223 matches found
CVE-2023-39909
Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application...
CVE-2023-39909
CVE-2023-39909 affects Ericsson Network Manager prior to 23.2. The vulnerability arises from mishandled access control, allowing unauthenticated low‑privilege users to access the NCM application (impacting confidentiality, integrity, and availability). The issue is documented across multiple sour...
CVE-2023-40055 SolarWinds Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability
The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. We found this issue was not resolved in CVE-2023-33227...
Cross site scripting
An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hijacking...
CVE-2023-29505
An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hijacking...
SUSE CVE-2016-3951
Double free vulnerability in drivers/net/usb/cdcncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service system crash or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor...
PT-2023-35033 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.8 Description: A potential NULL pointer dereference issue exists in the ncm bitrate function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...
PT-2023-34911 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.304 Description: A potential NULL pointer dereference issue exists in the ncm bitrate function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel version...
PT-2023-9443 · Linux +4 · Linux Kernel +4
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.10.149-android13 Description: The vulnerability is related to a potential NULL pointer dereference in the ncm bitrate function. This issue can cause a crash when the cdev-gadget pointer is NULL, leading to a...
SolarWinds Orion Arbitrary File Write (CVE-2020-27871)
An arbitrary file write vulnerability exists in SolarWinds Network Configuration Manager. The vulnerability is due to insufficient validation of file types for vulnerability announcement data files in VulnerabilitySettings.aspx, combined with a lack of restriction on destination paths. A remote,...
CVE-2021-35226
An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service SWIS. Exposed credentials are encrypted and require authenticated access with an NCM role...
CVE-2021-35226
An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service SWIS. Exposed credentials are encrypted and require authenticated access with an NCM role...
Design/Logic Flaw
An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service SWIS. Exposed credentials are encrypted and require authenticated access with an NCM role...
CVE-2021-35226 Hashed Credential Exposure Vulnerability
An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service SWIS. Exposed credentials are encrypted and require authenticated access with an NCM role...
ManageEngine NCM 12.5.x < 12.5.657 / 12.6.x < 12.6.002 / 12.6.104 / 12.6.118 Authenticate Bypass
The version of ManageEngine NCM running on the remote web server 12.5.x prior to 12.5.657, or 12.6.x prior to 12.6.002 / 12.6.104 / 12.6.118. It is, there, affected by an authentication bypass vulnerability. Due to the lack of proper request handling an unauthenticated, remote attacker can retrie...
ManageEngine NCM 12.5.x < 12.5.658 / 12.6.x < 12.6.003 / 12.6.105 / 12.6.120 RCE
ManageEngine NCM 12.5.x prior to 12.5.658, or 12.6.x prior to 12.6.003 / 12.6.105 / 12.6.120 can allow authenticated users to make database changes that lead to remote code execution. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported...
GSD-2022-1000816 CDC-NCM: avoid overflow in sanity checking
CDC-NCM: avoid overflow in sanity checking This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.26 by commit...
PT-2022-7498 · Linux +5 · Linux Kernel +5
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the CDC-NCM component in the Linux kernel, where a broken device may provide an extreme offset and a reasonable length for a fragment, causing an integer overfl...
ManageEngine NCM < 12.5.465 SQLi
A SQL injection vulnerability exists in ManageEngine NCM prior to 12.5.465, due to an issue in configuration search. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 70300 C Tenable, Inc...