15856 matches found
CVE-2021-40222
Rittal CMC PU III Web management Version affected: V3.11.002. Version fixed: V3.17.10 is affected by a remote code execution vulnerablity. It is possible to introduce shell code to create a reverse shell in the PU-Hostname field of the TCP/IP Configuration dialog. Web application fails to sanitiz...
sssd: shell command injection in sssctl
A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest...
CVE-2021-34721
Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details sectio...
CVE-2021-34721
Cisco IOS XR Software contains CLI command-injection vulnerabilities (CVE-2021-34721) that could let an authenticated, local attacker gain root access and execute arbitrary commands. Affected component is the CLI; root-shell access would be obtained locally with high privileges. Cisco has issued ...
PT-2021-17979
Name of the Vulnerable Software and Affected Versions: BAB TECHNOLOGIE GmbH eibPort V3 versions prior to 3.9.1 Description: The issue allows unauthenticated attackers to access the login service at "/webif/SecurityModule" in a brute force attack. The password could be weak and the default usernam...
CVE-2021-28909: Improper Restriction of Excessive Authentication Attempts
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brute force attack. The password could be weak and default username is known as 'admin'. This is usable and part of an attack chain to gain SS...
PT-2021-17984
Name of the Vulnerable Software and Affected Versions: BAB TECHNOLOGIE GmbH eibPort V3 versions prior to 3.9.1 Description: The issue allows users to set weak passwords because, although the password strength is displayed in the configuration tool, it is not enforced. This can be part of an attac...
PT-2021-17982
Name of the Vulnerable Software and Affected Versions: BAB TECHNOLOGIE GmbH eibPort V3 Description: The issue concerns a hard-coded and weak root SSH key passphrase, known as 'eibPort string', which is unique to each device. This passphrase can be used to gain SSH root access, representing the...
CVE-2021-40222: Improper Neutralization of Special Elements used in an OS Command
Rittal CMC PU III Web management Version affected: V3.11.002. Version fixed: V3.17.10 is affected by a remote code execution vulnerablity. It is possible to introduce shell code to create a reverse shell in the PU-Hostname field of the TCP/IP Configuration dialog. Web application fails to sanitiz...
CVE-2021-28914: Weak Password Requirements
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow the user to set a weak password because the strength is shown in configuration tool, but finally not enforced. This is usable and part of an attack chain to gain SSH root access...
CVE-2021-28912: Weak Password Requirements
BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the final part of an attack chain to gain SSH root access...
CVE-2021-28911: Improper Restriction of Excessive Authentication Attempts
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains some sensitive data e.g. device serial number. Having those info, a possible loginId can be self-calculated in a brute force attack against BMX interface. This is usable and part...
BAB Technologie Gmbh BAB TECHNOLOGIE GmbH eibPort security vulnerability
Bab Technologie Gmbh BAB TECHNOLOGIE GmbH eibPort is an application from BAB TECHNOLOGIE GmbH Bab Technologie Gmbh, Germany, for managing smart furniture devices. A security vulnerability exists in BAB TECHNOLOGIE GmbH eibPort V3, which stems from a vulnerability in versions prior to 3.9.1 that...
BAB TECHNOLOGIE GmbH eibPort Access Control Vulnerability
Bab Technologie Gmbh BAB TECHNOLOGIE GmbH eibPort is an application from BAB TECHNOLOGIE GmbH Bab Technologie Gmbh, Germany, for managing smart furniture devices. A security vulnerability exists in BAB TECHNOLOGIE GmbH eibPort V3, which stems from a vulnerability in versions prior to 3.9.1 that...
BAB TECHNOLOGIE GmbH eibPort security vulnerabilities
Bab Technologie Gmbh BAB TECHNOLOGIE GmbH eibPort is an application from BAB TECHNOLOGIE GmbH Bab Technologie Gmbh, Germany, for managing smart furniture devices. A security vulnerability exists in BAB TECHNOLOGIE GmbH eibPort V3, which stems from a weak password in versions prior to 3.91. An...
CVE-2021-28913: Missing Authentication for Critical Function
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /webif/SecurityModule to validate the so called and hard coded unique 'eibPort String' which acts as the root SSH key passphrase. This is usable and part of an attack chain to gain SSH root access...
CVE-2021-34722
Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details sectio...
CVE-2021-3054
A time-of-check to time-of-use TOCTOU race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-...
