CVE-2021-28501

An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration...

CVE-2021-35034

An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted...

The vulnerability of the Ethernet software solutions WISE-4060, Adam-6050 D, and Adam.NET Utility lies in the lack of authentication attempt limits, allowing attackers to gain full access to the device.

The vulnerability of the Microprogrammed Ethernet module WISE-4060, Adam-6050 D, and Adam.NET Utility is related to the absence of authentication attempt limits. Exploiting this vulnerability can allow a malicious actor to gain full access to the device remotely...

CVE-2021-27451

Mesa Labs AmegaView Versions 3.0 and prior’s passcode is generated by an easily reversible algorithm, which may allow an attacker to gain access to the device...

Design/Logic Flaw

Mesa Labs AmegaView Versions 3.0 and prior’s passcode is generated by an easily reversible algorithm, which may allow an attacker to gain access to the device...

Solar-Log 500 has an unspecified vulnerability

Solar-Log is a data logger used to monitor photovoltaic power plants from Solar-Log GmbH in Germany. Solar-Log 500 has a security vulnerability that could be exploited by an attacker with access to the device to read sensitive information...

The vulnerability of microprogrammed software in programmable logic controllers like ioLogik, related to deficiencies in access control, allows a intruder to gain access to the device.

The vulnerability of microprogrammed software in programmable logic controllers like ioLogik is related to deficiencies in access control. Exploiting this vulnerability can allow an intruder to gain access to the device...

Huawei Imanager NetEco 数据伪造问题漏洞

Huawei Imanager NetEco is a professional energy infrastructure management platform from Huawei of China. It is used to provide accurate operations and maintenance management. Huawei iManager NetEco has a security vulnerability that could be exploited by attackers to forge signatures, bypass...

CVE-2021-38394

An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted...

DEBIAN-CVE-2021-30597

Use after free in Browser UI in Google Chrome on Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via physical access to the device...

All Bachmann M1 System Processor Modules

1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Bachmann Electronic, GmbH Equipment: All M-Base Controllers Vulnerability: Use of Password Hash with Insufficient Computational Effort 2. REPOSTED INFORMATION This updated advisory is a follow-up to the...

Authentication flaw

Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a denial of...

HPE RDA-CAS 1.23.826 Denial Of Service Exploit

!/usr/bin/python -- coding: UTF-8 -- hpfreeze.py HPE Remote Device Access Unauthenticated Denial of Service Jeremy Brown jbrown3264/gmail June 2021 "Designed for the enterprise, HPE RDA Remote Device Access provides integrated remote connectivity for support automation, device telemetry and remot...

HPE RDA-CAS 1.23.826 Denial Of Service

!/usr/bin/python -- coding: UTF-8 -- hpfreeze.py HPE Remote Device Access Unauthenticated Denial of Service Jeremy Brown jbrown3264/gmail June 2021 "Designed for the enterprise, HPE RDA Remote Device Access provides integrated remote connectivity for support automation, device telemetry and remot...

MesaLabs AmegaView 授权问题漏洞

MesaLabs AmegaView is a continuous monitoring system CMS from MesaLabs USA. A security vulnerability exists in MesaLabs AmegaView version 3.0 and prior versions. An attacker could exploit the vulnerability to gain access to the device...

The vulnerability of the Microsoft Accessibility Insights browser extension, related to the lack of data protection for service data, allows a malicious actor to gain unauthorized access to the device.

The vulnerability of the Microsoft Accessibility Insights browser extension is related to the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the device through a specially created web page...

CVE-2021-32454

SITEL CAP/PRX firmware version 5.2.01 makes use of a hardcoded password. An attacker with access to the device could modify these credentials, leaving the administrators of the device without access...

Vulnerability of the sub-component of the French HR component of the Oracle HRMS system, a business automation system from Oracle E-Business Suite. This component allows unauthorized access by attackers to devices.

The vulnerability of the sub-component of the French HR component of the Oracle HRMS system, a business automation system from Oracle’s E-Business Suite, is related to code errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device...

CS Money: Previously created sessions continue being valid after MFA activation

Summary: Hi, team. This is the same issue of 667739. Please take a look. I found one issue related to your 2FA system on https://cs.money/security/ Steps To Reproduce: 1. access the same account on https://cs.money/ in two devices 1. on device 'A' go to https://cs.money/security/ complete all ste...

Arbitrary File Read Vulnerability in Device Access Gateway of Zhejiang Dahua Corporation Technology Co.

Zhejiang Dahua Technology Co., Ltd. is a video-centered intelligent IOT solution provider and operation service provider. An arbitrary file read vulnerability exists in the device access gateway of Zhejiang Dahua Technology Co. Ltd, which can be exploited by attackers to obtain sensitive...