CVE-2017-12115

CVE-2017-12115 affects cpp-ethereum’s JSON-RPC endpoint miner_setEtherbase. The root cause is improper authorization: the function does not perform a user privilege check, allowing the execution of restricted functionality via a JSON request. The vulnerability is demonstrated by the existence of ...

CVE-2017-12112

The CVE-2017-12112 entry corresponds to an authorization bypass in cpp-ethereum’s JSON-RPC admin_addPeer API. Talos reports an improper authorization check in AdminNet::admin_addPeer that allows a remote attacker to trigger restricted functionality without credentials, with the call binding to 0....

CVE-2017-12117

CVE-2017-12117 affects cpp-ethereum’s JSON-RPC miner_start API. The root cause is improper authorization checks in the miner_start implementation, allowing a remote attacker to trigger restricted functionality without credentials. Affected component is the JSON-RPC server inside cpp-ethereum (com...

CVE-2017-12115: Incorrect Authorization

An exploitable improper authorization vulnerability exists in minersetEtherbase API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass...

PT-2018-5359 · Ethereum · Cpp-Ethereum

Name of the Vulnerable Software and Affected Versions: cpp-ethereum version affected versions not specified Description: An issue exists in the miner stop API endpoint of cpp-ethereum's JSON-RPC, where improper authorization can be exploited. An attacker can send JSON data to trigger this issue...

CVE-2017-12117: Incorrect Authorization

An exploitable improper authorization vulnerability exists in minerstart API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this...

CVE-2017-12114: Incorrect Authorization

An exploitable improper authorization vulnerability exists in adminpeers API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this...

CVE-2017-12118: Incorrect Authorization

An exploitable improper authorization vulnerability exists in minerstop API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. An attacker can send JSON to trigger this vulnerability...

CVE-2017-12113: Incorrect Authorization

An exploitable improper authorization vulnerability exists in adminnodeInfo API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger th...

CVE-2017-11398: Improper Authorization

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server Standalone versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system...

CVE-2017-12112: Incorrect Authorization

An exploitable improper authorization vulnerability exists in adminaddPeer API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger thi...

CVE-2017-12116: Incorrect Authorization

An exploitable improper authorization vulnerability exists in minersetGasPrice API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger...

PT-2018-5353 · Ethereum · Cpp-Ethereum

Name of the Vulnerable Software and Affected Versions: cpp-ethereum version affected versions not specified Description: An improper authorization issue exists in the admin addPeer API endpoint of cpp-ethereum's JSON-RPC. This allows a JSON request to access restricted functionality, resulting in...

CVE-2017-12197: Incorrect Authorization

It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information...

CVE-2017-16743

An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to craft special HTTP requests allowing an attacker to bypass web-service authentication allowing t...

CVE-2017-16743

An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to craft special HTTP requests allowing an attacker to bypass web-service authentication allowing t...

CVE-2017-16743

PHOENIX CONTACT FL SWITCH series (3xxx, 4xxx, 48xxx) running firmware 1.0–1.32 are affected by CVE-2017-16743, an Improper Authorization vulnerability. A remote unauthenticated attacker can craft special HTTP requests to bypass web-service authentication and gain administrative privileges on the ...

CVE-2017-16743: Improper Authorization

An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to craft special HTTP requests allowing an attacker to bypass web-service authentication allowing t...

PHOENIX CONTACT FL SWITCH

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: PHOENIX CONTACT Equipment: FL SWITCH Vulnerabilities: Improper Authorization, Information Exposure AFFECTED PRODUCTS All FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32 are affecte...

PT-2018-1007

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products versions 1.0 through 1.32 Description An issue with improper authorization was found, allowing a remote unauthenticated attacker to craft special HTTP requests to bypass web-servi...