CVE-2019-7229

The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisioning process via ABB Panel Builder 600 over FTP." Neither of these transmission methods implements any form of...

CVE-2019-7229

The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisioning process via ABB Panel Builder 600 over FTP." Neither of these transmission methods implements any form of...

Design/Logic Flaw

The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisioning process via ABB Panel Builder 600 over FTP." Neither of these transmission methods implements any form of...

CVE-2019-7229

The ABB CP635 HMI vulnerability (CVE-2019-7229) affects firmware update paths, specifically two upgrade methods: (1) USB/SD Card flashing and (2) remote provisioning via ABB Panel Builder 600 over FTP. Both methods lack encryption and authenticity verification for the firmware/software binaries, ...

CVE-2019-7229

The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisioning process via ABB Panel Builder 600 over FTP." Neither of these transmission methods implements any form of...

Logitech R700 Laser Presentation Remote Keystroke Injection Vulnerability

Product: R700 Laser Presentation Remote Manufacturer: Logitech Affected Versions: Model R-R0010 PID WD904XM and PID WD802XM Tested Versions: Model R-R0010 PID WD904XM and PID WD802XM Vulnerability Type: Insufficient Verification of Data Authenticity CWE-345 Keystroke Injection Vulnerability Risk...

The vulnerability of Cisco Adaptive Security Appliance’s microprogramming software lies in the insufficient verification of the authenticity of executed requests. This allows a hacker to execute arbitrary code in the context of the current user.

The vulnerability of Cisco Adaptive Security Appliance’s microprogramming software is related to insufficient verification of the authenticity of the requests being executed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, using...

CVE-2019-3786

Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. Th...

The vulnerability of Secutech router microprogramming software, related to insufficient verification of data authenticity, allows a hacker to alter DNS settings.

The vulnerability of Secutech router microprogramming software is related to insufficient verification of data authenticity. Exploiting this vulnerability could allow a malicious actor to alter DNS settings by making a request to goform/AdvSetDns?GO=wandns.asp...

CVE-2019-7323

GUP generic update process in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update. The update process relies on cleartext HTTP. The attacker could replace the...

The vulnerability of the Windows operating system, related to errors in the driver authenticity verification mechanism, allows a hacker to load improperly signed drivers into the kernel.

The vulnerability of the Windows operating system is related to errors in the mechanism for verifying the authenticity of kernel drivers. Exploiting this vulnerability allows an attacker to load improperly signed drivers into the kernel...

CVE-2018-7798

A Insufficient Verification of Data Authenticity CWE-345 vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration IP address, mask and gateway when remotely connected to the device...

CVE-2018-7798

CVE-2018-7798 affects Schneider Electric Modicon M221 PLCs (all versions). Root cause: Insufficient Verification of Data Authenticity (CWE-345) in the UMAS protocol, enabling a remote attacker to modify IPv4 configuration (IP address, subnet mask, gateway). Reported impact: potential remote recon...

CVE-2018-7798

A Insufficient Verification of Data Authenticity CWE-345 vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration IP address, mask and gateway when remotely connected to the device...

CVE-2018-7798

A Insufficient Verification of Data Authenticity CWE-345 vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration IP address, mask and gateway when remotely connected to the device...

Cross-Site Request Forgery (CSRF)

tribalsystems/zenario is vulnerable to cross-site request forgery CSRF. The application does not verify the authenticity of a request to admin/organizer.ajax.php?path=zenariocontent%2Fpanels%2Fcontent, which allows an attacker to submit a request on behalf of the victim when the victim visits a...

Hospira LifeCare PCA Infusion System Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-125-01 Hospira LifeCare PCA Infusion System Vulnerabilities that was published May 5, 2015, on the NCCIC/ICS-CERT web site. Independent researcher Billy Rios has identified an improper authorization vulnerabilit...

The vulnerability of Medtronic MyCareLink Patient Monitor lies in the insufficient verification of data authenticity, allowing attackers to inject arbitrary information into the Medtronic CareLink network.

The vulnerability of Medtronic MyCareLink Patient Monitor relates to insufficient verification of data authenticity. Exploiting this vulnerability could allow an attacker, operating remotely, to inject arbitrary information into the Medtronic CareLink network...

Design/Logic Flaw

A vulnerability was discovered in all versions of Medtronic MyCareLink 24950 and 24952 Patient Monitor. The affected product's update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable...

Medtronic MyCareLink 24950 Patient Monitor (Update A)

1. EXECUTIVE SUMMARY CVSS v3 4.9 Vendor: Medtronic Equipment: MyCareLink Patient Monitor Vulnerabilities: Insufficient Verification of Data Authenticity, Storing Passwords in a Recoverable Format 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow an attacker with...