Improper access control

Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass administrator-enforced Web Login restrictions and gain access to entries via an unexpected vector...

CVE-2023-2282

Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass administrator-enforced Web Login restrictions and gain access to entries via an unexpected vector...

CVE-2023-2282

Devolutions Remote Desktop Manager suffers improper access control in the Web Login listener (affecting 2023.1.22 and earlier). An authenticated user can bypass administrator-imposed Web Login restrictions and access restricted entries via an unexpected vector. The NVD CVE entry lists a MEDIUM/LO...

CVE-2023-2282: Undefined Security Weakness

Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass administrator-enforced Web Login restrictions and gain access to entries via an unexpected vector...

Devolutions Remote Desktop Manager 安全漏洞

Devolutions Remote Desktop Manager is an application from Devolutions Canada. It provides remote desktop management functionality. A security vulnerability exists in Devolutions Remote Desktop Manager version 2023.1.22 and prior versions, which stems from improper access control of the Web login...

PT-2023-18713 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2023.1.22 and earlier Description: The issue is related to improper access control in the Web Login listener, allowing an authenticated user to bypass administrator-enforced Web Login restrictions...

CVE-2022-32514

A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Products: C-Bus Network Automation Controller - LSS5500NAC Versions prior to V1.10.0, Wiser for C-Bus Automation Controller - LSS5500SHAC...

Ruckus Networks Unleashed C110 授权问题漏洞

The Ruckus Networks Unleashed C110 is a wireless LAN product from Ruckus Networks, USA. A security vulnerability exists in multiple RUCKUS Networks products that originates from performing a WEB GUI login authentication bypass...

CVE-2022-40895

In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. The vulnerability is due to insecure design, where a difference in forgot password...

PT-2022-16924 · Automationdirect · Automationdirect Stride Field I/O

Name of the Vulnerable Software and Affected Versions: AutomationDirect Stride Field I/O affected versions not specified Description: The issue allows any attempt to log into the device with a web browser to potentially receive the device's password in the communication packets. Recommendations: ...

多款AutomationDirect产品安全漏洞

AutomationDirect C-more EA9 HMI and so on are products of AutomationDirect, Inc.AutomationDirect C-more EA9 HMI is a series of touch screen panels.AutomationDirect DirectLOGIC is a programmable logic AutomationDirect SIO-MB04RTDS is a programmable logic controller. A security vulnerability exists...

MAL-2022-3008 Malicious code in feishu-web-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a14951732b9d74cb9292015f2a81f6489d7887247dc37b8eadf0a6517f9fb22f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in feishu-web-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a14951732b9d74cb9292015f2a81f6489d7887247dc37b8eadf0a6517f9fb22f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7115 Malicious code in wechat-web-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b586c23c600833d8a48686acbfa907bb25a5721bdf793c96da22190c15cd83be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in qq-web-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7603e671a15b80daca7e87077897f28f0d260965f7c5d5ec50f93bf695a0f35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wechat-web-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b586c23c600833d8a48686acbfa907bb25a5721bdf793c96da22190c15cd83be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SolarWinds Serv-U vulnerability exploited to deliver Log4j attack

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. SolarWinds is affected by a vulnerability CVE-2021-35247 due to improper input validation when processing LDAP queries in the Serv-U web login screen. Serv-U versions up to 15.2.5 are affected by this flaw and were fixed in...

Input validation

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper...

CVE-2021-35247

CVE-2021-35247 affects SolarWinds Serv-U where the LDAP authentication input validator improperly sanitized characters in the web login interface. Public documentation from SolarWinds notes that versions up to 15.2.5 were affected and fixed in 15.3; SolarWinds recommends updating Serv-U to the la...

CVE-2021-35247: Improper Input Validation

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper...