203 matches found
EUVD-2021-32615
Malicious code in bioql PyPI...
EUVD-2024-53432
Malicious code in bioql PyPI...
EUVD-2023-35722
Malicious code in bioql PyPI...
EUVD-2023-0202
Malicious code in bioql PyPI...
EUVD-2022-52459
Malicious code in bioql PyPI...
EUVD-2022-15800
Malicious code in bioql PyPI...
EUVD-2023-32720
Malicious code in bioql PyPI...
PKI via API: Authentication granted with an invalid certificate
...
The vulnerability of the components of the Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager, which are used in network traffic analysis, network detection, and response systems, allows attackers to compromise the integrity of protected information.
The vulnerability of the API components of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager relates to improper authentication. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...
CVE-2024-42062
CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that...
CVE-2023-30394
The MoveIt framework 1.1.11 for ROS allows cross-site scripting XSS via the API authentication function. NOTE: this issue is disputed by the original reporter because it has "no impact."...
CVE-2023-32303
Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in...
CVE-2022-2531
An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was not performing correct authentication on Grafana API under specific conditions allowing...
CVE-2022-33138
A vulnerability has been identified in SIMATIC MV540 H All versions V3.3, SIMATIC MV540 S All versions V3.3, SIMATIC MV550 H All versions V3.3, SIMATIC MV550 S All versions V3.3, SIMATIC MV560 U All versions V3.3, SIMATIC MV560 X All versions V3.3. Affected devices do not perform authentication f...
CVE-2021-38147
Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...
CVE-2021-36460
VeryFitPro com.veryfit2hr.second 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's...
CVE-2021-45900
Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a VIVOHAUTH cookie is assigned so that they can be uniquely identified. Certain APIs can be successfully executed without proper authentication. This can let ...
CVE-2020-13927
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...
CVE-2019-25020
An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can retrieve the administrative configuration by sending a POST request to the /sdm-ws-rest/preconfiguration URI...