Debian DSA-4589-1 : debian-edu-config - security update

It was discovered that debian-edu-config, a set of configuration files used for the Debian Edu blend, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other user principals. C Tenable Network Security, Inc. The descriptive text and package checks in...

[SECURITY] [DSA 4589-1] debian-edu-config security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4589-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 18, 2019 https://www.debian.org/security/faq -...

PT-2019-5234 · Mit +2 · Kerberos +3

Name of the Vulnerable Software and Affected Versions: Debian-edu-config versions prior to 2.11.10 debian-lan-config versions prior to 0.26 Description: The issue is related to a security flaw in privilege management. Exploitation of this flaw can allow an attacker to gain unauthorized access to...

CVE-2019-18284

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. The AdminService is available without authentication on the Application Server. An attacker can use methods exposed via this interface to receive password hashes of other users and to change...

Design/Logic Flaw

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. The AdminService is available without authentication on the Application Server. An attacker can use methods exposed via this interface to receive password hashes of other users and to change...

Siemens SPPA-T3000 Application Server Improper Authentication Vulnerability (CNVD-2019-45416)

SPPA-T3000 is a distributed control system mainly used in thermal power plants and large-scale renewable energy power plants.Application Server is the application server in it, which provides the main system services including access control, distribution of data to thin clients and archiving. A...

ClonOs WEB UI 19.09 - Improper Access Control

ClonOs WEB UI 19.09 - Improper Access Control Exploit Title: ClonOs WEB UI 19.09 - Improper Access Control Date: 2019-10-19 Exploit Author: İbrahim Hakan Şeker Vendor Homepage: https://clonos.tekroutine.com/ Software Link: https://github.com/clonos/control-pane Version: 19.09 Tested on: ClonOs CV...

CVE-2019-16261

Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet. NOTE: the vendor's position is that a newer firmware version, fixing this...

MGASA-2019-0237 Updated webmin packages fix security vulnerability

Updated webmin package fixes security vulnerability: Webmin before 1.930 allows remote exploits if the option to change expired passwords is enabled CVE-2019-15107. Note that it is only vulnerable if changing of expired passwords is enabled, which is not the case by default...

Adive Framework 2.0.7 - Cross-Site Request Forgery

Adive Framework 2.0.7 - Cross-Site Request Forgery Exploit Title: Adive Framework 2.0.7 – Cross-Site Request Forgery CSRF Date:02/08/2019. Exploit Author: Pablo Santiago Vendor Homepage: https://adive.es Software Link: https://github.com/ferdinandmartin/adive-php7 Version: 2.0.7 Tested on: Window...

CVE-2016-10859

cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands SEC-65...

CVE-2016-10859

cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands SEC-65...

CVE-2016-10859

cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands SEC-65...

CVE-2016-10859

CVE-2016-10859 affects cPanel before 11.54.0.0. The issue allows unauthorized password changes through Webmail API commands (SEC-65). Root cause details are not expanded beyond the description in the provided documents. Exploitation status and concrete remediation steps are not specified in the c...

CVE-2018-20862

cPanel before 76.0.8 unsafely performs PostgreSQL password changes SEC-366...

Moxa OnCell G3100-HSPA Security Bypass Vulnerability

Moxa OnCell G3100-HSPA is a G3100-HSPA series cellular network gateway device from Moxa, Taiwan, China. A security vulnerability exists in Moxa OnCell G3100-HSPA 1.4 Build 16062919 and earlier versions. The vulnerability can be exploited by an attacker to bypass authentication and access the web...

CVE-2017-14728

An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this exploit. Also, the SiteOmat does not force administrators to switch passwords, leaving SSH and HTTP remote authentication open to public...

HaPe PKH 1.1 - Cross-Site Request Forgery (Update Admin)

HaPe PKH 1.1 - Cross-Site Request Forgery Update Admin Exploit Title: HaPe PKH 1.1 - Cross-Site Request Forgery Update Admin Dork: N/A Date: 2018-10-12 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.sitejo.id Software Link: https://sourceforge.net/projects/hape-pkh/files/latest/download...

CVE-2018-15901

e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators...

Intex N150 Device Cross-Site Request Forgery Vulnerability

Intex N150 devices is a wireless router product from Intex Technologies, India. A cross-site request forgery vulnerability exists in the router firmware in Intex N150 devices. A remote attacker can exploit this vulnerability to change user passwords and router settings...