CVE-2017-12695

An Improper Authentication issue was discovered in General Motors GM and Shanghai OnStar SOS SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to subvert security mechanisms and reset a user account password...

CVE-2017-12695

CVE-2017-12695 affects the Shanghai OnStar iOS Client (GM SOS) version 7.1. The vulnerability is described as an Improper Authentication flaw that could allow an attacker to subvert security mechanisms and reset a user account password. Connected sources also reference related issues in the same ...

CVE-2017-14018

Affected product : Ethicon Endo-Surgery Generator Gen11 (all versions released before 2017-11-29). Vulnerability : Improper Authentication (CWE-287) where the security mechanism between Gen11 and single-patient use products can be bypassed, allowing unauthorized devices to connect and potentially...

CVE-2017-14018

An improper authentication issue was discovered in Johnson & Johnson Ethicon Endo-Surgery Generator Gen11, all versions released before November 29, 2017. The security authentication mechanism used between the Ethicon Endo-Surgery Generator Gen11 and single-patient use products can be bypassed,...

CVE-2017-10903

PTW-WMS1 firmware 2.000.012 has an improper authentication vulnerability (CVE-2017-10903) that lets remote attackers log in with root privileges and perform arbitrary operations via unspecified vectors. Affected product: Princeton PTW-WMS1 wireless storage; root cause is inadequate authentication...

Princeton PTW-WMS1 Improper Authentication Vulnerability

The Princeton PTW-WMS1 is a wireless storage device from Princeton Japan. A security vulnerability exists in the Princeton PTW-WMS1 using firmware version 2.000.012. A remote attacker can exploit the vulnerability to log in to the device with root privileges and perform arbitrary operations...

CRITICAL CODESYS VULNERABILITIES IN WAGO PFC 200 SERIES

VENDOR DESCRIPTION “The WAGO-I/O-SYSTEM is a flexible fieldbus-independent solution for decentralized automation tasks. With the relay, function and interface modules, as well as overvoltage protection, WAGO provides a suitable interface for any application.” Source:...

Multiple vulnerabilities in Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1

Overview Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1 provided by Princeton Ltd. is a Wi-Fi storage. Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1 contains multiple vulnerabilities listed below. Improper Access Restriction CWE-284 - CVE-2017-10900 Buffer Overflow CWE-119 -...

Siemens SWT3000

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: SWT3000 Vulnerabilities: Improper Authentication, Authentication Bypass, Improper Input Validation. AFFECTED PRODUCTS Siemens reports that the vulnerabilities affect the following SWT 3000...

Ethicon Endo-Surgery Generator G11 Vulnerability

OVERVIEW Johnson & Johnson, the parent company of Ethicon Endo-Surgery, LLC, reported an improper authentication vulnerability in the Ethicon Endo-Surgery Generator Gen11. EthiconEndo-Surgery, LLC has produced updates that mitigate this vulnerability in the affected product. AFFECTED PRODUCTS The...

CVE-2017-8194

The FusionSphere OpenStack V100R006C00SPC102NFV has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message...

CVE-2017-8194

The FusionSphere OpenStack V100R006C00SPC102NFV has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message...

CVE-2017-8195

The FusionSphere OpenStack V100R006C00SPC102NFV has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message...

CVE-2017-8194

CVE-2017-8194 affects FusionSphere OpenStack V100R006C00SPC102 (NFV). An improper authentication on a single port lets an authenticated, remote attacker send a crafted REST message to perform additional operations. The CVE entry includes a high-level impact (partial to high confidentiality/integr...

CVE-2017-8195

The FusionSphere OpenStack V100R006C00SPC102NFV has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message...

CVE-2017-8194

The FusionSphere OpenStack V100R006C00SPC102NFV has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message...

JanTek JTC-200 RS232-NET Connector CSRF / Missing Authentication

Vendor: JanTek Equipment: JTC-200 Vulnerabilities: Cross-site Request Forgery, Improper Authentication Advisory URL: https://ipositivesecurity.com/2017/10/28/ics-jantek-jtc-200-rs232-net-converter-advisory-published/ ICS-CERT Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-283-02 CVE-ID...

Circle with Disney Apid Strstr Authentication Bypass Vulnerability

Summary An exploitable authentication bypass vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A specially crafted token can bypass the authentication routine of the Apid binary, causing the device to grant unintended administrative access. An attacker needs...

actionpack Improper Authentication vulnerability

The decodecredentials method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access...

GHSA-92W9-2PQW-RHJJ actionpack Improper Authentication vulnerability

The decodecredentials method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access...