Authentication flaw

A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication...

Authentication flaw

DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service JAAS authentication and that system is given a configuration which contains an error, the authentication for the system will fail open and allow an attacker to login using any...

Authentication flaw

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be...

Authentication flaw

Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4...

CVE-2022-48294

The IHwAttestationService interface has a defect in authentication. Successful exploitation of this vulnerability may affect data confidentiality...

PT-2023-15673 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The IHwAttestationService interface has a defect in authentication. Successful exploitation of this issue may affect data confidentiality. There is no...

Authentication flaw

IBM Sterling External Authentication Server 6.1.0 and IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms during installation that could allow a local attacker to decrypt sensitive information. IBM X-Force ID: 231373...

Authentication flaw

Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated access to run code ...

HelpSystems GoAnywhere MFT 代码问题漏洞

HelpSystems GoAnywhere MFT is a hosted file transfer software from HelpSystems USA. A security vulnerability exists in HelpSystems GoAnywhere MFT that stems from incorrect authentication, which can lead to command injection...

Authentication flaw

In BIP-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when OCSP authentication profile is configured on a virtual server, undisclosed requests can cause an increase in CPU resource utilization. Note: Software...

Authentication flaw

A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request...

Authentication flaw

A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Affected Products: APC Easy UPS Online Monitoring Software Windows 7, 10, 11 & Windows...

Authentication flaw

Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login...

UFLO 代码注入漏洞

UFLO is a pure Java process engine based on Spring that supports various flow methods such as parallel, dynamic parallel, serial, and countersign. A code injection vulnerability exists in UFLO uflo-core, which stems from incorrect user authentication...

GHSA-G25R-GVQ3-WRQ7 Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster

Impact An issue was discovered in Rancher where an authorization logic flaw allows an authenticated user on any downstream cluster to 1 open a shell pod in the Rancher local cluster and 2 have limited kubectl access to it. The expected behavior is that a user does not have such access in the...

Authentication flaw

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication...

Authentication flaw

In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 SCG200 before 3.6.2.0.795, SmartZone 100 SZ-100 before 3.6.2.0.795, SmartZone 300 SZ300 before 3.6.2.0.795, Virtua...

Authentication flaw

A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploi...

The vulnerability of the Portainer container management platform, related to deficiencies in the authentication process, allows a perpetrator to gain full access to the file system.

The vulnerability of the Portainer container management platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain full access to the host’s file system through the host management API...

PT-2023-1297 · Tp Link · Tp-Link Sg105Pe

Name of the Vulnerable Software and Affected Versions: TP-Link SG105PE versions prior to 1.0 1.0.0 Build 20221208 Description: The issue is related to an authentication bypass vulnerability in the firmware of TP-Link SG105PE switches. This vulnerability is associated with weaknesses in the...