Barco Control Room Authorization Issue Vulnerability

Barco Control Room is a visualization and collaboration solution from Barco Belgium. It is used to build control rooms. A security vulnerability previously existed in the Barco Control Room Management Suite web application version 3.14, which stemmed from the ability to expose log files without...

CVE-2022-22189 Contrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authentication

An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration CSO allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently authenticated to. This issue affects:...

PT-2022-2299 · Cisco · Cisco Iox +1

Name of the Vulnerable Software and Affected Versions: Cisco IOx affected versions not specified Description: The issue exists due to incorrect restriction of the directory path name with limited access. An attacker could inject arbitrary commands into the underlying host operating system, execut...

CVE-2022-25832

Improper authentication vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to use locked Myfiles app without authentication...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

CVE-2022-24929

Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication...

GHSA-C566-2GRG-MJWG Serialization vulnerability in Apache Tapestry

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to...

Default configuration

Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a default configuration page accessible without authentication. An attacker may use this functionality to change the exposed configuration values such as network settings...

Spinnaker Access Control Vulnerability

Spinnaker is a continuous delivery platform. Used to release software changes with high speed and confidence. Spinnaker has a security vulnerability that stems from the presence of inappropriate privileges in the software that allow for pipeline creation and execution. This allows an arbitrary us...

CVE-2021-27561

Yealink Device Management DM 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication...

CVE-2020-19964

A Cross Site Request Forgery CSRF vulnerability was discovered in PHPMyWind 5.6 which allows attackers to create a new administrator account without authentication...

Tad Uploader Access Control Vulnerability

Tad Uploader is a file upload management module from the individual developers of Tad in Taiwan, China.An authorization issue vulnerability exists in Tad Uploader, which could be exploited by remote attackers to modify the names of folders in a booklist using this feature without logging in...

Siemens Industrial Edge Management Authorization Issue Vulnerability

An authorization bypass vulnerability exists in Siemens Industrial Edge Management, a Siemens platform for hosting applications from various vendors on a computing platform close to the shop floor. Lack of effective privilege management for changing passwords. The vulnerability allows an attacker...

Zoho ManageEngine DesktopCentral authorization issue vulnerability

ZOHO ManageEngine DesktopCentral is used by ZOHO for cloud-scale monitoring to reduce complexity.ZOHO ManageEngine DesktopCentral suffers from an authorization issue vulnerability that could be exploited by attackers to obtain APIKEY of valid users without authentication...

PT-2021-16580

Name of the Vulnerable Software and Affected Versions: S Secure versions prior to SMR MAY-2021 Release 1 Description: The issue is related to an improper running task check in S Secure, which allows attackers to use a locked app without authentication. Recommendations: For versions prior to SMR...

CVE-2021-0133

Key exchange without entity authentication in the IntelR Security Library before version 3.3 may allow an authenticated user to potentially enable escalation of privilege via network access...

VMware vSphere Client Access Control Error Vulnerability

Vmware vSphere Client is an application from Vmware, Inc. It provides virtualization management. An authorization issue vulnerability exists in Vmware vSphere Client, which can be exploited by an attacker to perform actions allowed by an affected plugin without authentication...

De Consumentenbond Sannce Smart HD Baby Monitor Authorization Issues Vulnerability

The de Consumentenbond Sannce Smart HD Baby Monitor is a webcam from de Consumentenbond in the Netherlands. It provides monitoring functionality. A security vulnerability exists in the Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices, which can be exploited by an attacker to gain...

Acexy Wireless-N WiFi Repeater REV security vulnerability

Amazon Acexy Wireless-N WiFi Repeater REV is an Amazon.com, Inc. It is used to provide network services A security vulnerability exists in Acexy Wireless-N WiFi Repeater REV 1.0 that originates from the ability to change the administrator password without authentication...

GE Grid Solutions UR information leakage vulnerability

GE Grid Solutions UR is an embedded operating system from GE Grid Solutions, France. It provides high-performance protection, scalable I/O, integrated monitoring and metering, high-speed communications, and extensive programming and configuration capabilities. An information disclosure...