PT-2023-6483 · Apache · Apache Pulsar

Name of the Vulnerable Software and Affected Versions: Apache Pulsar versions through 2.9.4 Apache Pulsar versions from 2.10.0 through 2.10.3 Apache Pulsar version 2.11.0 Description: The issue is related to an improper authentication vulnerability in Apache Pulsar Broker, allowing a client to st...

Stack overflow

A stack-based buffer overflow vulnerability exists in the libzebra.so.0.0.0 securitydecryptpassword functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to a buffer overflow. An authenticated attacker can send an HTTP request to trigger this vulnerability...

CVE-2023-30643

Missing authentication vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attackers to delete arbitrary non-preloaded applications...

VMware SD-WAN update addresses a bypass authentication vulnerability (CVE-2023-20899)

3. VMware SD-WAN Bypass Authentication Vulnerability CVE-2023-20899 VMware SD-WAN contains a bypass authentication vulnerability. VMware has evaluated the severity of this issue to be in the moderate severity range with a maximum CVSSv3 base score of 5.3...

PT-2023-25405 · Unknown · Piigab M-Bus

Name of the Vulnerable Software and Affected Versions: PiiGAB M-Bus affected versions not specified Description: The issue concerns hard-coded credentials used for authentication in PiiGAB M-Bus. No information is provided about the estimated number of potentially affected devices or real-world...

Vulnerability fixed in Grafana

Grafana Labs has fixed a vulnerability in Grafana. The vulnerability is in the way accounts are validated when using Azure Active Directory for authentication. A malicious party could exploit it to completely take over an account and thus gain access gain access to sensitive data in that account...

CVE-2023-3326

pamkrb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket tgt from the Kerberos KDC Key Distribution Center over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pamkrb5 has no way to validate...

DEBIAN-CVE-2023-3326

pamkrb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket tgt from the Kerberos KDC Key Distribution Center over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pamkrb5 has no way to validate...

PT-2023-4089 · Pam Krb5 +2 · Pam Krb5 +2

Name of the Vulnerable Software and Affected Versions: pam krb5 affected versions not specified Description: The issue is related to the incorrect implementation of the authentication algorithm in the pam krb5 module. This allows an attacker to gain unauthorized access to the system by controllin...

4D SAS 4D Server 授权问题漏洞

4D SAS 4D Server is a rapid development platform for business applications from 4D. A security vulnerability exists in the 4D SAS 4D Server Application that stems from the presence of an authentication vulnerability...

CVE-2023-2827 Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital

SAP Plant Connectivity - version 15.5 PCo or the Production Connector for SAP Digital Manufacturing - version 1.0, do not validate the signature of the JSON Web Token JWT in the HTTP request sent from SAP Digital Manufacturing. Therefore, unauthorized callers from the internal network could send...

Microsoft Windows Authentication 安全漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Windows Authentication. An attacker could exploit the vulnerability to elevate privileges. The following products and...

CVE-2023-34232 Snowflake NodeJS Driver vulnerable to Command Injection

snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on SSO browser URL authentication in versions prior to 1.6.21. In order to exploit the potential for command injection, an attacker would need to be successful in 1 establishing a malicio...

WordPress plugin WP User Switch 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Sitecore Experience Platform 安全漏洞

Sitecore Experience Platform XP is a suite of customer digital experience platforms from Sitecore, Denmark. A security vulnerability exists in Sitecore Experience Platform XP version 9.3, which originates from a Remote Code Execution RCE vulnerability in authentication via the component...

CVE-2023-3065 Mobatime mobile application - Authentication bypass

Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue affects Mobatime mobile application AMXGT100 through 1.3.20...

STARFACE 安全漏洞

STARFACE is an IP telephony system for digital communications from STARFACE, Inc. A security vulnerability exists in STARFACE version 7.3.0.10 and prior versions that originates from allowing authentication using password hashes...

CVE-2023-34228

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions...

CVE-2023-33485

TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contains a post-authentication buffer overflow via parameter sPort/ePort in the addEffect function...

Honeywell OneWireless 访问控制错误漏洞

Honeywell OneWireless is an industrial wireless mesh network from Honeywell that can simultaneously support ISA100 Wireless IEC 62734, WirelessHART IEC 62591 field instruments transmitters, actuators, etc., Wi-Fi devices and Ethernet/IP-based devices. A security vulnerability exists in Honeywell...