Huawei E5756S Authentication Bypass Vulnerability

The Huawei E5756S is a Unicom 3G Internet card device from Huawei China. A security vulnerability exists in the Huawei E5756S V100R001B100D00SP00C00 version, which stems from an imperfect WebUI interface authentication mechanism. The vulnerability can be exploited by a remote attacker to view the...

Information disclosure

The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges...

Dataprobe iBootBar Authorization Vulnerability

Dataprobe iBootBar is a remote power management solution from Dataprobe USA that provides serial ports, optional internal modem and DTMF audio dialing control. A security vulnerability exists in Dataprobe iBootBar using the 2007-09-20 beta firmware. A remote attacker can exploit this vulnerabilit...

CVE-2017-12421

NetApp Clustered Data ONTAP 8.3.x before 8.3.2P12 is affected by CVE-2017-12421. A remote authenticated attacker can execute arbitrary code on the storage controller via unspecified vectors. Impact is described as remote code execution with potential data exposure on affected ONTAP versions. Reme...

CVE-2014-8677

SO Planning (SOPlanning) 1.32 and earlier is vulnerable to multiple issues, including SQL injection, XSS and PHP code injection. Specifically, CVE-2014-8677 describes that remote authenticated users with a prepared database or the ability to create arbitrary databases, or PHP < 5.2 with an con...

CVE-2017-13670

In BlackCat CMS 1.2, CVE-2017-13670 describes a vulnerability where remote authenticated users can upload arbitrary files through the media/upload AJAX endpoint (backend/media/ajax_upload.php), demonstrated by a ZIP containing a PHP file. The available documents do not specify an exact exploit pa...

Red Hat Certificate Server Input Validation Vulnerability Vulnerability

Red Hat Certificate Server is an enterprise software system that provides an extensible security framework for establishing and maintaining trusted identities and keeping communications private. An input validation vulnerability vulnerability exists in Red Hat Certificate Server. Remotely...

Sql injection

SQL injection vulnerability in the Operation and Maintenance Unit OMU in Huawei VCN500 before V100R002C00SPC201 allows remote authenticated users to execute arbitrary SQL commands via a crafted HTTP request...

Code injection

Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to write to arbitrary files within the underlying operating system and consequently cause a denial of service or gain privileges by leveraging incorrect permission checking...

Default credentials

ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow user accounts to have multiple valid username and password pairs, which allows remote authenticated users to login to a target account via any of its username and password pairs...

Default credentials

ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin"...

CVE-2015-7258

CVE-2015-7258 affects ZTE ADSL ZXV10 W300 modems (W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57). The CNVD/NVD entries describe an information-disclosure flaw where remote authenticated users can obtain user passwords by displaying user information in a Telnet connection. The root cause detai...

SaltStack Salt Directory Traversal Vulnerability

SaltStack Salt aka SaltStack is a set of open source tools for managing infrastructure from SaltStack, Inc. in the United States. The tool provides configuration management, remote execution and other functions , able to manage tens of thousands of servers , with the ability to quickly complete t...

PYSEC-2017-151

Withdrawn as duplicate of PYSEC-2017-35 Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID...

CVE-2017-11610

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups...

CVE-2017-12791

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID...

CVE-2017-12791

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID...

CVE-2017-12791: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID...

CVE-2017-7424

A Path Traversal CWE-22 vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote authenticated users to download arbitrary files from a system running the product, if this component is...

CVE-2017-7422

Reflected and stored Cross-Site Scripting XSS, CWE-79 vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms CWE-693 and other...