NVD disclosure day

Published threat advisories for May 2, 2019

CVE-2018-16988

Open XDMoD Weak Password Reset Allows Account Takeover

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

An authentication bypass vulnerability exists in Open XDMoD through version 7.5.0, allowing account takeover via a weak password reset mechanism. An attacker can exploit this by performing a brute-force attack on a reset token after a password reset has been initiated. This could lead to unauthorized access to systems

NVD modified: NVD date unavailable

CVE advisoryKnown Exploit

CVE-2017-18368

Zyxel Router Command Injection Vulnerability.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

Certain ZyXEL and Billion routers have a command injection vulnerability in their log forwarding function, allowing unauthenticated users to run arbitrary commands. This could lead to unauthorized control of network devices, data compromise, and service disruption. The business risk is significant due to potential unau

NVD modified: NVD date unavailable • CISA KEV