3176 matches found
CVE-2023-25563 GSS-NTLMSSP vulnerable to multiple out-of-bounds reads when decoding NTLM fields
GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of...
JSA10413 - Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) products - Security Bundle - Authentication & Authorization Issue
Last Modified Date 24-Aug-2026 0:34:58...
SA45476 - Client Side Desync Attack (Informational)
Last Modified Date 24-Aug-2026 0:35:08...
CVE-2023-0716 Wicked Folders <= 2.18.16 - Missing Authorization on ajax_edit_folder
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajaxeditfolder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this...
CVE-2023-0234 SiteGround Security < 1.3.1 - Admin+ SQLi
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue...
D-Link Wireless Access Point Code Execution
The vulnerability of the UPGCGICheckAuth function in D-Link’s wireless access points DAP-2020 and DAP-1360 is related to numerical truncation errors during the processing of the binary file webupg. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2023-22501
An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances. With write access to a User Directory and outgoing email enabled...
CVE-2023-22501
An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances. With write access to a User Directory and outgoing email enabled...
CVE-2023-22501
An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances. With write access to a User Directory and outgoing email enabled...
CVE-2022-42970
A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Affected Products: APC Easy UPS Online Monitoring Software Windows 7, 10, 11 & Windows...
CVE-2022-48176
Netgear routers R7000P before v1.3.3.154, R6900P before v1.3.3.154, R7960P before v1.4.4.94, and R8000P before v1.4.4.94 were discovered to contain a pre-authentication stack overflow...
Oracle Access Manager Authentication Engine Unauthorized Access
The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
CVE-2022-43978 Limited Authentication bypass due to hardcoded secret
There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order t...
Jenkins Plugin Keycloak Authentication 授权问题漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...
Cisco ASA Firepower Threat Defense Auth Bypass
The vulnerability of the authentication and authorization processes for VPN connections of microprogrammed network interface devices supporting Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD is related to access control deficiencies. Exploiting this vulnerability can...
CVE-2023-22334
Use of password hash instead of password for authentication vulnerability in CONPROSYS HMI System CHS Ver.3.4.5 and earlier allows a remote authenticated attacker to obtain user credentials information via a man-in-the-middle attack...
CVE-2023-22334
Use of password hash instead of password for authentication vulnerability in CONPROSYS HMI System CHS Ver.3.4.5 and earlier allows a remote authenticated attacker to obtain user credentials information via a man-in-the-middle attack...
CVE-2023-22334
CVE-2023-22334 affects CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier. The root issue is use of a password hash instead of the actual password for authentication, which can allow a remote authenticated attacker to obtain user credentials information via a man-in-the-middle attack. Affected advi...
CVE-2021-4314
The connected PT-2023-12418 entry provides concrete details for CVE-2021-4314: affected software is zOSMF versions 1.16–1.19. The root cause is bypass of JWT token validation when APAR PH12143 is not applied, causing ZAAS client/API ML API queries to accept forged tokens and authenticate as other...
