CWE-254: 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
From the CWE List. © The MITRE Corporation.
Newest
- orange livebox 1.1 firmwareLivebox 1.1 allows remote authenticated users to upload arbitrary configuration files, download...8.8 High
- redislabs redisnetworking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for...7.4 High
- reseed project reseedreseed seeds random numbers from an insecure HTTP request to random.org during installation,...5.9 Medium
- microsoft windows 10, windows 8.1, windows rt 8.1 +3 more +5 moreThe Microsoft Windows Storage component on Microsoft Windows 8.1, Windows Server 2012 R2, Windows...4.5 Medium
- theforeman foremanThe LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of...8.1 High
- huawei fusionserver ch121 v3, fusionserver ch220 v3, fusionserver ch222 v3 +7 more +9 moreThe management interface on Huawei FusionServer rack servers RH2288 V3 with software before...8.8 High
- huawei uap2105 firmwareHuawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial...6.8 Medium
- jenkinsJenkins HttpOnly flag not Set for session cookies5.3 Medium
- jenkinsJenkins secure flag not set on session cookies5.3 Medium
- tinfoilsecurity devise-two-factorTinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)5.3 Medium
- fedoraproject 389 administration serverMultiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38.4.2 Medium
- wago 750-849 firmware, 758-870 firmware +1 moreWAGO IO 750-849 01.01.27 and WAGO IO 750-881 01.02.05 do not contain privilege separation.9.8 Critical
- google android, qualcomm, inc. snapdragon mobile +1 moreIn all Qualcomm products with Android releases from CAF using the Linux kernel, a UE can respond...9.8 Critical
- alcatel-lucent home device managerAlcatel-Lucent Home Device Manager before 4.1.10, 4.2.x before 4.2.2 allows remote attackers to...7.5 High
- selinux project selinuxselinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a...5.5 Medium
- hcl software bigfix inventory, ibm license metric tool +1 moreIBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote...9.8 Critical
- netapp clustered data ontapNetApp Clustered Data ONTAP allows man-in-the-middle attackers to obtain sensitive information,...7.5 High
- netapp data ontapNetApp Data ONTAP 8.1 and 8.2, when operating in 7-Mode, allows man-in-the-middle attackers to...7.5 High
- cisco adaptive security appliance softwareASA 5515-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.4.x before 9...8.1 High
- ibm qradar security information and event manager, security qradar siem +1 moreIBM QRadar 7.2 and 7.3 does not require that users should have strong passwords by default, which...7.5 High
- google android, qualcomm, inc. all qualcomm products +1 moreIn all Android releases from CAF using the Linux kernel, some regions of memory were not...5.5 Medium
- google android, qualcomm, inc. all qualcomm products +1 moreIn all Android releases from CAF using the Linux kernel, stack protection was not enabled for...5.5 Medium
- bluecoat advanced secure gateway, cacheflow, proxysg +2 moreBlue Coat Advanced Secure Gateway 6.6, CacheFlow 3.4, ProxySG 6.5 and 6.6 allows remote attackers...7.5 High
- apple iphone osFind My iPhone on iOS 2.0 through 3.1.3 for iPhone 3G and later and iOS 2.1 through 3.1.3 for...4.8 Medium
- grandstream waveThe Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving...7.8 High
- zohocorp servicedesk plusZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies,...5.3 Medium
- osram lightify proOSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.7.5 High
- osram lightify homeOSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning.7.5 High
- web2pyweb2py is vulnerable to password brute-force attack9.8 Critical
- huawei honor 6 firmware, honor 6 plus firmware, honor 7 firmware +2 moreHuawei Honor 6, Honor 6 Plus, Honor 7 phones with software versions earlier than 6.9.16 could...7.8 High
- fortinet fortiosLong lived sessions in Fortinet FortiGate devices with FortiOS 5.x before 5.4.0 could violate a...5.9 Medium
- revive-adserver revive adserverRevive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery...9.0 Critical
- intel advanced threat defense (atd), mcafee advanced threat defense +1 moreDetection bypass vulnerability in Intel Security Advanced Threat Defense (ATD) 3.4.6 and earlier...7.5 High
- intel advanced threat defense (matd), mcafee advanced threat defense +1 moreSandbox detection evasion vulnerability in hardware appliances in McAfee (now Intel Security)...5.5 Medium
- ibm tivoli monitoring, tivoli monitoring v6 +1 moreIBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that...4.6 Medium
- yandex browser, yandex n.v. browser for desktop +1 moreYandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in...6.5 Medium
- apple iphone osAn issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue...4.6 Medium
- apple iphone osAn issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue...9.8 Critical
- apple iphone osAn issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue...6.8 Medium
- apple iphone osAn issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue...4.6 Medium
- apple tvos, watchos, iphone os +1 more +3 moreAn issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10...7.8 High
- apple iphone osAn issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue...6.8 Medium
- apple iphone os, mac os x +1 moreAn issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10...5.9 Medium
- apple iphone osAn issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue...7.5 High
- ibm websphere message broker, integration bus +1 moreIBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking...6.1 Medium
- emerson se4801t0x redundant wireless i\/o card firmware, se4801t1x simplex wireless i\/o card firmware +1 moreAn issue was discovered in Emerson SE4801T0X Redundant Wireless I/O Card V13.3, and SE4801T1X...5.0 Medium
- sauter-controls novaweb web hmiAn issue was discovered in Sauter NovaWeb web HMI. The application uses a protection mechanism...7.2 High
- jenkins script securityJenkins Script Security Plugin allows for Bypass of Groovy Sandbox Protection7.3 High
- tor browser launcher project browser launcherTor Browser Launcher (aka torbrowser-launcher) before 0.2.4, during the initial run, allows man...8.1 High
- ibm kenexa lms on cloudIBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to hijack the...5.4 Medium
- Show moreLoading…