CVE-2023-52949

Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors...

CVE-2024-45075

IBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to administrator due to missing authentication...

Hitachi Energy MicroSCADA X SYS600 安全漏洞

Hitachi Energy MicroSCADA X SYS600 is a SCADA product from Hitachi, Japan. It ensures optimal control and reliable operation of your switching station through seamless integration and connectivity between different devices and systems. A security vulnerability exists in Hitachi Energy MicroSCADA ...

PT-2024-29899 · Homepage · Homepage

Name of the Vulnerable Software and Affected Versions: Homepage version 0.9.1 Description: The default setup of Homepage is vulnerable to DNS rebinding due to the lack of certificate and authentication. An attacker can exploit this by changing the DNS records of their domain to the internal IP...

The vulnerabilities of the CPCI85 and SICORE processor control modules from Siemens SICAM, such as CP-8031, CP-8050, and SICAM EGS, allow attackers to downgrade the firmware version of the devices.

The vulnerability of the CPCI85 and SICORE processor module control systems from Siemens SICAM, such as CP-8031, CP-8050, and SICAM EGS, stems from the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to downgrade the firmware version of the...

WordPress Getwid – Gutenberg Blocks plugin <= 2.0.10 - Missing Authentication to API key update vulnerability

Missing Authentication to API key update vulnerability discovered by Peter Thaleikis in WordPress Plugin Getwid versions = 2.0.10...

SUSE CVE-2021-26928

BIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. Because of this, products that use BIRD which may, for example, include Tigera products in some configurations, as well as products of other vendors may have been susceptible to route redirection for Denia...

CVE-2024-4609

A vulnerability exists in the Rockwell Automation FactoryTalk® View SE Datalog function that could allow a threat actor to inject a malicious SQL statement if the SQL database has no authentication in place or if legitimate credentials were stolen. If exploited, the attack could result in...

CVE-2023-39466

CVE-2023-39466 applies to Triangle MicroWorks SCADA Data Gateway. The vulnerability is in the get_config endpoint, where lack of authentication allows remote attackers to disclose sensitive information without credentials. Root cause: missing authentication prior to accessing get_config functiona...

CVE-2024-3701

The system application com.transsion.kolun.aiservice component does not perform an authentication check, which allows attackers to perform malicious exploitations and affect system services...

CVE-2024-31813

TOTOLINK EX200 V4.0.3c.7646B20201211 does not contain an authentication mechanism by default...

CVE-2023-51571

Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this...

PT-2024-13729 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions 7.1.x through 7.2.3 Description: The issue concerns the lack of authentication requirement for certain API endpoints. Specifically, the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost do not...

PT-2024-20474 · Allegro Ai · Clearml

Name of the Vulnerable Software and Affected Versions: Allegro AI's ClearML platform affected versions not specified Description: The issue is related to a lack of authentication in the fileserver component, allowing a remote attacker to access, create, modify, and delete files without proper...

The vulnerability of the Photos component in the macOS operating system, related to the lack of authentication for the critical function, allows a hacker to access the “Photos Album” without authentication.

The vulnerability of the macOS operating system is related to the absence of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to access the “Photos Album” album without being authenticated...

The vulnerabilities of the API interfaces of microprogramming software for thermal scanning systems like FeverWarn ESP32, FeverWarn RaspberryPi, and the FeverWarn DataHub RaspberryPi, which allow attackers to gain unauthorized access to protected information.

The vulnerability of the API interfaces of microprogramming software for thermal scanning systems like FeverWarn ESP32, FeverWarn RaspberryPi, and the FeverWarn DataHub RaspberryPi involves the absence of authentication procedures for critical functions. Exploiting this vulnerability could allow ...

PT-2024-1434 · Unknown · Machinesense +3

Name of the Vulnerable Software and Affected Versions: MachineSense affected versions not specified FeverWarn ESP32 affected versions not specified FeverWarn RaspberryPi affected versions not specified FeverWarn DataHub RaspberryPi affected versions not specified Description: The cloud provider...

The vulnerability of the HNAP1 interface in D-Link DIR-822 microprogrammed router software allows a hacker to gain access to administrator accounts with empty passwords.

The vulnerability of the HNAP1 interface of D-Link DIR-822 microprogrammed router software is related to the absence of authentication for the critical function. Exploiting this vulnerability allows a malicious actor to access administrator accounts with empty passwords...

The vulnerability of the HNAP1 interface in D-Link DIR-822 microprogrammed router software allows a hacker to gain access to administrator accounts with empty passwords.

The vulnerability of the HNAP1 interface of D-Link DIR-822 microprogrammed router software is related to the absence of authentication for the critical function. Exploiting this vulnerability allows a malicious actor to access administrator accounts with empty passwords...

WordPress Plugin Contact Form Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...