CVE-2022-22523 Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass

An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled...

Carlo Gavazzi UWP 授权问题漏洞

Carlo Gavazzi UWP is a monitoring and control Universal Web Platform from Carlo Gavazzi. It is used for applications such as building automation, energy efficiency performance management and parking lot guidance. An authorization issue vulnerability exists in Carlo Gavazzi UWP version 3.0, CPY Ca...

Security fix for the ALT Linux 9 package glpi version 9.5.9-alt1

9.5.9-alt1 built Sept. 23, 2022 Pavel Zilke in task 307140 Sept. 14, 2022 Pavel Zilke - New version 9.5.9 - This release fixes several critical security issues that has been recently discovered. Update is strongly recommended! - Security fixes: + CVE-2022-35945 : XSS through registration API +...

CVE-2022-36105

Summary of CVE-2022-36105 (TYPO3 user enumeration via response timing) TYPO3 CMS is vulnerable to a timing-based information disclosure during user authentication (backend and frontend). An observer can distinguish existing vs. non-existing user accounts by measuring response times. The issue aff...

InventoryManagementSystem SQL注入漏洞

InventoryManagementSystem is an inventory management system by Sajan Rajbhandari, an individual developer. It provides an easy way to track products, suppliers, customers, and purchasing and sales information. A security vulnerability exists in InventoryManagementSystem version 1.0, which...

CVE-2022-37145

The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on the login page with no time or attempt limitation in an...

CVE-2022-1368 Cognex 3D-A1000 Dimensioning System Missing Authentication for Critical Function

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 3354 and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an...

Dell BIOS 授权问题漏洞

Dell BIOS is embedded software on a small memory chip SMI on a computer motherboard from Dell, Inc. The Dell BIOS has a security vulnerability that stems from the inclusion of an incorrect authentication vulnerability, which could be exploited by a locally authenticated malicious user by sending...

PT-2022-4844 · Trend Micro · Trend Micro Apex One +1

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex One affected versions not specified Trend Micro Apex One as a Service affected versions not specified Description: A vulnerability in the authentication procedure allows an attacker to bypass login authentication by falsifyin...

Dell CloudLink 授权问题漏洞

Dell CloudLink is a data encryption and key management system from Dell USA. A security vulnerability exists in Dell CloudLink version 7.1.3 and prior versions. An attacker could exploit the vulnerability to bypass authentication and gain access to the CloudLink system console...

CVE-2022-36755

D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZEDGROUP=1 value, as demonstrated by a request for getcfg.php...

CVE-2022-36755

CVE-2022-36755 affects D-Link DIR845L A1 with an authentication flaw exploitable via an AUTHORIZED_GROUP=1 value, demonstrated by a getcfg.php request. CVSSv3.1 base score 9.8 (CRITICAL) with network access, no user interaction required, and impacts on confidentiality, integrity, and availability...

CVE-2022-36755

D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZEDGROUP=1 value, as demonstrated by a request for getcfg.php...

CVE-2022-35733

Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders UDR-JA1004/JA1008/JA1016 firmware versions v1.0.20.13 and earlier, and UDR-JA1016 firmware versions v2.0.20.13 and earlier allows a remote unauthenticated attacker to execute an arbitrary OS...

Authentication flaw

Mealie1.0.0beta3 is vulnerable to user enumeration via timing response discrepancy between users and non-users when an invalid password message is displayed during an authentication attempt...

CVE-2022-37422

Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded...

PT-2022-17958

Name of the Vulnerable Software and Affected Versions: Sequi PortBloque S affected versions not specified Description: The issue is related to improper authentication, which may allow an attacker to bypass the authentication process and gain user-level access to the device. Recommendations: At th...

The vulnerability of the Jenkins Compuware ISPW Operations Plugin, related to deficiencies in authentication procedures, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Jenkins Compuware ISPW Operations Plugin is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the WS-UsernameToken authentication mechanism in Dahua cameras, related to the possibility of intercepting ONVIF requests. Exploiting this vulnerability could allow a malicious actor to gain full access to the IP camera.

The vulnerability of the WS-UsernameToken authentication mechanism in Dahua IP cameras lies in the ability to intercept ONVIF requests. Exploiting this vulnerability could allow a malicious actor to gain full access to the IP camera...

CVE-2022-29957

The Emerson DeltaV Distributed Control System DCS through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety of functionality. These protocols include Firmware upgrade 18508/TCP, 18518/TCP; Plug-and-Play 18510/UDP; Hawk services 18507/UDP; Managemen...