CVE-2019-1020002

Pterodactyl before 0.7.14 with 2FA allows credential sniffing...

CVE-2019-17387

An authentication flaw in the AVPNCRP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevated privileges through arbitrary code execution on Windows, Linux, and macOS...

CVE-2019-18380

Symantec Industrial Control System Protection ICSP, versions 6.x.x, may be susceptible to an unauthorized access issue that could potentially allow a threat actor to create or modify application user accounts without proper authentication...

CVE-2019-19522

OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group. This occurs because root's file can be written to /etc/skey or /var/db/yubikey, and need not be owned by root...

CVE-2011-5100

The web interface in McAfee Firewall Reporter before 5.1.0.13 does not properly implement cookie authentication, which allows remote attackers to obtain access, and disable anti-virus functionality, via an HTTP request...

CVE-2014-10389

The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication...

CVE-2019-14473

eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp...

CVE-2019-10119

eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via an invalid login attempt to the RemoteApi account, aka HMCCU-154. This leads to automatic login as admin...

CVE-2013-1211

Cisco NX-OS on the Nexus 1000V does not properly handle authentication for Virtual Ethernet Module VEM to Virtual Supervisor Module VSM communication, which allows remote attackers to obtain VEM access via 1 spoofed STUN packets or 2 a crafted VMware ESXi instance, aka Bug ID CSCud14832...

CVE-2012-4926

approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u parameter in an 1 app0 disable or 2 app1 enable action...

GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition EE and GitLab Community Edition CE A security vulnerability...

Tridium Niagara Framework和Tridium Niagara Enterprise Security 安全漏洞

Tridium Niagara Framework and Tridium Niagara Enterprise Security are both products of Tridium, Inc.Tridium Niagara Framework is a comprehensive software infrastructure that solves the challenges of creating appliance to enterprise applications. Tridium Niagara Enterprise Security is a...

AutomationDirect MB-Gateway 访问控制错误漏洞

AutomationDirect MB-Gateway is a single-port Modbus gateway module from AutomationDirect, Inc. that converts Modbus TCP to Modbus RTU. An access control error vulnerability exists in the AutomationDirect MB-Gateway that stems from a lack of authentication and access control on the embedded web...

The vulnerability of the administrator panel of microprogrammed software routers such as GL-A1300, GL-AX1800, GL-AXT1800, GL-MT3000, GL-MT2500, GL-MT6000, GL-MT1300, GL-MT300N-V2, GL-AR750S, GL-AR750, GL-AR300M, and GL-B1300 allows attackers to circumvent security restrictions, gain increased privileges, and obtain full control over the device.

The vulnerability of the administrator panel of microprogrammed software routers such as GL-A1300, GL-AX1800, GL-AXT1800, GL-MT3000, GL-MT2500, GL-MT6000, GL-MT1300, GL-MT300N-V2, GL-AR750S, GL-AR750, GL-AR300M, and GL-B1300 is related to deficiencies in authentication procedures. Exploiting this...

The vulnerability of the control panel of microprogrammed software for routers GL-A1300, GL-AX1800, GL-AXT1800, GL-MT3000, GL-MT2500, GL-MT6000, GL-MT1300, GL-MT300N-V2, GL-AR750S, GL-AR750, GL-AR300M, and GL-B1300 allows a hacker to gain unauthorized access to protected information, execute arbitrary code, and gain full control over the device.

The vulnerability of the control panel of microprogrammed software for routers GL-A1300, GL-AX1800, GL-AXT1800, GL-MT3000, GL-MT2500, GL-MT6000, GL-MT1300, GL-MT300N-V2, GL-AR750S, GL-AR750, GL-AR300M, and GL-B1300 is related to deficiencies in authentication procedures. Exploiting this...

CVE-2025-4755

A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R68125. It has been classified as critical. This affects the function sub497DE4 of the file /H5/netconfig.asp. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclose...

The vulnerability of the API component of the Zabbix monitoring system allows a hacker to disclose protected information.

The vulnerability of the API component of the Zabbix monitoring system is related to incorrect authentication. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information that should be protected...

The vulnerability of the ColdFusion software platform, related to deficiencies in the authentication mechanism, allows attackers to circumvent existing security restrictions and execute arbitrary code.

The vulnerability of the ColdFusion software platform is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and execute arbitrary code...

Alibaba Cloud Linux 3 : 0115: booth (ALINUX3-SA-2024:0115)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0115 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2022-2553: The authfile directive in t...

Alibaba Cloud Linux 3 : 0142: curl (ALINUX3-SA-2022:0142)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0142 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2022-22576: An improper authentication...