2906 matches found
Apache Spark Remote Code Execution Vulnerability
Apache Spark is a fast, general-purpose compute engine designed for large-scale data processing.Apache Spark is an open-source clustered computing environment similar to Hadoop that enables in-memory distribution of datasets, which optimizes iterative workloads in addition to being able to provid...
The vulnerability of the enterprise-level catalog service 389 Directory Server, related to incorrect authentication, allows attackers to gain access to confidential data.
The vulnerability of the enterprise-level catalog service 389 Directory Server lies in the improper handling of comparison operations involving internal timestamps during authentication processes. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to...
The vulnerability of the SCADA platform for remote oil and gas applications from Emerson’s OpenEnterprise platform stems from improper implementation of authentication mechanisms. This allows attackers to execute arbitrary code.
The vulnerability of the SCADA platform for remote Emerson OpenEnterprise oil and gas applications is related to the improper implementation of authentication mechanisms. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted malicious...
Authentication flaw
HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B smartphones with versions earlier than 10.1.0.135C00E135R2P11; versions earlier than 10.1.0.135C00E135R2P8, versions earlier than 10.1.0.135 have an improper authentication vulnerability. Due to the identity of the message sender not being properly verified, a...
Authentication flaw
Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach...
CVE-2020-12004
The affected product lacks proper authentication required to query the server on the Ignition 8 Gateway versions prior to 8.0.10 and Ignition 7 Gateway versions prior to 7.9.14, allowing an attacker to obtain sensitive information...
Authentication flaw
An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5. A malicious application may be able to bypass Privacy preferences...
Authentication flaw
A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, physical attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient authentication mechanisms for...
Authentication flaw
The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...
Authentication flaw
The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then execute an exploit that would allow to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF...
Authentication flaw
An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication token...
Authentication flaw
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wpajaxaccordionsajaximportjson action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordio...
Authentication flaw
An authentication bypass vulnerability in the Panorama context switching feature allows an attacker with network access to a Panorama's management interface to gain privileged access to managed firewalls. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue...
Authentication flaw
SAP Business Objects Business Intelligence Platform Live Data Connect, versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing...
Authentication flaw
An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page a certain live?.shtml page with the variable syspasswd. Affected Devices: Wavlink WN530HG4, Wavlink...
Logic Flaw Vulnerability in Geth/Parity RPC API for Ethernet Nodes
Geth/Parity is an Ether node agent. The vulnerability stems from an Ethernet node Geth/Parity RPC API authentication flaw, where a malicious call to ethsendTransaction steals tokens. An attacker could use this vulnerability to steal tokens from others...
Authentication flaw
Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to pair a rogue keypad to an armed system...
Authentication flaw
In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very...
Authentication flaw
Certain NETGEAR devices are affected by authentication bypass. This affects JGS516PE before 2017-05-11, JGS524Ev2 before 2017-05-11, JGS524PE before 2017-05-11, GS105Ev2 before 2017-05-11, GS105PE before 2017-05-11, GS108Ev3 before 2017-05-11, GS108PEv3 before 2017-05-11, GS116Ev2 before...