The vulnerability of Omron CS/CJ automation controllers, related to the lack of authentication for critical functions, allows attackers to gain access to protected information.

The vulnerability of Omron CS/CJ automation controllers lies in the lack of authentication for critical functions. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to protected information...

January 10, 2023—KB5022348 (Monthly Rollup)

None None...

CVE-2023-27979

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in the IGSS project report directory, this could lead to denial of service when an attacker sends specific crafted messages to the Data Server TCP port. Affecte...

Uniview IP Camera 授权问题漏洞

Uniview IP Camera is a camera from China Uniview Technology Uniview. A security vulnerability exists in the Uniview IP Camera that stems from a failure of identification and authentication in the web-based management interface...

CVE-2023-22481 Sensitive information exposure in the logs of greader API in FreshRSS

FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in users//logapi.txt in the case where the authentication fails. The issues occurs in authorizationToUser in greader.php. If there is an issue with the request or the credentials,...

FreshRSS 日志信息泄露漏洞

FreshRSS is a free, self-hosted RSS aggregator from FreshRSS Open Source. FreshRSS suffers from a log information disclosure vulnerability that stems from a user-supplied password being logged in plaintext in users//logapi.txt in the event of an authentication failure...

SUSE CVE-2006-5170

pamldap in nssldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pamauthenticate function to return a success cod...

SUSE CVE-2010-3705

The sctpauthasocgethmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmacids array of an SCTP peer, which allows remote attackers to cause a denial of service memory corruption and panic via a crafted value in the last element of this array...

SUSE CVE-2011-1720

The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service...

SUSE CVE-2013-5745

The vinoserverclientdatapending function in vino-server.c in GNOME Vino 2.26.1, 2.32.1, 3.7.3, and earlier, and 3.8 when encryption is disabled, does not properly clear client data when an error causes the connection to close during authentication, which allows remote attackers to cause a denial ...

SUSE CVE-2019-15162

rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to enumerate valid usernames...

Application-Aware Processing Tasks Fail in a Kerberos-Only Environment After Upgrading to Veeam Backup & Replication 12

Challenge If you use persistent agents for guest OS processing in a Kerberos-only environment, after upgrading to Veeam Backup & Replication 12, some backup jobs may fail with the error: Failed to connect to guest agent, failing over to guest agent through VIX Failed to connect to guest agent...

CVE-2022-46732

Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status...

Proficy Historian 访问控制错误漏洞

GE Digital Proficy Historian is a powerful tool with storage analysis and data collection capabilities from GE Digital. An access control error vulnerability exists in Proficy Historian v7.1 and prior versions, which stems from the fact that even if authentication to a local service fails,...

CVE-2022-46732 CVE-2022-46732

Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status...

CVE-2022-48195

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

PT-2022-27475 · Apache · Apache Shardingsphere-Proxy

Name of the Vulnerable Software and Affected Versions: Apache ShardingSphere-Proxy versions prior to 5.3.0 Description: The issue arises when Apache ShardingSphere-Proxy is used with MySQL as the database backend. In versions prior to 5.3.0, the database session is not properly cleaned up after a...

Apache ShardingSphere 安全漏洞

Apache ShardingSphere is an open source distributed database middleware solution from the Apache Foundation. A security vulnerability exists in Apache ShardingSphere-Proxy versions prior to 5.3.0, which stems from the fact that when using MySQL as a database backend, the database session is not...

The vulnerability of the Linux operating system’s Bluetooth driver allows attackers to gain increased privileges.

The vulnerability of the Linux operating system’s Bluetooth driver kernel is related to errors during authentication processes. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

389-ds-base: expired password was still allowed to access the database

A vulnerability was found in the 389 Directory Server. This issue allows expired passwords to access the database, causing improper authentication...