CVE-2015-3459: Undefined Security Weakness

The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands...

CVE-2015-0669

Cisco IOS 15.4S and 15.4(3)S are affected by CVE-2015-0669 due to insufficient validation of Autonomic Networking (AN) messages in the Autonomic Networking Infrastructure (ANI). A remote, unauthenticated attacker can craft AN messages over an intranet to overwrite configuration settings, causing ...

CVE-2015-0669: Improper Input Validation

The Autonomic Networking Infrastructure ANI implementation in Cisco IOS 15.4S and 15.43S allows remote attackers to modify configuration settings or cause a denial of service partial service outage by sending crafted Autonomic Networking AN messages on an intranet network, aka Bug ID CSCup62167...

PT-2015-4796

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.4S through 15.43S Description The issue allows remote attackers to modify configuration settings or cause a partial denial of service by sending crafted Autonomic Networking messages on an intranet network. This is due to...

CVE-2014-0005: Undefined Security Weakness

PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform JBEAP 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to read and modify the application sever configuration and state by deploying a crafted application...

PT-2015-3595

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform JBEAP version 6.2.2 JBoss BRMS versions prior to 6.0.3 roll up patch 2 Description The issue allows remote authenticated users to read and modify the application server configuration and state by...

CVE-2015-1454

Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which allows man-in-the-middle attackers to spoof ProxySG Client Managers, and consequently modify configurations and execute arbitrary software...

PT-2015-5294

Name of the Vulnerable Software and Affected Versions Blue Coat ProxyClient versions prior to 3.3.3.3 Blue Coat ProxyClient versions 3.4.x prior to 3.4.4.10 Blue Coat Unified Agent versions prior to 4.1.3.151952 Description The issue allows man-in-the-middle attackers to spoof ProxySG Client...

XEROX Multiple Product Unauthenticated Remote Firmware Injection Vulnerability

Added: 12/19/2014 BID: 52483 OSVDB: 80096 Background Some Xerox Multifunction Printers MFP utilize Dynamic Loadable Modules DLM for patching, upgrading and cloning. The DLMs can be delivered to the printer via the Jet Direct printer service on TCP port 9100. Problem Multiple Xerox products are...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Lantronix xPrintServer allows remote attackers to hijack the authentication of administrators for requests that modify configuration, as demonstrated by executing arbitrary commands using the c parameter in the rpc action...

CVE-2013-3089

Cross-site request forgery CSRF vulnerability in apply.cgi in Belkin N300 F7D7301v1 router allows remote attackers to hijack the authentication of administrators for requests that modify configuration...

CVE-2013-3089: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in apply.cgi in Belkin N300 F7D7301v1 router allows remote attackers to hijack the authentication of administrators for requests that modify configuration...

CVE-2014-5335

Multiple cross-site request forgery CSRF vulnerabilities in innovaphone PBX 10.00 sr11 and earlier allow remote attackers to hijack the authentication of administrators for requests that modify configurations or user accounts, as demonstrated by 1 changing the administrator password via a crafted...

PT-2014-3418

Name of the Vulnerable Software and Affected Versions ZOLL Defibrillator / Monitor X Series affected versions not specified Description The issue concerns default passwords for supervisor and service accounts, allowing physically proximate attackers to modify the device configuration. This could...

Zend Platform 2.2.1 PHP.INI File Modification Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22802/info The Zend Platform is prone to an issue that may let local attackers modify the PHP configuration file 'php.ini'. This issue occurs because the application is installed with an 'inimodifier' program that may be...

CVE-2014-2349 Emerson DeltaV Use of Improper Authorization

Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program...

CVE-2014-0769

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to 1 modify the configuration via a request to the debug service on port 4000 o...

Authentication flaw

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to 1 modify the configuration via a request to the debug service on port 4000 o...

CVE-2014-0769 Festo CECX-X-(C1/M1) Controller Improper Authentication

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to 1 modify the configuration via a request to the debug service on port 4000 o...