F5 NGINX Controller Authentication Vulnerability

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A security vulnerability exists in the NGINX controller NATS messaging service in F5 NGINX Controller versions 1.0....

Authentication Bypass

github.com/caddyserver/caddy is vulnerable to authentication bypass. When TLS is used for client authentication, it does not enforce a tls: StrictHostMatching mode for client authentication, leading to a bypass of TLS authentication...

CVE-2020-1813

CVE-2020-1813 affects Huawei P30 smartphones with versions earlier than 10.1.0.135 (C00E135R2P11). The issue is an improper authentication vulnerability related to a specific interface, allowing access without authentication under certain conditions and enabling unauthorized operations. Public so...

Incorrect Authentication Vulnerability in Multiple Huawei Products (CNVD-2021-93841)

The Huawei USG9500 is a data center firewall product, the NGFW Module is a next-generation firewall NGFW module, and the NIP6800 is an intrusion prevention system. Multiple Huawei products are vulnerable to incorrect authentication. An attacker could exploit the vulnerability to gain certain...

Sign in with Apple JWT Token Forgery Vulnerability

Sign in with Apple is an Apple authentication mechanism. Sign in with Apple JWT token forgery vulnerability can be exploited by an attacker to forge a JWT token and gain control of the target user's account access...

Command injection

The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system...

Hoaxcalls Botnet Exploits Symantec Secure Web Gateways

Cyberattackers are targeting a post-authentication remote code-execution vulnerability in Symantec Secure Web Gateways as part of new Mirai and Hoaxcalls botnet attacks. Hoaxcalls first emerged in late March, as a variant of the Gafgyt/Bashlite family; it’s named after the domain used to host its...

SAP Business Objects Business Intelligence Platform Access Control Error Vulnerability

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. An access control error vulnerability exists in SAP Business Objects...

Security Advisory - Improper Authentication Vulnerability in Several Huawei Products

Some Huawei products have an improper authentication vulnerability. Attackers need to perform some operations to exploit the vulnerability. Successful exploit may obtain certain permissions on the device. Vulnerability ID: HWPSIRT-2020-03160 This vulnerability has been assigned a Common...

CVE-2020-5893

In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for captive portal detection...

CVE-2020-5563

Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in the affected product via the API...

How An Image Could've Let Attackers Hack Microsoft Teams Accounts

Microsoft has patched a worm-like vulnerability in its Teams workplace video chat and collaboration platform that could have allowed attackers to take over an organization's entire roster of Teams accounts just by sending participants a malicious link to an innocent-looking image. The flaw,...

Red Hat Satellite Job Invocation Authorization Issue Vulnerability

Red Hat Satellite is a system management platform from Red Hat, Inc. that extends the Linux infrastructure and provides system management capabilities such as administration, configuration, and monitoring. Red Hat Satellite is a system management platform from Red Hat, Inc. that extends the Linux...

CVE-2020-8797

Juplink RX4-1500 v1.0.3 is affected by CVE-2020-8797 due to a command injection from an unsanitized exec call when the telnetd service is enabled and an admin can authenticate from the local network. This allows a local attacker to gain root access to the Linux subsystem. The connected sources pr...

CVE-2020-9070

Huawei smartphones Taurus-AL00B with versions earlier than 10.0.0.205C00E201R7P2 have an improper authentication vulnerability. The software insufficiently validate the user's identity when a user wants to do certain operation. An attacker can trick user into installing a malicious application to...

Weak Password Vulnerability in MessageSolution Enterprise Email Archiving

MessageSolution Enterprise Email Archiving is a scalable, intelligent enterprise archiving and eDiscovery platform. MessageSolution Enterprise Email Archiving suffers from a weak password vulnerability that can be exploited by an attacker to log into the system...

NETGEAR RAX40 Authorization Issues Vulnerability

The NETGEAR RAX40 is a wireless router from NETGEAR. An authorization issue vulnerability exists in versions prior to NETGEAR RAX40 1.0.3.64, which can be exploited by an attacker to bypass authentication...

Unisoon UltraLog Express Authentication Vulnerability

Unisoon UltraLog Express is a telephone recording system from Unisoon, Taiwan, China. A security vulnerability exists in the administration interface of Unisoon UltraLog Express, which originates from the program not properly authenticating access to some pages/functions. An attacker could exploi...

CVE-2020-9066

Technical details (affected product versions, root cause specifics, exploit conditions, or remediation) are not publicly available in the provided connected documents. Monitor for updates from Huawei advisory and security databases.

New Mirai Variant 'Mukashi' Targets Zyxel NAS Devices

Another variant of the shape-shifting Mirai botnet is attacking Zyxel network-attached storage NAS devices using a critical vulnerability that was only recently discovered, according to security researchers. The variant, dubbed Mukashi, takes advantage of a pre-authentication command injection...