2899 matches found
Authentication flaw
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unauthenticated user on the Schneider UPS Monitor service...
Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.
...
Schneider Electric Easy UPS Online Monitoring Software 访问控制错误漏洞
Schneider Electric Easy UPS Online Monitoring Software is a power monitoring software from Schneider Electric France. The Schneider Electric Easy UPS Online Monitoring Software suffers from an access control error vulnerability that stems from an authentication vulnerability that lacks critical...
Authentication flaw
An Improper Authentication vulnerability in upload-file.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to upload arbitrary files to temporary folders on the device. This issue affects Juniper Networks Junos OS: All versions prior to...
Authentication flaw
The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept possibly cleartext target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point such as authentication...
B&R Industrial Automation B&R VC4 授权问题漏洞
B&R Industrial Automation B&R VC4 is a visualization system from B&R Industrial Automation, Austria. It can be used to create line displays or to control integrated or remote XGA displays with keys and/or touch screens. A security vulnerability exists in the B&R Industrial Automation B&R VC4 that...
The vulnerability of the NTLM network authentication protocol for Windows operating systems allows attackers to circumvent security restrictions and gain increased privileges.
The vulnerability of the NTLM network authentication protocol for Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to circumvent security restrictions and enhance their privileges...
PT-2023-20188 · Mitel · Mitel Micollab
Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions through 9.6.2.9 Description: A vulnerability in the web conferencing component could allow an unauthenticated attacker to download a shared file via a crafted request, including the exact path and filename, due to...
The vulnerability of the WLAN module of the Android EMUI operating system and the HarmonyOS operating system allows attackers to interfere with the WLAN service.
The vulnerability of the WLAN layer of the Android EMUI operating system and the HarmonyOS platform is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to influence WLAN services through third-party applications...
Authentication flaw
An improper restriction of excessive authentication attempts vulnerability CWE-307 in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 administrative interface allows an attacker with a valid user account to perform brute-forc...
CVE-2023-0944
Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, email and password. This is possible because the application is vulnerable to IDOR, it does not correctly validate user permissions with respect to certain...
PT-2023-16630 · Bhima · Bhima
Name of the Vulnerable Software and Affected Versions: Bhima version 1.27.0 Description: The issue allows an authenticated attacker with regular user permissions to update arbitrary user session data, including username, email, and password. This is due to the application being vulnerable to...
PT-2023-8995 · Etcd-Io +7 · Etcd-Io +7
Name of the Vulnerable Software and Affected Versions: Etcd-io version 3.4.10 Description: The issue is related to an authentication vulnerability that can be exploited by sending an authentication request to the etcdserver with a username and password, potentially allowing a remote attacker to...
Authentication flaw
Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 and prior versions allows users with restricted rights to bypass entry permission via id collision...
Authentication flaw
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can...
Authentication flaw
Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to the system. A threat actor could exploit this vulnerability to create a user account without providing valid credentials. A threat actor w...
DEBIAN-CVE-2023-0210
A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems...
Authentication flaw
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an unauthenticated attacker could generate a valid token, which would lead to authentication bypass...
Delta Electronics InfraSuite Device Master 访问控制错误漏洞
Delta Electronics InfraSuite Device Master is Delta Electronics' device for simplifying and automating critical equipment monitoring. An authentication error vulnerability exists in Delta Electronics InfraSuite Device Master versions prior to 1.0.5, which can be exploited by an attacker to achiev...