CVE-2017-8194

The FusionSphere OpenStack V100R006C00SPC102NFV has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message...

JanTek JTC-200 RS232-NET Connector CSRF / Missing Authentication

Vendor: JanTek Equipment: JTC-200 Vulnerabilities: Cross-site Request Forgery, Improper Authentication Advisory URL: https://ipositivesecurity.com/2017/10/28/ics-jantek-jtc-200-rs232-net-converter-advisory-published/ ICS-CERT Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-283-02 CVE-ID...

Circle with Disney Apid Strstr Authentication Bypass Vulnerability

Summary An exploitable authentication bypass vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A specially crafted token can bypass the authentication routine of the Apid binary, causing the device to grant unintended administrative access. An attacker needs...

actionpack Improper Authentication vulnerability

The decodecredentials method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access...

GHSA-92W9-2PQW-RHJJ actionpack Improper Authentication vulnerability

The decodecredentials method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access...

CVE-2017-9625

An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. The web application lacks proper authentication which could allow an attacker to view information and modify settings or execute code remotely...

CVE-2017-9625

An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. The web application lacks proper authentication which could allow an attacker to view information and modify settings or execute code remotely...

CVE-2017-9625

An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. The web application lacks proper authentication which could allow an attacker to view information and modify settings or execute code remotely...

CVE-2017-9625

The CVE-2017-9625 entry concerns Envitech EnviDAS Ultimate web application authentication bypass. Affected: EnviDAS Ultimate versions prior to v1.0.0.5. Issue: improper authentication allowing an attacker to view information, modify settings, or remotely execute code. CVSS v3 base score 8.2 (AV:N...

CVE-2016-5791

An Improper Authentication issue was discovered in JanTek JTC-200, all versions. The improper authentication could provide an undocumented BusyBox Linux shell accessible over the TELNET service without any authentication...

Authentication flaw

An Improper Authentication issue was discovered in JanTek JTC-200, all versions. The improper authentication could provide an undocumented BusyBox Linux shell accessible over the TELNET service without any authentication...

CVE-2016-5791

The CVE-2016-5791 entry concerns JanTek JTC-200 (TCP/IP converter). The connected advisory confirms two vulnerabilities: (1) Cross-Site Request Forgery (CSRF) and (2) Improper Authentication that lets an unauthenticated user access an undocumented BusyBox shell over Telnet. All JTC-200 versions a...

CVE-2016-5791

An Improper Authentication issue was discovered in JanTek JTC-200, all versions. The improper authentication could provide an undocumented BusyBox Linux shell accessible over the TELNET service without any authentication...

VulnCheck KEV: CVE-2016-7836

SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program...

Envitech Ltd. EnviDAS Ultimate

CVSS v3 8.2 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Envitech Ltd. Equipment: EnviDAS Ultimate Vulnerability: Improper Authentication AFFECTED PRODUCTS The following versions of EnviDAS Ultimate, a web application for environmental monitoring, are affected: EnviDAS...

JanTek JTC-200

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available. Vendor: JanTek Equipment: JTC-200 Vulnerabilities: Cross-site Request Forgery, Improper Authentication AFFECTED PRODUCTS The following versions of JTC-200, a TCP/IP converter, are affected:...

CVE-2017-14000

An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11. By accessing a specific uniform resource locator URL on the web server, a malicious user is able to access the application without authenticating...

Authentication flaw

An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does not properly authenticate users, which may allow a malicious attacker to access sensitive information such as HMI pages or modify PLC variables...

Authentication flaw

An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11. By accessing a specific uniform resource locator URL on the web server, a malicious user is able to access the application without authenticating...

CVE-2017-14000

CVE-2017-14000 affects Ctek SkyRouter Series 4200/4400 (all versions before V6.00.11). The vulnerability is an Improper Authentication that allows access to the web application without authenticating by hitting a specific URL. MITRE-style details from the provided sources indicate the impact as u...