Unspecified vulnerability in slpjs

slpjs is a JavaScript library for validating and building the Simple Ledger Protocol SLP. A security vulnerability exists in versions of slpjs prior to 0.27.2 that can be exploited by an attacker to prevent users from generating tokens tokens...

CVE-2019-9102

An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. A predictable mechanism of generating tokens allows remote attackers to bypass the cross-site request forgery CSRF protection...

Cross site request forgery (csrf)

An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. A predictable mechanism of generating tokens allows remote attackers to bypass the cross-site request forgery CSRF protection...

CVE-2019-9102

CVE-2019-9102 affects Moxa MB3xxx Protocol Gateways: MB3170/MB3270 firmware <=4.0, MB3280/MB3480 <=3.0, MB3660 <=2.2, and MB3180

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 allows a hacker to perform arbitrary actions on the vulnerable device.

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 is related to a predictable algorithm for token generation. Exploiting this vulnerability allows an attacker operating remotely to perform arbitrary...

CVE-2019-10754

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong...

CVE-2019-10754

CVE-2019-10754 affects Apereo CAS before release 6.1.0-RC5. The root cause is the use of apache commons-lang3’s RandomStringUtils for token and ID generation, whose PRNG is not cryptographically strong, making generated values predictable. This predictability can enable an attacker to infer token...

Huawei B315s-22 Information Disclosure

Product Family: LTE Model B315s a 22 Firmware version: 21.318.01.00.26 Author: Usman Saeed usman at xc0re.net 1. Unauthenticated access to sensitive files: It was observed that the web application running on the router, allows unauthenticated access to sensitive files on the web server. POC: By...

Huawei B315s-22 - Information Leak Vulnerability

Exploit for hardware platform in category web applications Product Family: LTE Model B315s – 22 Firmware version: 21.318.01.00.26 Author: Usman Saeed usman at xc0re.net 1. Unauthenticated access to sensitive files: It was observed that the web application running on the router, allows...

Huawei B315s-22 - Information Leak

Product Family: LTE Model B315s – 22 Firmware version: 21.318.01.00.26 Author: Usman Saeed usman at xc0re.net 1. Unauthenticated access to sensitive files: It was observed that the web application running on the router, allows unauthenticated access to sensitive files on the web server. POC: By...

CVE-2018-14709

Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation...

Authentication flaw

Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation...

CVE-2018-14709

Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation...

CVE-2018-14709

CVE-2018-14709 affects Drobo 5N2 NAS (Dashboard API) where insecure token generation allows authentication bypass. Public details in the provided documents indicate remote command injection via the NASd service, enabling attackers to perform actions such as querying device status, installing appl...

CVE-2018-1000554

Trovebox version = 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user component that can result in Password reset. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed...

Security Bulletin: API Connect is affected by a vulnerability by which an authenticated user could generate an API token

Summary API Connect has addressed the following vulnerability. An authenticated user could be allowed to generate an API token when not subscribed to the application plan. Vulnerability Details CVEID: CVE-2017-1555 DESCRIPTION: IBM API Connect could allow an authenticated user to generate an API...

Trovebox Insecure Password Reset Token Generation Vulnerability

Trovebox is an open source image sharing and management platform. user is one of the user components. A security vulnerability exists in the user component of Trovebox prior to version 4.0.0-rc6, which stems from the program failing to create a secure password reset token. An attacker can exploit...

CVE-2017-16028

react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG Math.random...

New multiOverflow Bug Identified in Multiple ERC20 Smart Contracts (CVE-2018-10706)

Our vulnerability-scanning system at PeckShield has so far discovered several dangerous smart contract vulnerabilities batchOverflow, proxyOverflow, transferFlaw, ownerAnyone. Some of them could be used by attackers to generate tokens out of nowhere while others can be used to steal tokens from...

Unauthenticated Access

spring-cloud-sso-connector is vulnerable to unauthenticated access. The vulnerability exists due to a regression caused in version 2.1.2, which disables issuer validation in resource servers when PCF is deployed with multiple SSO service plans, allowing malicious users to authenticate to unbound...