581 matches found
CVE-2016-10700
authlogin.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database, because the guest user is not considered. NOTE: this vulnerability exists because of an incomplete fix for...
CVE-2016-10700
CVE-2016-10700 affects Cacti prior to 1.0.0, where auth_login.php lets remote authenticated users bypass access restrictions by logging in as a non-existent user (guest not counted), tied to an incomplete fix for CVE-2016-2313. Public sources in connected documents confirm the vulnerability and n...
Command Execution Vulnerability in the pelco Sarix Enhanced GeneralSetupController.php File
pelco Sarix Enhanced is a webcam. A command execution vulnerability exists in the pelco Sarix Enhanced GeneralSetupController.php file. The vulnerability is caused due to the program failing to properly perform validity checks when processing user-submitted data, which allows an attacker...
Envitech Ltd EnviDAS Ultimate Authentication Bypass Vulnerability
Envidas Ultimate is an intelligent, versatile, multi-site continuous emissions monitoring and data collection system from Envitech Ltd. An authentication bypass vulnerability exists in Envitech Ltd EnviDAS Ultimate, where an attacker could view information and modify settings or remotely execute...
Symantec Messaging Gateway <= 10.6.3-2 unauthenticated root RCE(CVE-2017-6327)
Bug 1: Web authentication bypass The web management interface is available via HTTPS, and you can't do much without logging in. If the current session identified by the JSESSIONID cookie has the user attribute set, the session is considered authenticated. The file LoginAction.class defines a numb...
Symantec Messaging Gateway 10.6.3-2 Remote Code Execution
Hello, This is an advisory for CVE-2017-6327 which is an unauthenticated remote code execution flaw in the web interface of Symantec Messaging Gateway prior to and including version 10.6.3-2, which can be used to execute commands as root. Symantec Messaging Gateway, formerly known as Brightmail, ...
CVE-2017-1000020
SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass. "eCos Embedded Web Servers used by Multiple Routers and Home devices, while sending SYN Flood or FIN Flood packets fails to validate and handle the packets and does not ask for any si...
UBUNTU-CVE-2017-9781
A cross site scripting XSS vulnerability exists in CheckMK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the username parameter when attempting authentication to webapi.py, which is returned unencoded with content type...
Debian DLA-952-1 : kde4libs security update
Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2017-6410 Itzik Kotler, Yonatan Fridburg and Amit Klein of Safebreach Labs reported that URLs are not...
[SECURITY] [DLA 952-1] kde4libs security update
Package : kde4libs Version : 4:4.8.4-4+deb7u3 CVE ID : CVE-2013-2074 CVE-2017-6410 CVE-2017-8422 Debian Bug : 856890 Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following...
Multiple Brother device authentication bypass vulnerabilities
Brother MFC-J6973CDW and others are printer products from Brother Industries Japan. A security vulnerability exists in multiple Brother devices. An attacker could exploit the vulnerability to bypass Web authentication...
DLA-560-2 cacti - regression update
Bulletin has no description...
The vulnerability of Juniper SRX 240 router microprogramming software allows a hacker to execute arbitrary code.
The Juniper SRX 240 router software contains a vulnerability in the SRX Web Authentication service. This vulnerability allows an attacker to execute arbitrary code due to the lack of control over input parameters on the page where user authentication takes place...
The vulnerability of the Cisco Wireless LAN Controller 2500 software allows a malicious individual to cause service failure.
Vulnerability exists in Cisco Wireless LAN Controller WLC devices due to improper memory release. This allows malicious actors operating remotely to trigger a service failure by sending frequent WebAuth authorization requests...
The vulnerability of the Cisco Wireless LAN Controller 4400 software allows a malicious individual to cause service failure.
Vulnerability exists in Cisco Wireless LAN Controller WLC devices due to improper memory release. This allows malicious actors operating remotely to trigger a service failure by sending frequent WebAuth authorization requests...
The vulnerability of Cisco PIX software allows a malicious individual to trigger a service failure.
Overloading the buffer in the Cisco PIX Firewall allows malicious actors operating remotely to trigger service failures by using authentication for HTTP traffic via TACACS+ or RADIUS...
The vulnerability of the Cisco Wireless LAN Controller 5500 software allows a malicious individual to cause service failure.
Vulnerability exists in Cisco Wireless LAN Controller WLC devices due to improper memory release. This allows malicious actors operating remotely to trigger a service failure by sending frequent WebAuth authorization requests...
CVE-2016-2313
authlogin.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database...
