[security bulletin] HPSBGN02930 rev.1 - HP Intelligent Management Center(iMC) and HP IMC Service Operation Management Software Module, Remote Authentication Bypass, Disclosure of Information, Unauthorized Access, SQL Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03943547 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03943547 Version: 1 HPSBGN02930 rev....

Design/Logic Flaw

The CPRCTRANSACTIONCALLBYSET function in the Engineering Workbench component in SAP Production Planning and Control allows remote authenticated users to bypass intended transaction restrictions via unspecified vectors...

apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element...

Command injection

The restricted telnet shell on the D-Link DSL2730U router allows remote authenticated users to bypass intended command restrictions via shell metacharacters that follow a whitelisted command...

Tectia SSH Server Remote Authentication Bypass Exploit Published

UPDATE–Unix and Linux versions of Tectia SSH server as well as the open source versions of Free FTPD and FreeSSHD for Windows are vulnerable to a critical remote authentication bypass exploit published on the Free Disclosure List. The exploit, disclosed by the same researcher who reported a slew ...

freeFTPd 1.2.6 - Remote Authentication Bypass

freeFTPd 1.2.6 - Remote Authentication Bypass FreeFTPD all versions Remote System Level Exploit Zero-Day -- No username needed, straightforward rooting! Discovered & Exploited By Kingcope Year 2011 -- https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/23079.zip...

FreeSSHD Remote Authentication Bypass Zeroday Exploit

Exploit for windows platform in category remote exploits FreeSSHD all version Remote Authentication Bypass ZERODAY Discovered & Exploited by Kingcope Year 2011 http://www.exploit-db.com/sploits/23080.zip Run like: ssh.exe -l valid username might be: root admin administrator webadmin sysadmin...

freeFTPd 1.2.6 - Remote Authentication Bypass

FreeFTPD all versions Remote System Level Exploit Zero-Day -- No username needed, straightforward rooting! Discovered & Exploited By Kingcope Year 2011 -- https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23079.zip Example banner: WeOnlyDo-wodFTPD 2.3.6.165 This...

(SSH.com Communications) SSH Tectia (SSH 2.0-6.1.9.95 Tectia 6.1.9.95) - Remote Authentication Bypass

SSH.com Communications SSH Tectia SSH 2.0-6.1.9.95 Tectia 6.1.9.95 - Remote Authentication Bypass https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/23082.zip SSH Tectia Remote Authentication Bypass Tectia is the commercial OpenSSH solution. The product can be foun...

freeSSHd 2.1.3 - Remote Authentication Bypass

freeSSHd 2.1.3 - Remote Authentication Bypass FreeSSHD all version Remote Authentication Bypass ZERODAY Discovered & Exploited by Kingcope Year 2011 Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/23080.zip Run like: ssh.exe -l valid username...

freeSSHd 2.1.3 - Remote Authentication Bypass

FreeSSHD all version Remote Authentication Bypass ZERODAY Discovered & Exploited by Kingcope Year 2011 Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23080.zip Run like: ssh.exe -l valid username might be: root admin administrator webadmin...

(SSH.com Communications) SSH Tectia (SSH < 2.0-6.1.9.95 / Tectia 6.1.9.95) - Remote Authentication Bypass

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23082.zip SSH Tectia Remote Authentication Bypass Tectia is the commercial OpenSSH solution. The product can be found at: www.tectia.com An attacker in the possession of a valid username of an SSH Tectia installation...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, which allows remote attackers to bypass authentication by connecting with a SSL connection...

NGS00106 Technical Advisory: Increased exploitation of Oracle GlassFish Server Administration Console Remote Authentication Bypass Vulnerability

======= Summary ======= Name: Increased exploitation of Oracle GlassFish Server Administration Console Remote Authentication Bypass Vulnerability Release Date: 5 January 2012 Reference: NGS00106 Discoverer: David Spencer [email protected] Vendor: Oracle Vendor Reference: Systems Affecte...

Oracle GlassFish Server Administration Bypass

======= Summary ======= Name: Increased exploitation of Oracle GlassFish Server Administration Console Remote Authentication Bypass Vulnerability Release Date: 5 January 2012 Reference: NGS00106 Discoverer: David Spencer Vendor: Oracle Vendor Reference: Systems Affected: Oracle GlassFish Server 2...

PT-2011-4376 · Cisco · Cisco Asa +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliances ASA 5500 series devices versions 7.0 through 7.08.12 Cisco Adaptive Security Appliances ASA 5500 series devices versions 7.1 through 7.25.2 Cisco Adaptive Security Appliances ASA 5500 series devices versions...

JAKCMS PRO 2.2.5 Arbitrary File Upload

Exploit Title: JAKCMS PRO = 2.2.5 Remote Arbitrary File Upload Exploit Google Dork: "Powered By JAKCMS" Date: 21/09/2011 Author: EgiX Software Link: http://www.jakcms.com/ Version: 2.2.5 Tested on: Windows 7 and Debian 6.0.2 ?php / -------------------------------------------------------- JAKCMS P...

UBUNTU-CVE-2011-2907

Terascale Open-Source Resource and Queue Manager aka TORQUE Resource Manager 3.0.1 and earlier allows remote attackers to bypass host-based authentication and submit arbitrary jobs via a modified PBSOHOST variable to the qsub program...

H3C ER5100 - Authentication Bypass

source: https://www.securityfocus.com/bid/48384/info The H3C ER5100 is prone to a remote authentication-bypass vulnerability. Attackers can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. http://www.example.com:8080/home.asp?userLogin.asp...

CVE-2009-5077

CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHPSELF variable, which is not properly handled by 1 includes/applicationtop.php and 2 admin/includes/applicationtop.php...