2899 matches found
The vulnerability of the client request handler of the secure access control system used in IED RUGGEDCOM CROSSBOW allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the client request handler of the Siemens RUGGEDCOM CROSSBOW access control system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
CVE-2022-4148 WP OAuth Server < 4.3.0 - Subscriber+ Arbitrary Client Deletion
The WP OAuth Server OAuth Authentication WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client...
PT-2023-20299 · WordPress · Second2None Service Area Postcode Checker
Name of the Vulnerable Software and Affected Versions: Second2none Service Area Postcode Checker plugin versions prior to 2.0.9 Description: The issue is related to an authentication vulnerability that affects users with admin+ privileges in the Second2none Service Area Postcode Checker plugin...
CVE-2023-1460
A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=saveuser of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to...
Authentication flaw
Improper authentication in SecSettings prior to SMR Mar-2023 Release 1 allows attacker to reset the setting...
PT-2023-1716 · Moxa · Nport 6000 +1
Name of the Vulnerable Software and Affected Versions: Line version 13.6.1 NPort 6000 affected versions not specified NPort Windows Driver Manager affected versions not specified Description: An issue in the Cleaning makotoya mini-app on Line allows attackers to send crafted malicious notificatio...
Authentication flaw
The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create and download packet captures with known default URLs...
Authentication flaw
Transient DOS due to reachable assertion in WLAN while processing PEER ID populated by TQM...
Authentication flaw
A improper restriction of excessive authentication attempts vulnerability CWE-307 in Fortinet FortiDeceptor 3.1.x and before allows a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form...
Security Bulletin: Insufficient authorization check in IBM supplied MQ Advanced for Integration container image (CVE-2023-26284)
Summary When using the IBM Supplied MQ Advanced for Integration container imageibm-mqadvanced-server-integration, all users authenticated with the cluster are granted administration access to the MQ Console, without checking IAM access rights. The MQ Console log will report following error -...
The vulnerability of the AbstractSessionListener component in the Symfony software development and web application management framework allows a attacker to gain access to user sessions.
The vulnerability of the AbstractSessionListener component in the Symfony software development and management framework is related to incorrect authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain access to user sessions remotely...
keycloak: user impersonation via stolen uuid code
A flaw was found in Keycloak's OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issu...
The vulnerability of the Apex One antivirus software is caused by deficiencies in the authentication process, which allows a hacker to download arbitrary files into the SampleSubmission directory.
The vulnerability of the anti-virus software Apex One is due to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to download arbitrary files into the SampleSubmission directory by using the Content-Length header in the HTTP PUT request sent to the...
The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to deficiencies in the authentication process, allows attackers to increase their privileges.
The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain increased privileges...
Authentication flaw
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, macOS Monterey 12.6, macOS Big Sur 11.7. An app may be able to bypass Privacy preferences...
Authentication flaw
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, iOS 15.7.3 and iPadOS 15.7.3, tvOS 16.3, watchOS 9.3. An app may be able to bypass Privacy preferences...
CVE-2023-24093
An access control issue in H3C A210-G A210-GV100R005 allows attackers to authenticate without a password...
Authentication flaw
Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservice to the internet, which is not recommended. This is because there is no authentication feature enabled for the built-in eureka service. Malicious hackers ma...