Authentication flaw

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The dongle opens an unprotected wireless LAN that cannot be configured with encryption or a password. This enables anyone within the range of the WLAN to connect to the network without authentication...

Vgate iCar2 WiFi OBD2 Dongle Inadequate Access Protections

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Unprotected WiFi access & Unencrypted data transfer product: Vgate iCar 2 WiFi OBD2 Dongle vulnerable version: Vgate iCar 2 WiFi OBD2 Dongle fixed version: - CVE number:...

CVE-2018-9105

NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC service. This XPC service is responsible for receiving and processing new OpenVPN connection requests from the main application. Unfortunately...

CVE-2018-7204

inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the wp-config.php file using this plugin, the wp-config.php contents get added to log.txt, which is not protected and...

Unprotected AWS Bucket Exposes 50.4 GB of Financial Giant’s Data

By Waqas Another day, another AWS Bucket exposed to the public - This This is a post from HackRead.com Read the original post: Unprotected AWS Bucket Exposes 50.4 GB of Financial Giant's Data...

CVE-2017-17101

An issue was discovered in Apexis APM-H803-MPC software, as used with many different models of IP Camera. An unprotected CGI method inside the web application permits an unauthenticated user to bypass the login screen and access the webcam contents including: live video stream, configuration file...

CVE-2017-17101

The CVE-2017-17101 issue affects Apexis APM-H803-MPC software used on various IP cameras. A web application CGI entry point is unprotected, allowing an unauthenticated user to bypass login and access webcam contents, including live video streams, configuration files with passwords, and system inf...

PureVPN for macOS Elevation of Privilege Vulnerability

PureVPN for macOS is a suite of VPN software for the macOS platform. A security vulnerability exists in version 6.0.1 of PureVPN for macOS based platform, which stems from HelperTool LaunchDaemon implementing an unprotected XPC service. An attacker can exploit the vulnerability to execute system...

CVE-2018-6823

In the VPN client in Mailbutler Shimo before 4.1.5.1 on macOS, the com.feingeist.shimo.helper tool LaunchDaemon implements an unprotected XPC service that can be abused to execute scripts as root...

CVE-2017-12740

Siemens LOGO! Soft Comfort All versions before V8.2 lacks integrity verification of software packages downloaded via an unprotected communication channel. This could allow a remote attacker to manipulate the software package while performing a Man-in-the-Middle MitM attack...

CVE-2017-17809

In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forci...

CVE-2017-16731

An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 including Ellipse Select. A vulnerability exists in the authentication of Ellipse to LDAP/AD using the LDAP protocol. An attacker could exploit the vulnerability by...

CVE-2017-16731

An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 including Ellipse Select. A vulnerability exists in the authentication of Ellipse to LDAP/AD using the LDAP protocol. An attacker could exploit the vulnerability by...

CVE-2017-16731

An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 including Ellipse Select. A vulnerability exists in the authentication of Ellipse to LDAP/AD using the LDAP protocol. An attacker could exploit the vulnerability by...

CVE-2017-16731

The CVE-2017-16731 entry concerns ABB Ellipse versions 8.3–8.9 (including Ellipse Select) with an unprotected transport of credentials when authenticating to LDAP/AD via LDAP. The root cause is insecure credential transmission over the network, enabling an attacker on the local network to sniff t...

ABB Ellipse

CVSS v3 6.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: ABB Equipment: Ellipse Vulnerability: Unprotected Transport of Credentials AFFECTED PRODUCTS ABB reports that the vulnerability affects Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 including Ellipse...

Lantronix Devices Unprotected Access (Telnet)

The Lantronix device setup is accessible via an unprotected Telnet connection. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Lantronix Devices Unprotected Access (HTTP)

The Lantronix device web interface is accessible via an unprotected HTTP connection. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Progress Sitefinity 10.0 / 10.1 Broken Access Control / LINQ Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Broken access control & LINQ injection product: Progress Sitefinity vulnerable version: 10.0, 10.1 fixed version: =10.1.6527.0 internal build, 10.2 CVE number: - impact:...

The vulnerability of the FortiOS operating system arises from the lack of measures taken to protect the structure of web pages, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the FortiOS operating system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks by entering malicious code into the “Comments” field and saving the modified...