Total
157 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-7356 | 1 Zte | 2 Zxr10 8905e, Zxr10 8905e Firmware | 2024-11-21 | 5.0 MEDIUM | 5.6 MEDIUM |
| All versions up to V3.03.10.B23P2 of ZTE ZXR10 8905E product are impacted by TCP Initial Sequence Number (ISN) reuse vulnerability, which can generate easily predictable ISN, and allows remote attackers to spoof connections. | |||||
| CVE-2018-19025 | 1 Juuko | 2 K-808, K-808 Firmware | 2024-11-21 | 10.0 HIGH | 9.8 CRITICAL |
| In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed on the K-808 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.). | |||||
| CVE-2018-17935 | 1 Telecrane | 22 F25-10d, F25-10d Firmware, F25-10s and 19 more | 2024-11-21 | 4.8 MEDIUM | 8.1 HIGH |
| All versions of Telecrane F25 Series Radio Controls before 00.0A use fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state. | |||||
| CVE-2018-17932 | 1 Juuko | 2 K-800, K-800 Firmware | 2024-11-21 | 10.0 HIGH | 9.8 CRITICAL |
| JUUKO K-800 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.) is vulnerable to a replay attack and command forgery, which could allow attackers to replay commands, control the device, view commands, or cause the device to stop running. | |||||
| CVE-2018-17903 | 1 Sagaradio | 2 Saga1-l8b, Saga1-l8b Firmware | 2024-11-21 | 6.4 MEDIUM | 9.1 CRITICAL |
| SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to a replay attack and command forgery. | |||||
| CVE-2018-17176 | 1 Neatorobotics | 6 Botvac D4 Connected, Botvac D4 Connected Firmware, Botvac D6 Connected and 3 more | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| A replay issue was discovered on Neato Botvac Connected 2.2.0 devices. Manual control mode requires authentication, but once recorded, the authentication (always transmitted in cleartext) can be replayed to /bin/webserver on port 8081. There are no nonces, and timestamps are not checked at all. | |||||
| CVE-2018-16242 | 1 O.bike | 3 Obike-stationless Bike Sharing, Smart Locker, Smart Locker Firmware | 2024-11-21 | 2.9 LOW | 5.3 MEDIUM |
| oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy (BLE) to replay ciphertext based on a predictable nonce used in the locking protocol. | |||||
| CVE-2018-15498 | 1 Ysoft | 2 Safeq Server, Safeq Server Client | 2024-11-21 | 6.8 MEDIUM | 8.1 HIGH |
| YSoft SafeQ Server 6 allows a replay attack. | |||||
| CVE-2018-13789 | 1 Descor | 1 Infocad Fm | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Descor Infocad FM before 3.1.0.0. An unauthenticated web service allows the retrieval of files on the web server and on reachable SMB servers. | |||||
| CVE-2013-1351 | 1 Veraxsystems | 1 Network Management System | 2024-11-21 | 4.3 MEDIUM | 5.9 MEDIUM |
| Verax NMS prior to 2.10 allows authentication via the encrypted password without knowing the cleartext password. | |||||
| CVE-2024-36250 | 1 Mattermost | 1 Mattermost Server | 2024-11-14 | N/A | 4.8 MEDIUM |
| Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code within ~30 seconds | |||||
| CVE-2024-22066 | 1 Zte | 8 Zxr10 160, Zxr10 160 Firmware, Zxr10 1800-2s and 5 more | 2024-11-08 | N/A | 6.5 MEDIUM |
| There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . An authenticated attacker could use the vulnerability to obtain sensitive information about the device. | |||||
| CVE-2024-45244 | 1 Hyperledger | 1 Fabric | 2024-10-30 | N/A | 5.3 MEDIUM |
| Hyperledger Fabric through 2.5.9 does not verify that a request has a timestamp within the expected time window. | |||||
| CVE-2024-3982 | 1 Hitachienergy | 1 Microscada X Sys600 | 2024-10-30 | N/A | 8.2 HIGH |
| An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level is not enabled and only users with administrator rights can enable it. | |||||
| CVE-2024-46041 | 2024-10-07 | N/A | 8.8 HIGH | ||
| IoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay. | |||||
| CVE-2024-8260 | 2 Microsoft, Openpolicyagent | 2 Windows, Open Policy Agent | 2024-09-19 | N/A | 7.3 HIGH |
| A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions. | |||||
| CVE-2024-43099 | 2024-09-14 | N/A | 8.8 HIGH | ||
| The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into an ongoing authenticated session. To successfully achieve this, the attacker also needs to spoof both the IP address and MAC address of the originating host which is typical of a session-based attack. | |||||