CVE-2017-14244

The CVE-2017-14244 vulnerability affects the iBall ADSL2+ Home Router FW_iB-LR7011A_1.0.2, enabling an authentication bypass by accessing admin pages through CGI extensions (e.g., /info.cgi, /password.cgi). Root cause: CGI-based authentication bypass that exposes admin settings. Impact: attacker ...

Error: “Cannot start apps. Please run reset receiver to resolve a lockdown conflict for ClientHostedAppsShortcuts (error 2320)”

Users access a StoreURL and launch published IE from their Client machines. Then they use published IE and connect to another StoreURL from another farm to access another application. Majority but not all users get errors while launching the application. Error: “Cannot start apps. Please run Rese...

Stellar.org: Direct URL access to PDF files

hi, I was able to access the following PDF files without any authentication https://www.stellar.org/wp-content/uploads/2014/07/Bylaws-00580045-10.pdf https://www.stellar.org/wp-content/uploads/2014/07/FILED-STELLAR-DEVELOPMENT-FOUNDATION-00594674.pdf the pdf files under path...

CVE-2017-7919

An Improper Authentication issue was discovered in Newport XPS-Cx and XPS-Qx. An attacker may bypass authentication by accessing a specific uniform resource locator URL...

CVE-2017-7919

An Improper Authentication issue was discovered in Newport XPS-Cx and XPS-Qx. An attacker may bypass authentication by accessing a specific uniform resource locator URL...

Multiple Newport products certified to bypass vulnerabilities

The Newport XPS-Cx is a device controller from Newport USA, and the XPS-Qx is another version of it. An authorization issue exists in Newport XPS-Cx and XPS-Qx. An attacker can exploit this vulnerability to bypass authentication by accessing the URL...

CVE-2016-8722

An exploitable Information Disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client. Retrieving a specific URL without authentication can reveal sensitive information to an attacker...

CVE-2017-3832

A vulnerability in the web management interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to a missing internal handler for the specific request. An...

CVE-2016-8271

Huawei eSpace IAD V300R002C01SPC100 and earlier versions have an information leak vulnerability; an attacker can check and download the fault information by accessing a special URL...

Multiple Eaton ePDUs Path Traversal Vulnerabilities

Eaton ePDUs EAMxxx is a rack-mounted power distribution unit module from Eaton Corporation of America. A path traversal vulnerability exists in multiple Eaton ePDUs products, allowing remote attackers to exploit the vulnerability by submitting a special URL to access configuration files...

CVE-2017-5142

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the parameters by accessing a specific URL because of Improper Privilege Management...

UBUNTU-CVE-2016-7967

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled...

CVE-2016-7967

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled...

NetScaler Gateway: Could not add account. Check your account settings and try again.

When accessing the Store externally we would get the error Could not add account. Check your account settings and try again. If we access the Storefront Base URL, we are able to enumerate the applications and desktops just fine...

Vicon Network Camera Authentication Bypass

TITLE Vicon Network Cameras - Authentication Bypass AUTHOR Reginald Dodd / Information Security Engineer https://www.linkedin.com/in/reginalddodd VENDOR Vicon Industries Inc. http://www.vicon-security.com http://www.vicon-security.com/products/network-cameras/ DESCRIPTION Remote unauthenticated...

Nextcloud: The application uses basic authentication.

Basic authentication is enabled on file access requests ==================== Description --------------------- Basic authentication is enabled on the server if we request for the direct URL of a file. The issues of using Basic Authentication can be read here - OWASP: Basic Authentication. Though...

Personal Voice Judge - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Personal Voice Judge published at the 'play' market has multiple vulnerabilities...

News For PS4 - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application News For PS4 published at the 'play' market has multiple vulnerabilities...

Camper-PRO - Motorhome - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Camper-PRO - Motorhome published at the 'play' market has multiple vulnerabilities...

Coinbase: Direct URL access to completed reports

Access to non-HTML contents such as CSV report is not restricted to authenticated users. Anyone would be able to access a CSV report by giving the direct URL and downloading it. The URL could be obtained from browser history. The following URL is an example...