6396 matches found
CVE-2018-12659
SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrftoken parameter...
CVE-2018-12659
CVE-2018-12659 affects SLiMS 8 Akasia 8.3.1. The issue is a CSRF protection bypass where an attacker can obtain administrator access by omitting the csrf_token parameter. The root cause is the failure to enforce CSRF token verification, allowing remote exploitation. Documented impacts include adm...
CVE-2018-12659
SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrftoken parameter...
Security Bulletin: A command injection vulnerability has been identified in IBM Security Access Manager for Mobile appliances (CVE-2016-3028)
Summary A vulnerability in IBM Security Access Manager for Mobile could allow a remote authenticated attacker with admin access to the LMI to execute arbitrary commands on the system. Vulnerability Details CVEID: CVE-2016-3028 DESCRIPTION: IBM Security Access Manager for Mobile could allow a remo...
Security Bulletin: A command injection vulnerability has been identified in IBM Security Access Manager for Web appliances (CVE-2016-3028)
Summary A vulnerability in IBM Security Access Manager for Web could allow a remote authenticated attacker with admin access to the LMI to execute arbitrary commands on the system. Vulnerability Details CVEID: CVE-2016-3028 DESCRIPTION: IBM Security Access Manager for Web could allow a remote...
CVE-2018-12323
An issue was discovered on Momentum Axel 720P 5.1.8 devices. A password of EHLGVG is hard-coded for the root and admin accounts, which makes it easier for physically proximate attackers to login at the console...
CVE-2018-12263
portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI...
SIEMENS SCALANCE M875 Cross-Site Request Forgery Vulnerability
SCALANCE M industrial routers are used for secure remote access to the plant via mobile networks, e.g. GPRS or UMTS, with integrated security features such as firewalls to prevent unauthorized access and VPNs to protect data transmission. A cross-site request forgery vulnerability exists in SIEME...
CVE-2018-0319
A vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning PCP could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of a password recovery request. An attacker could...
Easy MPEG to DVD Burner SEH + DEP Bypass Local Buffer Overflow Vulnerability
Easy MPEG to DVD Burner is a freeware for Windows, mainly used as a DVD format converter for MPEG and DAT files. A security vulnerability exists in Easy MPEG to DVD Burner. An attacker can exploit this vulnerability to gain administrator access...
Lutron Devices Default Credentials (Telnet)
Lutron devices have default admin credentials that cannot be changed. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2018-1375 · Canon · Canon Lbp3370 +3
Name of the Vulnerable Software and Affected Versions: Canon LBP6650 versions Canon LBP3370 versions Canon LBP3460 versions Canon LBP7750C versions Description: The issue is related to a weakness in the authentication procedure of Canon printer software when using standard device settings. It...
Huawei 1288H and 2288H Rack Server JSON Injection Vulnerability
Huawei 1288H V5 and 2288H V5 are both rack routers that can be widely used for cloud virtualization, database, big data and other loads. A JSON injection vulnerability exists in the V100R005C00 software of the Huawei 1288H V5 and 2288H V5. The vulnerability stems from the program failing to...
UTStar WA3002G4 Authentication Bypass Vulnerability
The UTStar WA3002G4 is a modem from UTStarcom USA. An authentication bypass vulnerability exists in the UTStar WA3002G4. An attacker can use this vulnerability to directly access administrator settings and obtain plaintext credentials from the HTML source...
Schneider Electric MGE UPS and MGE STS 66074 MGE Network Management Card Transverse Sensitive Information Vulnerability (CNVD-2018-11132)
The Schneider Electric MGE UPS and MGE STS are both products of the French company Schneider Electric.The Schneider Electric MGE UPS is an uninterruptible power supply unit.The MGE STS is a static toggle switch.66074 MGE Network Management Card Transverse is one of the network management cards...
TP-Link EAP Controller and Omada Controller Elevation of Privilege Vulnerability
TP-Link EAP Controller and Omada Controller are both software from China P&L TP-LINK for remote control of wireless AP access point devices. A security vulnerability exists in TP-Link EAP Controller and Omada Controller versions 2.5.4Windows and 2.6.0Windows, which originates from the program's...
First things first: Envisioning your security deployment
This blog post is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 Security solutions. In this series youll find context, answers, and guidance for deployment and driving adoption within your organization. Check out our last blog...
CVE-2018-9845
Etherpad Lite before 1.6.4 is exploitable for admin access...
