GHSA-68WM-PFJF-WQP6 Authelia vulnerable to an authentication bypassed with malformed request URI on nginx

Impact This affects uses who are using nginx ngxhttpauthrequestmodule with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect other proxy servers, but all of the ones we officially suppo...

CVE-2021-41025

Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an instance of concurrent execution using shared resource with improper synchronization and one of...

CVE-2021-41025

CVE-2021-41025 affects Fortinet FortiWeb’s confd authentication mechanism. Affected FortiWeb versions include 6.0.0–6.0.7, 6.1.0–6.1.2, 6.2.0–6.2.6, 6.3.0–6.3.15, 6.4.0–6.4.1. The issue comprises concurrent execution using a shared resource with improper synchronization and an authentication bypa...

Hardcoded SSH Key in Cisco Policy Suite Lets Remote Hackers Gain Root Access

Cisco Systems has released security updates to address vulnerabilities in multiple Cisco products that could be exploited by an attacker to log in as a root user and take control of vulnerable systems. Tracked as CVE-2021-40119, the vulnerability has been rated 9.8 in severity out of a maximum of...

Authentication flaw

An issue in the authentication mechanism in Nong Ge File Explorer v1.4 unauthenticated allows to access sensitive data...

CVE-2021-30667

A logic issue was addressed with improved validation. This issue is fixed in iOS 14.6 and iPadOS 14.6. An attacker in WiFi range may be able to force a client to use a less secure authentication mechanism...

CVE-2021-30667

A logic issue was addressed with improved validation. This issue is fixed in iOS 14.6 and iPadOS 14.6. An attacker in WiFi range may be able to force a client to use a less secure authentication mechanism...

CVE-2021-27794

A vulnerability in the authentication mechanism of Brocade Fabric OS versions before Brocade Fabric OS v.9.0.1a, v8.2.3a and v7.4.2h could allow a user to Login with empty password, and invalid password through telnet, ssh and REST...

Unpatched Security Flaws Expose Mitsubishi Safety PLCs to Remote Attacks

Multiple unpatched security vulnerabilities have been disclosed in Mitsubishi safety programmable logic controllers PLCs that could be exploited by an adversary to acquire legitimate user names registered in the module via a brute-force attack, unauthorizedly login to the CPU module, and even cau...

Zhengzhou Weixia Computer Technology Co., Ltd. learning platform has a logic flaw vulnerability

Zhengzhou Weixia Computer Technology Co., Ltd. is a company mainly engaged in the development of online education software. Zhengzhou Weixia Computer Technology Co., Ltd. learning platform has a logic flaw vulnerability that can be exploited by attackers to bypass the authentication mechanism to...

XScreenSaver buffer overflow vulnerability

XScreenSaver is an open source screensaver written in C. XScreenSaver suffers from a buffer error vulnerability that stems from updatescreenlayout causing a buffer overflow when the application has more than 10 disconnectable video outputs. An attacker could bypass the authentication mechanism...

Authentication flaw

Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngxhttpauthrequestmodule with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect...

VMware Sounds Ransomware Alarm Over Critical Severity Bug

VMware patched a critical bug impacting its vCenter Server platform with a severity rating of 9.8 out of 10. The company said the flaw could allow a remote attacker to exploit its products and take control of a company’s affected system. VMware went a step further on Tuesday, calling on IT securi...

Design/Logic Flaw

The vSphere Client HTML5 contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform...

CVE-2021-21986

The vSphere Client HTML5 contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform...

VMware vCenter Server 6.5 / 6.7 / 7.0 Multiple Vulnerabilities (VMSA-2021-0010)

The version of VMware vCenter Server installed on the remote host is 6.5 prior to 6.5 U3p, 6.7 prior to 6.7 U3n or 7.0 prior to 7.0 U2b. It is, therefore, affected by multiple vulnerabilities: - The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validatio...

IBM InfoSphere Information Server Information Disclosure Vulnerability (CNVD-2021-37596)

IBM InfoSphere Information Server is a data integration platform that includes a range of products that enable you to understand, cleanse, monitor, transform, and transfer data, as well as collaborate to bridge the gap between business and IT. An information disclosure vulnerability exists in IBM...

User enumeration in authentication mechanisms

Description ----------- The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. Resolution ---------- We now ensure that a generic message is returned whether the user exists or not if the password ...

GHSA-2FRX-J9HJ-6C65 User enumeration in authentication mechanisms

Description ----------- The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. Resolution ---------- We now ensure that a generic message is returned whether the user exists or not if the password ...

CVE-2021-29747

CVE-2021-29747 affects IBM InfoSphere Information Server 11.7 and is described as an information disclosure vulnerability caused by a faulty authentication mechanism. The issue could allow a remote attacker over the network to obtain highly sensitive information. The IBM DataStage information-dis...