CWE-16.

HCL IEM was affected with X-Content-Type-Options Header Missing

• HCLSoftware IntelliOps Event Management
• CWE-16

This PowerVM Novalink update is being released to address

• IBM PowerVM Novalink
• CWE-16

An SSH misconfigurations exists in Tenable OT that led to the potential exfiltration of socket, port, and service information via the ostunnel user and GatewayPorts.

• Tenable, Inc. Tenable Operation Technology
• CWE-16

CSRF Token not Properly Implemented

• Azure Access Technology BLU-IC2
• Azure Access Technology BLU-IC4
• CWE-16

Cisco IOS and IOS XE Software SNMPv3 Configuration Restriction Vulnerability

• Cisco IOS XE Catalyst SD-WAN
• CWE-16

WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

• Progress Software Corporation WhatsUp Gold
• Path traversal
• CWE-16

Configurations in Android Build

• Qualcomm, Inc. Snapdragon
• CWE-16

Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of this vulnerability may affect availability.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-16

Permission vulnerability in the ActivityManagerService (AMS) module Impact: Successful exploitation of this vulnerability may affect availability.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-16

Access permission verification vulnerability in the Settings module.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-16

Privilege escalation vulnerability in the PMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-16

Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability will affect availability.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-16

Configuration Issue in WLAN Host and Firmware

• Qualcomm, Inc. Snapdragon
• CWE-16

Configuration Issue in Core

• Qualcomm, Inc. Snapdragon
• CWE-16

Dell Client BIOS contains a pre-boot direct memory access (DMA) vulnerability.

• Dell CPG BIOS
• CWE-16

Vulnerability of configuration defects in the media module of certain products..

• Huawei HarmonyOS
• Huawei EMUI
• CWE-16

Vulnerability of insecure signatures in the OsuLogin module.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-16

Configuration weakness in modem

• Qualcomm, Inc. Snapdragon
• CWE-16

Zabbix Agent installer adds “allow all TCP any any” firewall rule

• Zabbix agent (MSI packages)
• Zabbix agent 2 (MSI packages)
• CWE-16

Debugging port misconfiguration in Zoom Apps in the Zoom Client for Meetings for macOS

• Zoom Video Communications Inc Zoom Client for Meetings for MacOS
• CWE-16

Incorrect configuration of the cJSON library lead a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.

• OpenHarmony
• CWE-16

The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory

• YugaByte, Inc. Yugabyte DB
• Authentication bypass
• CWE-16

Dell SupportAssist Client Consumer versions (3.10.4 and prior) and Dell SupportAssist Client Commercial versions (3.1.1 and prior) contain a cross-site scripting vulnerability.

• Dell SupportAssist Consumer
• CWE-16

Cargo prior to Rust 1.26.0 may download the wrong dependency

• CWE-16
• CWE-494

<0.27.0 · fixed in 0.27.0

Junos OS Evolved: A remote attacker may cause a CPU Denial of Service by sending genuine traffic to a device on a specific IPv4 port.

• Juniper Networks Junos OS Evolved
• Juniper Networks Junos OS
• Information disclosure
• Broken access control

UniFi Protect application: A Cross-Origin Resource Sharing (CORS) vulnerability found in UniFi Protect application…

• UniFi Protect application
• CWE-16

HTTP TRACK & TRACE Methods Enabled

• SolarWinds Kiwi Syslog Server
• CWE-16

SRC Series: A remote attacker sending a specially crafted query may cause the web server to delete files

• Juniper Networks SRC Series
• Information disclosure
• CWE-16

SRC Series: A remote attacker sending a specially crafted query may cause the web server to disclose sensitive information

• Juniper Networks SRC Series
• Information disclosure
• CWE-16

SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug Wire Protocol (JDWP) interface security misconfiguration vulnerability which potentially leads to Remote Code Execution.

• SonicWall Analytics On-Prem
• CWE-16

Dell Wyse ThinOS 8.6 MR9 contains remediation for an improper management server validation vulnerability that could be potentially exploited to redirect a client to an attacker-controlled management…

• Dell Wyse Proprietary OS (ThinOS)
• CWE-16

Junos OS: Upon receipt of certain protocol packets with invalid payloads a self-propagating Denial of Service may occur.

• Juniper Networks Junos OS
• CWE-16

Lenovo PCManager: A privilege escalation vulnerability was reported in Lenovo PCManager prior to version…

• Lenovo PCManager
• CWE-16

Lenovo Desktop and Workstation systems: Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with…

• Lenovo Desktop and Workstation systems
• CWE-16

Cisco Small Business Switches Information Disclosure Vulnerability

• Cisco Small Business 250 Series Smart Switches Software
• CWE-16

Philips Clinical Collaboration Platform Configuration

• Philips Clinical Collaboration Platform
• CWE-16

PAN-OS: Management web interface denial-of-service (DoS)

• Palo Alto Networks PAN-OS
• CWE-16

Cisco Vision Dynamic Signage Director Directory Traversal Information Disclosure Vulnerability

• Cisco Vision Dynamic Signage Director
• CWE-16

ABB eSOMS X-XSS-Protection not enabled

• ABB eSOMS
• Cross-site scripting (XSS)
• CWE-16

eSOMS X-FrameOption

• ABB eSOMS
• CWE-16

eSOMS Cachecontrol (Pragma) HTTP Header

• ABB eSOMS
• CWE-16
• CWE-202

ABB eSOMS: SSL medium strength Cipher Suites

• ABB eSOMS
• Weak cryptography or TLS
• CWE-16

ABB eSOMS: Viewstate without MAC Signature

• ABB eSOMS
• CWE-16

ABB eSOMS: HTTP response information leakage

• ABB eSOMS
• CWE-16
• CWE-202

ABB eSOMS: Secure Flag not set

• ABB eSOMS
• CWE-16

eSOMS: X-Content-Type-Options Header Missing

• ABB eSOMS
• CWE-16

ABB eSOMS: HTTPOnly flag not set

• ABB eSOMS
• Cross-site scripting (XSS)
• CWE-16

Autocomplete in the form login screens

• OTRS AG ((OTRS)) Community Edition
• OTRS
• CWE-16

Settings for the Dell XPS 13 2-in-1 (7390) BIOS versions prior to 1.1.3 contain a configuration vulnerability.

• Dell CPG BIOS
• CWE-16

Cisco Webex Meetings Server Information Disclosure Vulnerability

• Cisco WebEx Meetings Server
• CWE-16

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 use default credentials admin/admin and moderator/moderator for the web interface.

• Crestron AirMedia
• CWE-16

Cisco Aironet Series Access Points Command Injection Vulnerability

• Cisco Aironet Access Point Software
• CWE-16

Cisco IOS XE Software Information Disclosure Vulnerability

• Cisco IOS XE Software
• CWE-16

Cisco Nexus 9000 Series Fabric Switches Application-Centric Infrastructure Mode Privilege Escalation Vulnerability

• Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode
• CWE-16

Cisco Registered Envelope Service Information Disclosure Vulnerability

• Cisco Registered Envelope Service
• CWE-16

Cisco Digital Network Architecture Center Unauthenticated Access Vulnerability

• Cisco Digital Network Architecture Center (DNA Center)
• CWE-16

A vulnerability in Cisco Meeting Server (CMS) could allow an unauthenticated, adjacent attacker to access services running on internal device interfaces of an affected system.

• Cisco Meeting Server unknown
• CWE-16

Cisco Meeting Server: A vulnerability in Cisco Meeting Server could allow an unauthenticated…

• Cisco Meeting Server
• CWE-16

Cisco Identity Services Engine: A vulnerability in the support tunnel feature of Cisco Identity Services Engine (ISE)…

• Cisco Identity Services Engine
• CWE-16

Cisco Spark Board: A vulnerability in the upgrade process of Cisco Spark Board could allow an authenticated…

• Cisco Spark Board
• CWE-16