Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Role-Based Access Control Vulnerability

A vulnerability in role-based access control of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system. The vulnerability is due to...

CVE-2020-3329: Improper Access Control

A vulnerability in role-based access control of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system. The vulnerability is due to...

CVE-2020-3168

A vulnerability in the Secure Login Enhancements capability of Cisco Nexus 1000V Switch for VMware vSphere could allow an unauthenticated, remote attacker to cause an affected Nexus 1000V Virtual Supervisor Module VSM to become inaccessible to users through the CLI. The vulnerability is due to...

CVE-2020-8495

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and...

CVE-2020-8494

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the empid, userid, pw...

CVE-2020-8495

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and...

CVE-2020-8495

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and...

CVE-2020-8494: Undefined Security Weakness

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the empid, userid, pw...

Unspecified Vulnerability in Logaritmo Aware CallManager

Logaritmo Aware CallManager is an enterprise telephone call management system. A security vulnerability exists in the CSV upload feature of the /supervisor/procesacarga.php file in the 2012 version of Logaritmo Aware CallManager, which can be exploited by an attacker accessing the /supervisor/csv...

Fortinet FortiSIEM 5.2.5 / 5.2.6 Hardcoded Key

Vendor: Fortinet Product: FortiSIEM Tested version: 5.2.5, 5.2.6. I haven't confirmed older versions, but there is a good chance they're also affected. CVE: Fortinet hands out their own CVEs according to Mitre, and since no human confirmation was received by Fortinet, no CVE was created yet. ==...

Awesome Support < 6.0.0 - Stored XSS via Ticket Title

The lack of sanitisation in the posttitle of a ticket could allow users with the Support Supervisor capability to create tickets containing XSS payloads. The risk is relatively low, as CSRF checks are in place and the affected role is close to an admin one. Using the DISALLOWUNFILTEREDHTML consta...

OMRON CX-Supervisor Vulnerable Third-Party Component Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OMRON CX-Supervisor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within Teamviewer tha...

Design/Logic Flaw

In Omron CX-Supervisor, Versions 3.5 12 and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. This version of Teamviewer is vulnerable to an obsolete function vulnerability requiring user interaction to exploit...

CVE-2019-18251

In Omron CX-Supervisor, Versions 3.5 12 and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. This version of Teamviewer is vulnerable to an obsolete function vulnerability requiring user interaction to exploit...

CVE-2019-18251

CVE-2019-18251 affects Omron CX-Supervisor (versions 3.5 (12) and earlier) where CX-Supervisor ships with TeamViewer 5.0.8703 QS. The issue is a vulnerability in the bundled TeamViewer, described as an obsolete-function flaw that requires user interaction to exploit (CWE-477 per ICS update; ZDI c...

CVE-2019-18251: Use of Obsolete Function

In Omron CX-Supervisor, Versions 3.5 12 and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. This version of Teamviewer is vulnerable to an obsolete function vulnerability requiring user interaction to exploit...

Unspecified Vulnerability in Omron CX-Supervisor (CNVD-2019-42429)

Omron CX-Supervisor is a visual machine controller from Omron Japan. An unspecified vulnerability exists in CX-Supervisor, which can be exploited by an attacker to cause information disclosure, total system compromise, and denial of service...

Teamviewer CVE-2019-18251 Remote Security Vulnerability

Description Teamviewer is prone to a remote security vulnerability. An attacker can leverage this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. Teamviewer 5.0.8703 QS is vulnerable. Technologies Affected Omron CX-Supervisor 3.4.1 Omron...

Omron CX-Supervisor (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Omron Equipment: CX-Supervisor Vulnerability: Use of Obsolete Function 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-19-318-04 Omron CX-Supervisor...

Omron CX-Supervisor

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Omron Equipment: CX-Supervisor Vulnerability: Use of Obsolete Function 2. RISK EVALUATION Successful exploitation of this vulnerability could result in information disclosure, total compromise of...