328 matches found
Cross-site Request Forgery (CSRF)
apache solr is vulnerable to cross-site request forgery CSRF. A remote attacker with access to the server could perform HTTP GET requests to any reachable URL on behalf of the user. This is due to the shards parameter not having a corresponding whitelist mechanism, disallowing the server to...
CVE-2019-12500
The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no server-side authentication check. Other affected commands include suddenly braking, locking, and unlocking...
pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local privesc
A flaw was found in the way pacemaker's client-server authentication was implemented. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation...
pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local privesc
A flaw was found in the way pacemaker's client-server authentication was implemented. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation...
CVE-2018-16877
A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation...
CVE-2018-16877
A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation...
USN-3795-3 libssh regression
USN-3795-1 and USN-3795-2 fixed a vulnerability in libssh. The upstream fix introduced a regression. This update fixes the problem. Original advisory details: Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this...
USN-3796-1 paramiko vulnerability
Daniel Hoffman discovered that Paramiko incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials...
USN-3795-1 libssh vulnerability
Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials...
F5 BIG-IP HTTPS health monitors design vulnerability
F5 BIG-IP LTM and so on are the products of F5 Corporation in the U.S.A. F5 BIG-IP LTM is a local traffic manager; BIG-IP AAM is an application acceleration manager; BIG-IP HTTPS health monitors is one of the HTTPS status monitoring programs. A security vulnerability exists in F5 BIG-IP HTTPS...
CVE-2018-0251
A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer SSL VPN portal of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of that portal on an...
Cisco ASA Cross-Site Scripting Vulnerability
Cisco 3000 Series Industrial Security Appliances etc. are different series of security appliances from Cisco.Adaptive Security Appliance ASA Software is one of the operating systems.Clientless Secure Sockets Layer SSL VPN is one of the SSL Secure Sockets Layer VPN applications. A cross-site...
CVE-2018-0251: Improper Neutralization of Input During Web Page Generation
A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer SSL VPN portal of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of that portal on an...
CVE-2018-6231
A server auth command injection authentication bypass vulnerability in Trend Micro Smart Protection Server Standalone versions 3.3 and below could allow remote attackers to escalate privileges on vulnerable installations...
HTTP Server Authentication Succeeded
This is an informational notice that the scanner was able to successfully authenticate against the web server using HTTP server credentials provided in the scan policy. No source data...
The vulnerability in the server component of the SAP POS software for automating accounting, sales, and production processes allows a perpetrator to read and delete files, shut down the Xpress Server, view the contents of the POS terminal, and attack user accounts.
The vulnerability in the server component of the SAP POS software for accounting, trading, and production automation lies in the absence of authentication procedures during file reading, operation completion, daemon shutdown, and terminal reading. Exploiting this vulnerability allows a malicious...
Design/Logic Flaw
In X.Org Server aka xserver and xorg-server before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp...
CVE-2017-7926
A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 1.9.0. The vulnerability allows cross-site request forgery CSRF attacks to occur when an otherwise-unauthorized cross-site request is sent from a browser the server has previously authenticated...