 : opensc (2023-c7e4c9af51)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c7e4c9af51 advisory. New upstream release 2240701 with security fixes for CVE-2023-40660, CVE-2023-4535, CVE-2023-40661 Tenable has extracted the preceding description...

Nextcloud Authorization Issues Vulnerability

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An authorization issue vulnerability exists in versions prior to Nextcloud 4.9.2, which stems from a 4-digit PIN that does not need to be provided to allow...

AlmaLinux 9 : opensc (ALSA-2023:7879)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:7879 advisory. - A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic...

Fedora 39 : opensc (2023-a854153d7a)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-a854153d7a advisory. New upstream release 2240701 with security fixes for CVE-2023-40660, CVE-2023-4535, CVE-2023-40661 Tenable has extracted the preceding description...

AlmaLinux 8 : opensc (ALSA-2023:7876)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:7876 advisory. - A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic...