CWE-254

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect pass

core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a c

The HTTP API supported by Starry Station (aka Starry Router) allows brute forcing the PIN setup by the user on the devic

A potential security vulnerability caused by the use of insecure (http) transactions during login has been identified wi

libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even

Zcash 2.x allows an inexpensive approach to "fill all transactions of all blocks" and "prevent any real transaction from

OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security heade

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).

Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).

The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.

The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.

In the most recent firmware for Blipcare, the device provides an open Wireless network called "Blip" for communicating w

In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).

cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).

In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, proxy authenti

In iOS before 11.2, exchange rates were retrieved from HTTP rather than HTTPS. This was addressed by enabling HTTPS for

An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the so

The legacy finger service (TCP port 79) is enabled by default on various older Lexmark devices.

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnera

xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (a

K-9 Mail v5.600 can include the original quoted HTML code of a specially crafted, benign looking, email within (digitall

cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).

cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229).

When mount.ecrpytfs_private before version 87-0ubuntu1.2 calls setreuid() it doesn't also set the effective group id. So

In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).

cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).

A potential security vulnerability caused by incomplete obfuscation of application configuration information was discove

A vulnerability in generate_filestorage_key of Ubuntu MAAS allows an attacker to brute-force filenames. This issue affec

FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a

IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 do not proper

The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Serv

A security design issue can allow an unprivileged user to interact with the Carbon Black Sensor and perform unauthorized

On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF

A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access the remote suppor

A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware consumer version 2.2.1 and

An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks

mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625 and SD 800, a fuse is

A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance (WSA) could allow an unauthenticated, re

When a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit NPAPI plugins is not enabl

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of

igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol.

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and S

Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined an

Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKE

IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial

Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a know

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back

phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request.