PT-2019-2282

Name of the Vulnerable Software and Affected Versions Modicon M100 versions all Modicon M200 versions all Modicon M221 versions all ATV IMC drive controller versions all Modicon M241 versions all Modicon M251 versions all Modicon M258 versions all Modicon LMC058 versions all Modicon LMC078 versio...

CVE-2019-6538

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro IC...

CVE-2018-13816

A vulnerability has been identified in TIM 1531 IRC All version V2.0. The devices was missing proper authentication on port 102/tcp, although configured. Successful exploitation requires an attacker to be able to send packets to port 102/tcp of the affected device. No user interaction and no user...

The vulnerability in the web interface of the Cisco Energy Management Suite allows a perpetrator to perform cross-site fraudulently.

The vulnerability of the Cisco Energy Management Suite’s web interface relates to the lack of authentication for HTTP requests. Exploiting this vulnerability allows a remote attacker to perform cross-site fraudulently, and to carry out arbitrary actions on the vulnerable device under the user’s...

CVE-2018-18014

Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to private services listening on ports 8000, 30000 and 30001. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated b...

CVE-2018-15598

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable...

CVE-2018-15565

An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authentication for adding a page. This can also be exploited via CSRF...

The vulnerability of the Policy Builder interface of the Cisco Policy Suite software management tool allows a perpetrator to access the interface and make changes to existing repositories.

The vulnerability of the Policy Builder interface of the Cisco Policy Suite management software is related to the absence of a mechanism for authenticating the Policy Builder interface. Exploiting this vulnerability could allow an attacker to gain access to the interface and make changes to...

PT-2018-3087 · Apache +2 · Apache Zookeeper +2

Name of the Vulnerable Software and Affected Versions: Apache ZooKeeper versions 3.5.0-alpha through 3.5.3-beta Apache ZooKeeper versions prior to 3.4.10 Description: The issue arises from the lack of authentication when a server attempts to join a quorum in Apache ZooKeeper. This allows an...

CVE-2018-2360

SAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is missing an authentication check for functionalities that require user identity and cause consumption of file system storage...

Hawt.io admin terminal command execution vulnerability

Hawt.io is a web console for managing Java frameworks. admin terminal is one of the management terminals. A security vulnerability exists in the admin terminal in Hawt.io, which is caused by the program failing to require authentication. A remote attacker can exploit this vulnerability to execute...

The vulnerability of the microprogrammed software of the BINOM3 Universal Multifunctional Electric Power Quality Meter lies in the lack of authentication, which allows attackers to gain access to the device’s settings.

The vulnerability of the microprogrammed software of the BINOM3 Universal Multifunctional Electric Power Quality Meter is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device and perform arbitrary settin...

The vulnerability of the Wi-Fi Konke Smart Plug’s microprogramming software lies in the lack of authentication procedures for Telnet sessions. This allows a malicious user to control the device with root privileges.

The vulnerability of the Wi-Fi Konke Smart Plug remote control software relates to the absence of authentication procedures for Telnet sessions. Exploiting this vulnerability could allow a malicious actor to control the device with root privileges through port 23...

CVE-2017-1222

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 123862...

Juniper Networks Junos Space Man-in-the-Middle Attack Vulnerability

Juniper Junos Space is a network management solution from Juniper Networks. The solution supports automated configuration, monitoring and troubleshooting of devices and services throughout their lifecycle. A security vulnerability exists in Juniper Networks Junos Space prior to version 17.1R1 tha...

CVE-2017-10623

Lack of authentication and authorization of cluster messages in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to intercept, inject or disrupt Junos Space cluster operations between two nodes. Affected releases are Juniper Networks Junos Space all versions prior to...

PT-2017-3367 · Zivif · Zivif Pr115-204-P-Rs

Name of the Vulnerable Software and Affected Versions: Zivif PR115-204-P-RS version V2.3.4.2103 Description: The issue is related to errors in handling registration data in the webcam's software. It allows a remote attacker to obtain user credentials using the HTTP request...

PT-2017-19227 · Sma Solar Technology · Sunny Boy Tlst-21 +3

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products, specifically Sunny Boy TLST-21, TL-21, and Sunny Tripower TL-10, TL-30 Description: The SIP implementation in SMA Solar Technology products does not properly use authentication with encryption, making it...

Mailcow Cross-Site Request Forgery Vulnerability (CNVD-2017-10371)

Mailcow is a mail server suite that provides a modern web UI interface for user and service management. A cross-site request forgery vulnerability exists in Mailcow. The vulnerability stems from the "admin.php" page not adding authentication such as token or CAPTCHA, which can be exploited by an...

The vulnerability of the CODESYS Runtime Toolkit execution environment allows a perpetrator to execute arbitrary commands and load arbitrary files.

The vulnerability of the CODESYS Runtime Toolkit lies in the absence of requirements for authentication procedures in the default configuration. Exploiting this vulnerability allows a malicious actor to execute commands through the command line interface and upload arbitrary files...