Design/Logic Flaw

ubiQuoss Switch VP5208A creates a bcmpassword file at /cgi-bin/ with the user credentials in cleartext when a failed login attempt occurs. The file can be reached via an HTTP request. The credentials can be used to access the system via SSH or TELNET if it is enabled...

CVE-2018-10024

ubiQuoss Switch VP5208A creates a bcmpassword file at /cgi-bin/ with the user credentials in cleartext when a failed login attempt occurs. The file can be reached via an HTTP request. The credentials can be used to access the system via SSH or TELNET if it is enabled...

Authorization

S12700 V200R005C00, V200R006C00, V200R006C01, V200R007C00, V200R007C01, V200R007C20, V200R008C00, V200R008C06, V200R009C00, V200R010C00, S7700 V200R001C00, V200R001C01, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R006C01, V200R007C00, V200R007C01, V200R008C00, V200R008C06, V200R009C00...

CVE-2018-10024

ubiQuoss Switch VP5208A creates a bcmpassword file at /cgi-bin/ with the user credentials in cleartext when a failed login attempt occurs. The file can be reached via an HTTP request. The credentials can be used to access the system via SSH or TELNET if it is enabled...

CVE-2017-15327

CVE-2017-15327 is an improper authorization vulnerability affecting Huawei switch products (S12700, S7700, S9700 families and others with specific V200R0x firmware). The issue arises when the system fails to enforce authorization checks for information that should be accessible only to authentica...

CVE-2017-15327

S12700 V200R005C00, V200R006C00, V200R006C01, V200R007C00, V200R007C01, V200R007C20, V200R008C00, V200R008C06, V200R009C00, V200R010C00, S7700 V200R001C00, V200R001C01, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R006C01, V200R007C00, V200R007C01, V200R008C00, V200R008C06, V200R009C00...

CVE-2018-10024

The vulnerability CVE-2018-10024 affects UbiQuoss Switch VP5208A. On a failed login attempt, the device creates a bcm_password file at /cgi-bin/ containing user credentials in cleartext, which can be retrieved via an HTTP request. These credentials can be used to access the system via SSH (or TEL...

Cisco Smart Install Unauthorized Access Vulnerability

Smart Install, a plug-and-play configuration and image management feature, provides zero-configuration deployment for switches new to the network, automating the process of initial configuration and operating system image loading, as well as providing backup of configuration files. An unauthorize...

Cisco Smart Install Protocol Misuse

SIET Smart Install Exploitation Tool Cisco Smart Install is a plug-and-play configuration and image-management feature that provides zero-touch deployment for new switches. You can ship a switch to a location, place it in the network and power it on with no configuration required on the device. Y...

Cisco IOS XE Software Denial of Service Vulnerability (CNVD-2018-08474)

Cisco IOS is the interconnected Internet operating system used on most Cisco Systems routers and network switches. A security vulnerability in the Switch Integrated Security feature of Cisco IOS XE Software for handling IPv6 packets can be exploited by a remote attacker to submit a special reques...

Improper authorization vulnerability in multiple Huawei switches

Huawei S12700 is an enterprise switch product from Huawei, China.Huawei S7700 and S9700 are intelligent routing switches from Huawei, China. An improper authorization vulnerability exists in multiple Huawei switches. When a user attempts to access certain information that is only accessible to...

Cisco Smart Install Remote Code Execution(CVE-2018-0171)

Introduction Application: Cisco IOS, Cisco IOS-XE Vendor: Cisco Bugs: Stack-based buffer overflow CWE-20, CWE-121 Risk: Critical; AV:N/AC:L/Au:N/C:C/I:C/A:C 10.0 A stack-based buffer overflow vulnerability was found in Smart Install Client code. This vulnerability enables an attacker to remotely...

Security Advisory - Improper Authorization Vulnerability on Huawei Switch Products

There is an improper authorization vulnerability on Huawei switch products. The system incorrectly performs an authorization check when a normal user attempts to access certain information which is supposed to be accessed only by authenticated user. Successful exploit could cause information...

CentOS 6 : kernel (CESA-2018:0512) (Meltdown) (Spectre)

An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20180313) (Meltdown) (Spectre)

Security Fixes : - hw: cpu: speculative execution branch target injection s390-only CVE-2017-5715, Important - hw: cpu: speculative execution bounds-check bypass s390 and powerpc CVE-2017-5753, Important - hw: cpu: speculative execution permission faults handling powerpc-only CVE-2017-5754 Bug...

Microsoft Windows Hyper-V Information Disclosure Vulnerability (CNVD-2018-06785)

Microsoft Windows Server 2008 SP2 and others are a series of operating systems from Microsoft Corporation USA.Hyper-V Network Switch is one of the network switches. An information disclosure vulnerability exists in Microsoft Hyper-V Network Switch, which originates from the program failing to...

Microsoft Windows Hyper-V Denial of Service Vulnerability (CNVD-2018-06786)

Microsoft Windows Server 2008 SP2 and others are a series of operating systems from Microsoft Corporation USA.Hyper-V Network Switch is one of the network switches. A denial of service vulnerability exists in Microsoft Hyper-V Network Switch, which originates from the program failing to properly...

CVE-2018-0888

The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure...

CVE-2018-0885

The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows a denial of service vulnerability due to how input from a...

CVE-2018-0888

The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure...