Authentication flaw

The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin password without authentication via a POST request to AdvancedSystemContent.asp with the uiViewToolsusername=admin&uiViewToolsPassword= and uiViewToolsPasswordConfirm= substrings...

Authentication flaw

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys...

Authentication flaw

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to bypass authentication...

Design/Logic Flaw

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate...

The vulnerability of the authentication function of the Cisco IOS XE operating system’s web server allows a hacker to cause a malfunction in the web server’s operation.

The vulnerability of the Cisco IOS XE operating system’s server authentication function is related to errors in processing input data. Exploiting this vulnerability can allow a remote attacker to cause malfunctions in the server...

Authentication flaw

AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges...

Authentication flaw

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks...

Authentication flaw

In listen and related functions of TelephonyRegistry.java, there is a possible permissions bypass of location permissions due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

Huawei 4G Router B612 Null Pointer Dereference Vulnerability

Huawei 4G Router B612 is an LTE router product from Huawei China. The product can use 4G network as a shared hotspot. A security vulnerability exists in the Huawei 4G Router B612. The vulnerability stems from the program not properly authenticating input. An unauthenticated attacker could exploit...

Authentication flaw

An issue was discovered in the LogMein LastPass Password Manager aka com.lastpass.ilastpass app 4.8.11.2403 for iOS. The password authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation. In other words, an attacker could authentica...

Authentication flaw

Askey AP5100W devices through AP5100WDualSIG1.01.097 are affected by WPS PIN offline brute-force cracking. This arises because of issues with the random number selection for the Diffie-Hellman exchange. By capturing an attempted and even failed WPS authentication attempt, it is possible to brute...

Imcat File Upload Vulnerability

Imcat is a PHP-based open source website building system. imcat 5.2 version of a security vulnerability , the vulnerability stems from the image upload interface does not do effective authentication filtering , the attacker can through the image function of the authentication file upload and remo...

CVE-2020-26834

SAP HANA Database, version - 2.0, does not correctly validate the username when performing SAML bearer token-based user authentication. It is possible to manipulate a valid existing SAML bearer token to authenticate as a user whose name is identical to the truncated username for whom the SAML...

Authentication flaw

SAP NetWeaver AS JAVA P2P Cluster Communication, versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missing authentication check, that are outside the cluster and even outside the network segment dedicated for the internal cluster communication. ...

The vulnerability of the Cisco IoT Field Network Director software allows a intruder to gain unauthorized access to protected information.

The vulnerability of the REST API interface of the Cisco IoT Field Network Director software management tool is related to deficiencies in the authentication process for confidential information. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized acces...

Authentication flaw

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie. In addition, an upload endpoint could then be used by an authenticated...

Authentication flaw

An issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. During the process of updating the firmware, the update script starts a telnetd -l /bin/sh process that does not require authentication for TELNET access...

UBUNTU-CVE-2020-25660

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the...

Authentication flaw

An authentication bypass in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with physical access to device hardware to obtain system information...

CVE-2020-25165

BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier and BD Alaris Systems Manager, Versions 4.33 and earlier The affected products are vulnerable to a network session authentication vulnerability within the authentication process between specified versions of the BD Alaris PC Unit and the ...