Tad Book3 Authorization Issues Vulnerabilities

Tad Book3 is an XOOPS module by the individual developer of Tad in Taiwan, China, which can be used to write books, handouts, and as a notepad. Tad Book3 suffers from an authorization issue vulnerability that stems from the Tad Book3 Edit Book page not performing authentication. An attacker can u...

Samsung SMR 授权问题漏洞

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in versions prior to Samsung SMR Oct-2021 Release 1, which stems from incorrect authentication in InputManagerService...

Sensitive Cookie Without 'HttpOnly' Flag in yeswiki/yeswiki

Description The software uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag. The HttpOnly flag directs compatible browsers to prevent client-side script from accessing cookies. Including the HttpOnly flag in the Set-Cookie HTTP response header helps...

CVE-2021-39879

Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin YITH Maintenance Mode, which ste...

Webauthn-Framework 授权问题漏洞

Webauthn-Framework is an authentication mechanism. It is used by Web applications to create and use strong, proven, scoped, public-key based credentials for strong authentication of users. Webauthn-Framework suffers from a security vulnerability that allows an attacker in control of a user's syst...

Dell Vnx2 Oe For File 安全特征问题漏洞

Dell Vnx2 Oe For File is an operating environment from Dell USA. A security signature issue vulnerability exists in Dell Vnx2 Oe For File that originates from an error in the processing of authentication requests. A remote attacker could use this vulnerability to bypass the authentication process...

CVE-2021-41317

XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...

PT-2021-4217 · Apache +1 · Apache Shiro +1

Name of the Vulnerable Software and Affected Versions: Apache Shiro versions prior to 1.8.0 Description: The issue is related to weaknesses in the authentication mechanism of Apache Shiro. A specially crafted HTTP request may cause an authentication bypass, allowing a remote attacker to gain...

Netgear NETGEAR 竞争条件问题漏洞

Netgear NETGEAR is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in the NETGEAR Smart Switch that stems from the device's multi-step HTTP authentication process only...

Fortinet FortiManager Code Injection Vulnerability

Fortinet FortiManager is a centralized network security management platform from Fortinet, Inc. The platform supports centralized management of any number of Fortinet devices and can group devices into different management domains ADOM to further simplify multi-device security deployment and...

CVE-2021-35215

Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability...

PT-2021-7541 · Vmware · Vmware Vrealize Log Insight

Name of the Vulnerable Software and Affected Versions: VMware vRealize Log Insight versions 8.x prior to 8.4 Description: The issue is due to improper user input validation, allowing an attacker with user privileges to inject a malicious payload via the Log Insight UI. This payload would be...

CVE-2021-37597

WP Cerber before 8.9.3 allows MFA bypass via wordpressloggedinhash manipulation...

CVE-2021-3458

The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified...

Information Disclosure

apache-airflow is vulnerable to information disclosure. The logging server running on port 0.0.0.0 by default has no authentication and allows reading log files of DAG jobs...

Siemens Sicam Missing Authentication for Critical Function

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. An attacker with access to the device's web server might be able to execute administrative commands without authentication. File data ot500430.nasl...

PT-2021-14612 · Dell · Dell Openmanage Enterprise

Name of the Vulnerable Software and Affected Versions: Dell OpenManage Enterprise versions prior to 3.6.1 Description: The issue is related to an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to hijack an elevated session or...

CVE-2021-32002 SiteManager troubleshooter allows access without authentication from local network

Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network information and configuration of the SiteManager. This issue affects: Secomea SiteManager All versions prior to 9.5 on Hardware...

CVE-2021-21538

Dell EMC iDRAC9 (Dell EMC Remote Access Controller) versions 4.40.00.00 and later are affected by CVE-2021-21538 when prior to 4.40.10.00 due to an improper authentication vulnerability that could allow a remote, unauthenticated attacker to gain access to the iDRAC virtual console. Root cause: im...