XenMobile FAQ: Shared Devices for iOS DEP

Q: Does XenMobile support shared devices for iOS when the devices are enrolled in Apple DEP? A: Yes Q:What is the difference between Basic DEP and Authorized DEP? A: Basic DEP: During the setup assistant, the initial enroller is the default DEP user. Then, it is the final user after MAM...

Code injection

In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute shellcode...

CVE-2018-1387

CVE-2018-1387 affects IBM Cloud APM Monitoring Agent for WebSphere Applications (WebSphere Applications agent) in IBM Cloud APM 8.1.3, 8.1.4 and related components. Root cause: the privacy filter did not shield PCI/data when diagnostics or transaction tracking is enabled, potentially exposing sen...

Cross site scripting

DISPUTED Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages - Edit template properties - Device Layouts -...

TrendNet Routers AUTHORIZED_GROUP Information Disclosure Vulnerability

TrendNet router devices are vulnerable to information disclosure vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...

CVE-2018-7034

TRENDnet TEW-751DR v1.03B03, TEW-752DRU v1.03B01, and TEW733GR v1.03B01 devices allow authentication bypass via an AUTHORIZEDGROUP=1 value, as demonstrated by a request for getcfg.php...

PT-2018-17862 · Trendnet · Trendnet Tew-752Dru +2

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-751DR version 1.03B03 TRENDnet TEW-752DRU version 1.03B01 TRENDnet TEW-733GR version 1.03B01 Description: The issue allows authentication bypass via an AUTHORIZED GROUP=1 value. This can be demonstrated by sending a request for...

CVE-2017-15093

When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. I...

Path traversal

An issue was discovered in Moxa MXview v2.8 and prior. The unquoted service path escalation vulnerability could allow an authorized user with file access to escalate privileges by inserting arbitrary code into the unquoted service path...

CVE-2017-14030

An issue was discovered in Moxa MXview v2.8 and prior. The unquoted service path escalation vulnerability could allow an authorized user with file access to escalate privileges by inserting arbitrary code into the unquoted service path...

CVE-2017-14030

An issue was discovered in Moxa MXview v2.8 and prior. The unquoted service path escalation vulnerability could allow an authorized user with file access to escalate privileges by inserting arbitrary code into the unquoted service path...

Trustwave Secure Web Gateway Elevation of Privilege Vulnerability

Trustwave Secure Web Gateway SWG is a web security gateway product from Trustwave, Inc. A security vulnerability exists in Trustwave SWG version 11.8.0.27 and earlier. A remote attacker can exploit the vulnerability by sending the 'publicKey' parameter to the /sendKey URI to add an arbitrary publ...

CVE-2017-18001

Trustwave Secure Web Gateway SWG through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI...

Design/Logic Flaw

Trustwave Secure Web Gateway SWG through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI...

CVE-2017-18001

Trustwave Secure Web Gateway SWG through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI...

Coremail's Android version suffers from an override access vulnerability.

Coremail Lobbyist Email System for Android is a mobile email app. There is an over-authorized access vulnerability in the "Personal Details" page of Coremail Lonker Mailbox System for Android. It allows attackers to utilize the vulnerability to modify the list field to query the name, cell phone...

CVE-2017-5530

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

CVE-2017-5530

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

Code injection

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

Design/Logic Flaw

Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to reset the admin password. The algorithm used in this mechanism is potentially at risk of being compromised and subsequently utilized by...