Weakness (CWE)
CWE-16: Configuration
Weaknesses in this category are typically introduced during the configuration of the software.
Source: MITRE CWE-16
24 results · Clear filters · Feed
-
Medium 4.3
Cisco IOS and IOS XE Software SNMPv3 Configuration Restriction Vulnerability
A vulnerability in the implementation of the Simple Network Management Protocol Version 3 (SNMPv3) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to poll an affected device using SNMP, even if the device …
-
Medium 4.4
Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of th…
-
Medium 5.6
Permission vulnerability in the ActivityManagerService (AMS) module Impact: Successful exploitation of this vulnerabili…
-
Medium 5.9
Configuration Issue in Core
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
-
Medium 6.5
Zabbix Agent installer adds “allow all TCP any any” firewall rule
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)
-
Medium 5.3
HTTP TRACK & TRACE Methods Enabled
The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was r…
-
Medium 6.5
SRC Series: A remote attacker sending a specially crafted query may cause the web server to delete files
A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to delete files which may allow the attacker to disrupt the integrity…
-
Medium 5.3
SRC Series: A remote attacker sending a specially crafted query may cause the web server to disclose sensitive information
A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to disclose sensitive information in the HTTP response which allows t…
-
Medium 5.0
Dell Wyse ThinOS 8.6 MR9 contains remediation for an improper management server validation vulnerability that could be …
-
Medium 6.7
Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configu…
-
Medium 6.8
Philips Clinical Collaboration Platform Configuration
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
-
Medium 5.3
Cisco Vision Dynamic Signage Director Directory Traversal Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to view potentially sensitive information on an affected device. The vulnerability is due to incorrect permissions w…
-
Medium 6.3
ABB eSOMS X-XSS-Protection not enabled
For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy, this might increase the risk of Cross Site Scripting.
-
Medium 6.5
eSOMS X-FrameOption
For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker can frame parts of the application on a malicious web site, revealing sensitive user inform…
-
Medium 6.5
eSOMS Cachecontrol (Pragma) HTTP Header
For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP header(s) have not been properly configured within the application response. This can potentially allow browsers and proxies to cache sensitive information.
-
Medium 5.9
ABB eSOMS: SSL medium strength Cipher Suites
ABB eSOMS versions 4.0 to 6.0.3 accept connections using medium strength ciphers. If a connection is enabled using such a cipher, an attacker might be able to eavesdrop and/or intercept the connection.
-
Medium 4.3
ABB eSOMS: HTTP response information leakage
For ABB eSOMS versions 4.0 to 6.0.3, HTTPS responses contain comments with sensitive information about the application. An attacker might use this detail information to specifically craft the attack.
-
Medium 6.1
eSOMS: X-Content-Type-Options Header Missing
For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack scenario would be un…
-
Medium 5.3
ABB eSOMS: HTTPOnly flag not set
For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Site Scripting.
-
Medium 4.6
Cargo prior to Rust 1.26.0 may download the wrong dependency
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is u…
-
Medium 5.3
Cisco Webex Meetings Server Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to access sensitive system information. The vulnerability is due to improper access control to files within the web-based mana…
-
Medium 6.7
Cisco Aironet Series Access Points Command Injection Vulnerability
A vulnerability in the CLI of Cisco Aironet Series Access Points (APs) could allow an authenticated, local attacker to gain access to the underlying Linux operating system (OS) without the proper authentication. The attacker would need valid administrator dev…
-
Medium 6.7
Cisco Nexus 9000 Series Fabric Switches Application-Centric Infrastructure Mode Privilege Escalation Vulnerability
A vulnerability in the controller authorization functionality of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to escalate standard users with root privilege on an affected device. The vulnerability is due to a …
-
Medium 5.3
Cisco Registered Envelope Service Information Disclosure Vulnerability
A vulnerability in the user management functions of Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to discover sensitive user information. The attacker could use this information to conduct additional reconnaissance attacks.…