1903 matches found
PT-2019-10041 · Ibm · Ibm Maximo Asset Management
Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management version 7.6 Description: The issue allows an authenticated user to replace a target page with a phishing site, potentially enabling the attacker to obtain highly sensitive information. Recommendations: For IBM Maxi...
CVE-2018-19879
An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX e.g., RUT950 R31.04.89 before R00.05.00.5 devices. The authentication functionality is not protected from automated tools used to make login attempts to the application. An anonymous attacker has the ability to make unlimited login...
PT-2019-19433 · Nagios · Nagios Im
Name of the Vulnerable Software and Affected Versions: Nagios IM versions prior to 2.2.7 Description: The issue allows authenticated users to execute arbitrary code due to API key problems. Recommendations: For versions prior to 2.2.7, update to version 2.2.7 or later to resolve the issue...
Authorization
A vulnerability in the user account management interface of Cisco NX-OS Software could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to an incorrect authorization check of user accounts and their associated Group ID GID. An...
Microsoft SharePoint Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...
Cross-Site Scripting (XSS) in PAN-OS External Dynamic Lists
A Cross-Site Scripting XSS vulnerability exists in the PAN-OS External Dynamic Lists. Ref. PAN-106776; CVE-2019-1565 Successful exploitation of this issue may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject...
CVE-2018-19557
An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/images...
CVE-2018-19557
The CVE-2018-19557 issue affects arcms (a CMS based on layui/arphp). Affected versions up to 2018-03-19 allow access to index/main, user/useradd, and img/images without authentication due to a lack of authentication checks, enabling unauthorized access. Public sources (NVD/NVD-derived entries and...
CVE-2018-16738
tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1...
CVE-2018-8852
Philips e-Alert Unit non-medical device, Version R2.1 and prior. When authenticating a user or otherwise establishing a new user session, the software gives an attacker the opportunity to steal authenticated sessions without invalidating any existing session identifier...
CVE-2018-16671
CirCarLife before 4.3 is affected by CVE-2018-16671 due to improper authentication for /html/device-id, causing system software information disclosure. Affected component is the CirCarLife web interface; root cause is lack of authentication on the device-id endpoint, enabling an unauthenticated u...
CVE-2018-15479
An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. Devices did not authenticate themselves to the cloud in device to...
SUSE-SU-2018:1971-1 Security update for python-paramiko
This update for python-paramiko fixes the following issues: - CVE-2018-7750: transport.py in the SSH server implementation of Paramiko did not properly check whether authentication is completed processing other requests. A customized SSH client could have skipped the authentication step bsc108527...
SUSE-SU-2018:1850-1 Security update for python-paramiko
This update for python-paramiko to version 2.0.8 fixes the following issues: - CVE-2018-7750: transport.py in the SSH server implementation of Paramiko did not properly check whether authentication is completed processing other requests. A customized SSH client could have skipped the authenticati...
PT-2018-16180 · Nextcloud +2 · Nextcloud Server +2
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 12.0.8 Nextcloud Server versions prior to 13.0.3 Description: The issue is related to improper authentication on the OAuth2 token endpoint. It involves missing checks that could potentially allow handing out...
CVE-2017-7931
In ABB IP GATEWAY 3.39 and prior, by accessing a specific uniform resource locator URL on the web server, a malicious user is able to access the configuration files and application pages without authentication...
MGASA-2018-0235 Updated spring-ldap packages fix security vulnerability
It was discovered that spring-ldap would under some circumstances allow authentication with a correct username but an arbitrary password CVE-2017-8028...
CVE-2018-11094
An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /goform/vpnBasicSettings do not require authentication. For example, when an HTTP POST request is made to /cgi-bin/ExportSettings.sh, the username, password, and...
CVE-2018-10581
In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist within their associated Team scoping. This occurs in situations where this authenticated user also belongs to multiple...
