Authentication Bypass

github.com/ansible-semaphore/semaphore is vulnerable to Authentication Bypass. The vulnerability exists due to improper handling of the authentication mechanism in auth.go, which allows an attacker to bypass the access control...

My Findings

Lines of code Vulnerability details Impact 1. Integer overflow: In the publishCompressedBytecode function, the check dictionary.length = 2 16 8 is intended to ensure that the dictionary does not become too large, but it is not sufficient to prevent an integer overflow. If dictionary.length exceed...

Here are some potential security vulnerabilities that I have identified in this particular contract (BytecodeCompressor.sol)

Lines of code Vulnerability details Impact 1. Integer overflow: In the publishCompressedBytecode function, the check dictionary.length = 2 16 8 is intended to ensure that the dictionary does not become too large, but it is not sufficient to prevent an integer overflow. If dictionary.length exceed...

CVE-2022-41333

An uncontrolled resource consumption vulnerability CWE-400 in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests...

FortiRecorder - DoS in login authentication mechanism

An uncontrolled resource consumption vulnerability CWE-400 in FortiRecorder login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests...

Authorization

An issue was discovered in the A4N Aremis 4 Nomad application 1.5.0 for Android. It possesses an authentication mechanism; however, some features do not require any token or cookie in a request. Therefore, an attacker may send a simple HTTP request to the right endpoint, and obtain authorization ...

SUSE CVE-2011-4971

Multiple integer signedness errors in the 1 processbinsaslauth, 2 processbincompletesaslauth, 3 processbinupdate, and 4 processbinappendprepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service crash via a large body length value in a packet...

CVE-2022-48300

The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-48299

The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

Design/Logic Flaw

The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

Design/Logic Flaw

The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-48299

The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-48300

The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-48300

The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-48299

CVE-2022-48299 affects Huawei HarmonyOS: the WMS module exposes APIs without proper authentication. Root cause: insufficient authentication in the WMS interface. Impact: potential data confidentiality loss via network access (CVSS 3.1 base score 7.5). Exploitation status is not detailed in the pr...

D-Link DIR-1935 SetWebFilterSetting WebFilterURLs Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handli...

Authentication Bypass

org.apache.shiro:shiro-web is vulnerable to authentication bypass attacks. A remote attacker is able bypass the authentication mechanism when forwarding or including via RequestDispatcher...

Time-of-check To Time-of-Use (TOCTOU)

go.etcd.io/etcd/v3 is vulnerable to time-of-check to time-of-use. The vulnerability exists because the startGateway function of gateway.go does not properly handle gateway endpoint validations, allowing an attacker to bypass the authentication mechanism...

PT-2022-25422 · Wavlink · Wavlink Quantum D4G

Name of the Vulnerable Software and Affected Versions: WAVLINK Quantum D4G WN531G3 versions M31G3.V5030.200325 and earlier Description: The issue arises because the WAVLINK Quantum D4G WN531G3 communicates over HTTP instead of HTTPS, and its hashing mechanism does not rely on a server-supplied ke...

Authorization

DISPUTED influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible...