CVE-2022-30245

Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller configuration without the...

CVE-2022-30245: Externally Controlled Reference to a Resource in Another Sphere

Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller configuration without the...

[SECURITY] Fedora 36 Update: ignition-2.14.0-2.fc36

Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files regular files, systemd units, etc., and configuring users. On first boot, Ignition reads its configuration from a source of truth remote URL, network...

Honeywell Modbus TCP Configuration Alteration

The vulnerability of Honeywell Modbus TCP and Safety Builder controllers’ anti-disaster protection devices, such as Safety Manager and Honeywell Experion PKS programmable logic controllers, is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow an...

[SECURITY] Fedora 34 Update: ignition-2.14.0-1.fc34

Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files regular files, systemd units, etc., and configuring users. On first boot, Ignition reads its configuration from a source of truth remote URL, network...

[SECURITY] Fedora 36 Update: ignition-2.14.0-1.fc36

Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files regular files, systemd units, etc., and configuring users. On first boot, Ignition reads its configuration from a source of truth remote URL, network...

CVE-2021-46006

In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication...

CVE-2021-46378

DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download...

CVE-2021-46378

DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download...

CVE-2021-46378

DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download...

Design/Logic Flaw

DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download...

CVE-2021-46378

CVE-2021-46378 affects D-Link DIR-850/DIR850 ET850-1.08TRb03, with an incorrect access control vulnerability that allows an unauthenticated remote configuration download to retrieve or manipulate the device’s config. The root issue is an insecure access control/OBE pathway via the remote config d...

CVE-2021-46378: Direct Request

DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download...

D-Link DIR850 ET850-1.08TRb03 security vulnerabilities

The D-Link DIR850 ET850-1.08TRb03 is a router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DIR850 ET850-1.08TRb03 that stems from DLink DIR850 ET850-1.08TRb03 is affected by a False Access Control Vulnerability via unauthenticated remote configuration download...

CVE-2021-21965

A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network packets can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2021-21965: Improper Access Control

A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network packets can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability...

Numando: A New Banking Trojan Targeting Latin American Users

A newly spotted banking trojan has been caught leveraging legitimate platforms like YouTube and Pastebin to store its encrypted, remote configuration and commandeer infected Windows systems, making it the latest to join the long list of malware targeting Latin America LATAM after Guildma, Javali,...

NTP < 4.2.8p3 DoS Vulnerability

Under limited and specific circumstances an attacker can send a crafted packet to cause a vulnerable ntpd instance to crash. This requires each of the following to be true: - ntpd set up to allow for remote configuration not allowed by default, and - knowledge of the configuration password, and -...

CVE-2021-1392

A vulnerability in the CLI command permissions of Cisco IOS and Cisco IOS XE Software could allow an authenticated, local attacker to retrieve the password for Common Industrial Protocol CIP and then remotely configure the device as an administrative user. This vulnerability exists because...

CVE-2021-1392: Insufficiently Protected Credentials

A vulnerability in the CLI command permissions of Cisco IOS and Cisco IOS XE Software could allow an authenticated, local attacker to retrieve the password for Common Industrial Protocol CIP and then remotely configure the device as an administrative user. This vulnerability exists because...