CVE-2015-7323

The Secure Meeting Pulse Collaboration in Pulse Connect Secure formerly Juniper Junos Pulse before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 allows remote authenticated users to bypass intended access restrictions and log into arbitrary meetings by leveraging a meeting id and...

CVE-2015-7322

The Secure Meeting Pulse Collaboration in Pulse Connect Secure formerly Juniper Junos Pulse before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 provides different messages for attempts to join a meeting depending on the status of the meeting, which allows remote attackers to enumerate...

Design/Logic Flaw

The Secure Meeting Pulse Collaboration in Pulse Connect Secure formerly Juniper Junos Pulse before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 allows remote authenticated users to bypass intended access restrictions and log into arbitrary meetings by leveraging a meeting id and...

Code injection

The Secure Meeting Pulse Collaboration in Pulse Connect Secure formerly Juniper Junos Pulse before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 provides different messages for attempts to join a meeting depending on the status of the meeting, which allows remote attackers to enumerate...

CVE-2015-7323

CVE-2015-7323 affects Pulse Connect Secure’s Secure Meeting component. An authenticated user could bypass meeting authorization and join arbitrary meetings via a valid session/meetingAppSun.jar, effectively bypassing access controls to in-session meetings. The Ivanti advisory notes the issue requ...

CVE-2015-7323

The Secure Meeting Pulse Collaboration in Pulse Connect Secure formerly Juniper Junos Pulse before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 allows remote authenticated users to bypass intended access restrictions and log into arbitrary meetings by leveraging a meeting id and...

CVE-2015-7322

The Secure Meeting Pulse Collaboration in Pulse Connect Secure formerly Juniper Junos Pulse before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 provides different messages for attempts to join a meeting depending on the status of the meeting, which allows remote attackers to enumerate...

CVE-2015-7322

The CVE-2015-7322 issue affects Pulse Connect Secure’s Secure Meeting (Pulse Collaboration). Affected releases expose different join-meeting messages based on meeting status, enabling remote attackers to enumerate valid meeting IDs by issuing a sequence of requests. This is an information-disclos...

Pulse Connect Secure Legitimate Conference ID Number Disclosure Vulnerability

Pulse Connect Secure is an SSL-based VPN for businesses. Pulse Connect Secure has a security vulnerability that allows remote users to submit special requests to determine the ID number of a legitimate process session...

Pulse Connect Secure Secure Meeting Component Access Control Vulnerability

Pulse Connect Secure is an SSL-based VPN for businesses. Access control exists for the Pulse Connect Secure Secure Meeting component, allowing an attacker to exploit a vulnerability to join a meeting unauthorized...

Junos Pulse Secure Meeting 8.0.5 Access Bypass Vulnerability

Junos Pulse Secure Meeting version 8.0.5 allows an attacker to enter "secure" meetings without knowledge of the password and the invitation link using the java fat client meetingAppSun.jar. Vulnerablity Title ================== Secure Meeting Pulse Collaboration issue may allow authenticated user...

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise Absolute Path Traversal Vulnerability

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise are both products of General Electric Company GE, U.S.A. GE Digital Energy MDS PulseNET is a suite of software applications for monitoring and controlling industrial communication network devices. Enterprise is an enterprise version of MD...

CVE-2015-2908

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server...

Hardcoded credentials

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH credentials, which makes it easier for remote attackers to obtain access by leveraging knowledge of the required username and password...

Information disclosure

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private...

CVE-2015-2907

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH credentials, which makes it easier for remote attackers to obtain access by leveraging knowledge of the required username and password...

CVE-2015-2906

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private...

CVE-2015-2908

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server...

CVE-2015-2906

CVE-2015-2906 affects Mobile Devices (MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x. The root issue is that SSH private keys are identical across customer installations, allowing a remote attacker to leverage a known key to gain access to other installations. According to SUSE and CERT/CC-re...

CVE-2015-2907

CVE-2015-2907 concerns the Mobile Devices (MDI) C4 OBD-II dongle family (firmware 2.x–3.4.x). The root cause is hard-coded SSH credentials (username/password) that enable remote attackers to gain access to affected devices. Impact described across sources includes unauthorized remote access; CERT...