CVE-2017-14696

SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request...

PT-2017-16155 · Cisco · Nexus 5600 Platform Switches +21

Name of the Vulnerable Software and Affected Versions: Cisco FXOS and NX-OS System Software affected versions not specified Firepower 4100 Series Next-Generation Firewall affected versions not specified Firepower 9300 Security Appliance affected versions not specified Multilayer Director Switches...

Foreman Information Disclosure Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in the LDAP Authentication feature in Foreman. A remote attacker could...

CVE-2017-13984

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to delete arbitrary files via servlet directory traversal...

CVE-2017-14349

An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data...

CVE-2017-13985

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to traverse directory leading to disclosure of information...

CVE-2017-14349

CVE-2017-14349 affects HPE SiteScope versions 11.2x and 11.3x. The issue allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data. The vulnerability’s root cause is described as an authentication weakness enabling broader read access; exploitati...

CVE-2017-13985

The CVE-2017-13985 issue affects HPE BSM Platform Application Performance Management System Health (versions 9.26, 9.30, 9.40). The vulnerability is a path traversal/authentication flaw in the Email Servlet that leads to information disclosure. The ZDI advisory notes that exploitation requires au...

CVE-2017-14349

An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data...

The vulnerability of the authentication module of the Cisco Identity Services Engine allows a hacker to gain Super Admin privileges for the ISE Admin portal.

The vulnerability of the Cisco Identity Services Engine’s authentication module arises from incorrect processing of authentication requests and improper determination of security policies for users who have passed the verification. Exploiting this vulnerability can allow a malicious actor,...

The software of the remote monitoring system Advantech WebAccess is vulnerable, as a lack of measures to protect the structure of the web page during authentication allows a intruder to inject any desired web script or HTML code.

The software of the remote monitoring system Advantech WebAccess is vulnerable because measures are not taken to protect the structure of the web page during authentication cross-site scripting attacks. Exploiting this vulnerability allows a malicious actor to inject arbitrary web scripts or HTML...

Multiple DenyAll Product Authentication Vulnerabilities

DenyAll i-Suite LTS and others are Web firewall products from DenyAll France. An authentication vulnerability exists in several DenyAll products. A remote attacker can exploit this vulnerability by sending a typeOf=debug request to the /webservices/download/index.php file and reading the iToken...

LDAP Injection Vulnerability in Joomla!

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. Joomla! 3.7.5 and previous versions of the system in the case of open LDAP authentication injection vulnerability, the vulnerability stems from the LDAP validation used ldapsearch...

FreeRDP Remote Code Execution Vulnerability

FreeRDP is a is a FreeRDP team developed a Windows, OSX and Linux platform based on the free, open source implementation of the Remote Desktop Protocol RDP. A remote code execution vulnerability exists in the authentication feature in FreeRDP 2.0.0-beta1+android1. A remote attacker could exploit...

Cross site request forgery (csrf)

IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sharing to cease through the use of cross-site request forgery. IBM X-Force ID: 111895...

SUSE-SU-2017:2267-1 Security update for jabberd

This update for jabberd fixes the following issues: - CVE-2017-10807: SASLANONYMOUS authentication method allowed anyone to authentication even if option was disabled bsc1047282...

SUSE-SU-2017:2200-1 Security update for subversion

This update for subversion fixes the following issues: - CVE-2017-9800: A malicious, compromised server or MITM may cause svn client to execute arbitrary commands by sending repository content with svn:externals definitions pointing to crafted svn+ssh URLs. bsc1051362 - Malicious user may commit...

Authentication flaw

A vulnerability in the authentication module of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass local authentication. The vulnerability is due to improper handling of authentication requests and policy assignment for externally authenticated users. An...

Default credentials

DISPUTED An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. This hashing algorithm can be cracked relatively easily. An attacker will likely be able to crack the password using offline cracker...

CVE-2017-9857

An issue was discovered in SMA Solar Technology products. The SMAdata2+ communication protocol does not properly use authentication with encryption: it is vulnerable to man in the middle, packet injection, and replay attacks. Any setting change, authentication packet, scouting packet, etc. can be...