CVE-2017-15206

Kanboard (before 1.0.47) is affected. An authenticated user can modify form data to add an internal link to another user’s private project, due to the underlying vulnerability in Kanboard prior to 1.0.47. Remediation is to upgrade to 1.0.47 or later (as noted in the public advisory/news). If you ...

CVE-2017-15198

CVE-2017-15198 affects Kanboard prior to 1.0.47. An authenticated user can alter form data to edit a category of another user’s private project, exposing an authorization weakness in the category-edit flow. The issue is documented across multiple sources (Red Hat, NVD, CVE List, Debian tracker) a...

CVE-2017-15199

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description...

CVE-2017-15201

CVE-2017-15201 affects Kanboard versions before 1.0.47. An authenticated user can edit tags of another user’s private project by altering form data, due to a permission/validation issue. Impact is editing private project labels. Remediation: upgrade to Kanboard 1.0.47 (or later) where the issue i...

CVE-2017-15196

The CVE-2017-15196 issue affects Kanboard prior to version 1.0.47, where an authenticated user can remove columns from another user’s private project by tampering with form data. The root cause is insufficient authorization/validation when processing form submissions that modify project columns. ...

CVE-2017-12851

An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46...

CVE-2017-12851

CVE-2017-12851 affects Kanboard prior to 1.0.46. An authenticated standard user could reset the administrator password by altering form data in the request, exposing a password‑reset vulnerability in the admin account. Remediation guidance found in public references suggests upgrading to a fixed ...

CVE-2017-6872

Siemens OZW672 and OZW772 devices (all versions) are affected by CVE-2017-6872, allowing an attacker with access to Port 21/TCP to read or alter historical measurement data due to missing authentication in the built‑in service. The vulnerability is documented with CVSSv3 base score 6.5 (vector AV...

CVE-2017-6872

A vulnerability was discovered in Siemens OZW672 all versions and OZW772 all versions that could allow an attacker with access to port 21/tcp to access or alter historical measurement data stored on the device...

OSIsoft PI Web API 2017

CVSS v3 7.1 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: OSIsoft Equipment: PI Web API 2017 Vulnerability: Cross-Site Request Forgery AFFECTED PRODUCTS OSIsoft reports that the vulnerability affects the following PI Web API products: PI Web API versions prior to 2017 1.9.0...

Authentication flaw

Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function to alter or delete information via unspecified vectors...

CVE-2017-2094

Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function to alter or delete information via unspecified vectors...

Oracle PeopleSoft Enterprise CS Campus Community Remote Vulnerability

Oracle PeopleSoft is a set of enterprise human capital management solutions from Oracle that provides human capital management, financial management, supplier relationship management, etc. PeopleSoft Enterprise CS Campus Community is one of the campus management components. A security vulnerabili...

Toshiba FlashAir does not require authentication in "Internet pass-thru Mode"

Overview FlashAir by Toshiba Corporation is a SDHC memory card which provides "Internet pass-thru Mode", allowing devices to access the internet while connecting to FlashAir. When configured in "Internet pass-thru Mode", FlashAir acts both as a station and as an access point. When "Internet...

Vulnerabilities in the Debian GNU/Linux operating system that allow a malicious individual to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the linux-headers-2.6.18-5-all-sparc package of the Debian GNU/Linux operating system may lead to breaches of confidentiality, integrity, and accessibility of protected information...

The vulnerability of the HP System Management Homepage software allows a perpetrator to obtain confidential information or alter data.

The vulnerability of the HP System Management Homepage software relates to errors in the code. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information or alter data...

Design/Logic Flaw

The API on Fisher-Price Smart Toy Bear devices allows remote attackers to obtain sensitive information or modify data by leveraging presence in an 802.11 network's coverage area and entering an account number...

The vulnerability of the Oracle E-Business Suite system’s automation functionality allows a perpetrator to alter data.

The vulnerability of the Oracle Applications Framework component of the Oracle E-Business Suite automation system is related to errors in the code. Exploiting this vulnerability can allow attackers to alter data...

Vulnerabilities of the Red Hat Enterprise Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The XFree86-font-utils-4.3.0 package in the Red Hat Enterprise Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may lead to violations of confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remote...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the libqt3c102-psql package of the Debian GNU/Linux operating system may lead to violations of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...