CVE-2017-8155

The outdoor unit of Customer Premise Equipment CPE product B2338-168 V100R001C00 has a no authentication vulnerability on a certain port. After accessing the network between the indoor and outdoor units of the CPE, an attacker can deliver commands to the specific port of the outdoor unit and...

CVE-2017-8155

The CVE-2017-8155 entry describes an unauthenticated access flaw in the outdoor unit of Huawei B2338-168 CPE. The issue arises from no authentication on a specific port (serial port access) between the indoor and outdoor units, enabling an attacker to deliver commands to the outdoor unit without ...

Debian: Security Advisory (DSA-4046-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1180-1] libspring-ldap-java security update

Package : libspring-ldap-java Version : 1.3.1.RELEASE-4+deb7u1 CVE ID : CVE-2017-8028 Tobias Schneider discovered that Spring-LDAP would allow authentication with an arbitrary password when the username is correct, no additional attributes are bound and when using LDAP BindAuthenticator with...

CVE-2017-9314

Authentication vulnerability found in Dahua NVR models NVR50XX, NVR52XX, NVR54XX, NVR58XX with software before DHNVR5xxxEngPV2.616.0000.0.R.20171102. Attacker could exploit this vulnerability to gain access to additional operations by means of forging json message...

Authentication flaw

Authentication vulnerability found in Dahua NVR models NVR50XX, NVR52XX, NVR54XX, NVR58XX with software before DHNVR5xxxEngPV2.616.0000.0.R.20171102. Attacker could exploit this vulnerability to gain access to additional operations by means of forging json message...

CVE-2017-14696

SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request...

PT-2017-16155 · Cisco · Nexus 5600 Platform Switches +21

Name of the Vulnerable Software and Affected Versions: Cisco FXOS and NX-OS System Software affected versions not specified Firepower 4100 Series Next-Generation Firewall affected versions not specified Firepower 9300 Security Appliance affected versions not specified Multilayer Director Switches...

Foreman Information Disclosure Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in the LDAP Authentication feature in Foreman. A remote attacker could...

CVE-2017-13984

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to delete arbitrary files via servlet directory traversal...

CVE-2017-14349

An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data...

CVE-2017-13985

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to traverse directory leading to disclosure of information...

CVE-2017-14349

CVE-2017-14349 affects HPE SiteScope versions 11.2x and 11.3x. The issue allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data. The vulnerability’s root cause is described as an authentication weakness enabling broader read access; exploitati...

CVE-2017-13985

The CVE-2017-13985 issue affects HPE BSM Platform Application Performance Management System Health (versions 9.26, 9.30, 9.40). The vulnerability is a path traversal/authentication flaw in the Email Servlet that leads to information disclosure. The ZDI advisory notes that exploitation requires au...

CVE-2017-14349

An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data...

The software of the remote monitoring system Advantech WebAccess is vulnerable, as a lack of measures to protect the structure of the web page during authentication allows a intruder to inject any desired web script or HTML code.

The software of the remote monitoring system Advantech WebAccess is vulnerable because measures are not taken to protect the structure of the web page during authentication cross-site scripting attacks. Exploiting this vulnerability allows a malicious actor to inject arbitrary web scripts or HTML...

The vulnerability of the authentication module of the Cisco Identity Services Engine allows a hacker to gain Super Admin privileges for the ISE Admin portal.

The vulnerability of the Cisco Identity Services Engine’s authentication module arises from incorrect processing of authentication requests and improper determination of security policies for users who have passed the verification. Exploiting this vulnerability can allow a malicious actor,...

Multiple DenyAll Product Authentication Vulnerabilities

DenyAll i-Suite LTS and others are Web firewall products from DenyAll France. An authentication vulnerability exists in several DenyAll products. A remote attacker can exploit this vulnerability by sending a typeOf=debug request to the /webservices/download/index.php file and reading the iToken...

LDAP Injection Vulnerability in Joomla!

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. Joomla! 3.7.5 and previous versions of the system in the case of open LDAP authentication injection vulnerability, the vulnerability stems from the LDAP validation used ldapsearch...

FreeRDP Remote Code Execution Vulnerability

FreeRDP is a is a FreeRDP team developed a Windows, OSX and Linux platform based on the free, open source implementation of the Remote Desktop Protocol RDP. A remote code execution vulnerability exists in the authentication feature in FreeRDP 2.0.0-beta1+android1. A remote attacker could exploit...