7366 matches found
CVE-2023-41999
An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that allows them to authenticate to the management console and perform tasks that require authentication...
CVE-2023-41999
An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that allows them to authenticate to the management console and perform tasks that require authentication...
Design/Logic Flaw
Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacker to upload and execute arbitrary files...
Path traversal
Arcserve UDP prior to 9.2 contains a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload. An unauthenticated remote attacker can exploit it to upload arbitrary files to any location on the file system where the UDP agent is installed...
CVE-2023-42000 Arcserve UDP Agent Unauthenticated Path Traversal File Upload
Arcserve UDP prior to 9.2 contains a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload. An unauthenticated remote attacker can exploit it to upload arbitrary files to any location on the file system where the UDP agent is installed...
CVE-2023-42000
CVE-2023-42000 affects Arcserve UDP, with a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload() that allows unauthenticated remote attackers to upload arbitrary files to locations on the UDP agent’s file system. Affected: Arcserve UDP prior to 9.2. Imp...
CVE-2023-41999 Arcserve UDP Management Authentication Bypass
An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that allows them to authenticate to the management console and perform tasks that require authentication...
CVE-2023-41999
Summary: CVE-2023-41999 affects Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier, allowing authentication to the management console and action on authenticated tasks. What’s affected: Arcserve UDP (management console) before v9.2....
CVE-2023-41998
Summary: CVE-2023-41998 affects Arcserve UDP prior to 9.2 via the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine allows uploading and executing arbitrary files, enabling unauthenticated remote exploitation as described in multiple sources. Affected product/version: Arcserv...
CVE-2023-41998 Arcserve UDP Unauthenticated RCE
Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacker to upload and execute arbitrary files...
Fedora: Security Advisory (FEDORA-2023-d9d55a0bfc)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2023-42770
Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentication challenge...
Authentication flaw
Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentication challenge...
CVE-2023-40151
When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP t...
Authentication flaw
When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP t...
CVE-2023-42770 Red Lion Controls Sixnet RTU Authentication Bypass Using An Alternative Path Or Channel
Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentication challenge...
CVE-2023-42770 Red Lion Controls Sixnet RTU Authentication Bypass Using An Alternative Path Or Channel
Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentication challenge...
CVE-2023-40151
CVE-2023-40151 affects Red Lion SixTRAK and VersaTRAK RTUs. Two flaws enable: (1) CVE-2023-42770 authentication bypass where UDP requires auth but TCP messages are accepted without challenge; (2) CVE-2023-40151 remote code execution via Sixnet UDR shell command execution, allowing root privileges...
CVE-2023-40151 Red Lion Controls Sixnet RTU Exposed Dangerous Method Or Function
When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP t...
ArubaOS 10.3.x < 10.4.0.3 / 10.5.x.x < 10.5.0.1 Multiple Vulnerabilities (ARUBA-PSA-2023-017)
The version of ArubaOS installed on the remote host is affected by multiple vulnerabilities: - Multiple Denial of Service DoS vulnerabilities exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the...