Siemens Sicam Missing Authentication for Critical Function

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. An attacker with access to the device's web server might be able to execute administrative commands without authentication. File data ot500430.nasl...

PT-2021-14612 · Dell · Dell Openmanage Enterprise

Name of the Vulnerable Software and Affected Versions: Dell OpenManage Enterprise versions prior to 3.6.1 Description: The issue is related to an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to hijack an elevated session or...

CVE-2021-32002 SiteManager troubleshooter allows access without authentication from local network

Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network information and configuration of the SiteManager. This issue affects: Secomea SiteManager All versions prior to 9.5 on Hardware...

CVE-2021-21538

Dell EMC iDRAC9 (Dell EMC Remote Access Controller) versions 4.40.00.00 and later are affected by CVE-2021-21538 when prior to 4.40.10.00 due to an improper authentication vulnerability that could allow a remote, unauthenticated attacker to gain access to the iDRAC virtual console. Root cause: im...

CVE-2020-36239

Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17....

CVE-2021-26824

DM FingerTool v1.19 in the DM PD065 Secure USB is susceptible to improper authentication by a replay attack, allowing local attackers to bypass user authentication and access all features and data on the USB...

openSUSE 15 Security Update : cryptctl (openSUSE-SU-2021:2136-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:2136-1 advisory. - A Use of Password Hash Instead of Password for Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manag...

CVE-2021-32743

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions prior to 2.11.10 and from version 2.12.0 through version 2.12.4, some of the Icinga 2 features that require credentials for extern...

Schneider Electric EcoStruxure Control Expert 安全漏洞

Schneider Electric EcoStruxure Control Expert formerly known as Unity Pro is a suite of programming software for Schneider Electric logic controller products from Schneider Electric, France. Schneider Electric EcoStruxure Control Expert has a security vulnerability in several of its products that...

PT-2021-7077 · Schneider Electric · Scadapack Remoteconnect For X70 +4

Name of the Vulnerable Software and Affected Versions: EcoStruxure Control Expert versions prior to V15.0 SP1 EcoStruxure Process Expert all versions SCADAPack RemoteConnect for x70 all versions Modicon M580 CPU all versions - part numbers BMEP and BMEH Modicon M340 CPU all versions - part number...

The vulnerability of user authentication within the IKE-protocol’s Xauth mechanism, which stems from insufficient validation of input data, allows attackers to trigger service failures.

The vulnerability related to user authentication within the Xauth protocol of the IKE protocol is linked to improper validation during the file transmission to the program’s input. Exploiting this vulnerability allows an attacker to cause service failures...

Jira Data Center & Jira Service Management Data Center - Missing Authentication for Ehcache RMI - CVE-2020-36239

h3. Issue Summary Jira Data Center, Jira Core Data Center, Jira Software Data Center, and Jira Service Management Data Center exposed a Ehcache RMI network service which attackers, who can connect to the service, on port 40001 and potentially 40011 012, could execute arbitrary code of their choic...

AVEVA System Platform 访问控制错误漏洞

AVEVA System Platform is an application from the UK-based AVEVA Aveva. A responsive, standards-driven and scalable foundation for regulatory, enterprise SCADA, MES and IIoT applications.An authentication vulnerability exists in AVEVA System Platform. No details of the vulnerability are currently...

White Shark System (WSS) Sensitive Information Disclosure Vulnerability

White Shark System WSS is a browser-based collaboration platform that integrates Project Management, Task Management, Work Management and Work Log Management. Project Management", "Task Management", "Work Management" and "Work Log Management". A sensitive information disclosure vulnerability exis...

CVE-2021-33842

Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located...

SAP NetWeaver ABAP Server 和 ABAP Platform 授权问题漏洞

SAP NetWeaver ABAP Server is an application server for ABAP Advanced Business Application Programming. SAP NetWeaver AS ABAP and ABAP Platform Authentication Error Vulnerability can be exploited by remote attackers to submit special requests, bypass security restrictions, and gain unauthorized...

Cisco SD-WAN vManage Information Disclosure (cisco-sa-sdwan-vmanageinfdis-LKrFpbv)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by an information disclosure vulnerability due to absence of authentication to view sensitive information. An unauthenticated, remote attacker can exploit this, by sending a crafted request to the cluster management...

Flask-AppBuilder安全漏洞

Flask-AppBuilder is a simple and fast application development framework. A user enumeration vulnerability exists in Flask- appbuilder, which can be exploited by an attacker to allow an unauthenticated user to enumerate existing accounts by timing the server's response time at login...

The vulnerability of software for managing Vmware vSphere Client lies in its authentication procedures’ flaws, which allow attackers to bypass the authentication process or gain unauthorized access to the device.

The vulnerability of the software for managing Vmware vSphere Client is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to bypass the authentication process or gain unauthorized access to the device by gaining access to port 443...

IBM Cognos Analytics Licensing Issues Vulnerabilities

IBM Cognos Analytics is a suite of business intelligence software from IBM in the United States. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such things as key factors and key people. An authorization issue...