CVE-2024-10511

CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local network repeatedly requests the /accessdenied URL...

CVE-2024-10511

CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local network repeatedly requests the /accessdenied URL...

CVE-2024-10511

The provided connected documents identify CVE-2024-10511 as an Improper Authentication (CWE-287) vulnerability in Schneider Electric PowerChute Serial Shutdown. The issue can cause Denial of Access to the PCSS web UI when a local-network attacker repeatedly requests the /accessdenied endpoint. Af...

QNAP QuTS hero Multiple Vulnerabilities (QSA-24-49)

QNAP QuTS hero is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qutshero"; ifdescriptio...

Script Injection

Tuned is vulnerable to a script injection vulnerability. The vulnerability is due to improper authentication in the instancecreate D-Bus function, which allows locally logged-in users to execute arbitrary scripts with absolute paths. Attackers can use this to escalate privileges by executing...

Vulnerabilities fixed in QNAP operating systems

QNAP has fixed vulnerabilities in several versions of their operating systems, including QTS and QuTS hero. The vulnerabilities include improper authentication, certificate validation issues, incorrect URL encryption, CRLF injection and command injection. These vulnerabilities allowed attackers t...

[SECURITY] [DLA 3989-1] ruby-doorkeeper security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3989-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk December 09, 2024 https://wiki.debian.org/LTS -...

Debian dla-3989 : ruby-doorkeeper - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3989 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3989-1 [email protected] https://www.debian.org/lts/security/...

CVE-2024-0130

NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges,...

CVE-2024-0130

NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges,...

CVE-2024-0130

NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges,...

CVE-2024-0130

CVE-2024-0130 affects NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI. The issue is an improper authentication vulnerability triggered by a malformed request over the Ethernet management interface, potentially enabling privilege escalation, data tampering, denial of service, and information...

CVE-2024-48859

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 bui...

Devolutions Remote Desktop Manager Multiple Vulnerabilities (DEVO-2024-0016)

The remote installation of Devolutions Server is affected by Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user to bypass the MFA validation via data source switching. CVE-2024-11671 Note th...

CISA Warns of Active Exploitation of Flaws in Zyxel, ProjectSend, and CyberPanel

The U.S. Cybersecurity and Infrastructure Security Agency CISA added multiple security flaws affecting products from Zyxel, North Grid Proself, ProjectSend, and CyberPanel to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation in the wild. The list of...

Phoenix Contact ILC PLCs Improper Authentication (CVE-2016-8380)

The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...

Siemens Scalance S Improper Authentication (CVE-2012-1799)

The web server on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 does not limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password. Thi...

Cisco NX-OS Improper Authentication (CVE-2014-3295)

The HSRP implementation in Cisco NX-OS 6.22a and earlier allows remote attackers to bypass authentication and cause a denial of service group-member state modification and traffic blackholing via malformed HSRP packets, aka Bug ID CSCup11309. This plugin only works with Tenable.ot. Please visit...

Phoenix Contact ILC PLCs Improper Authentication (CVE-2016-8371)

The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Cisco Small Business IP Improper Authentication (CVE-2012-0333)

Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768. This plugin only works with Tenable.ot. Please visit...