Authentication flaw

Authentication bypass vulnerability in Enterprise Security Manager ESM and License Manager LM in Intel Security McAfee Security Information and Event Management SIEM 9.6.0 MR3 allows an administrator to make changes to other SIEM users' information including user passwords without supplying the...

CVE-2016-4028

An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the...

Important: Red Hat Security Advisory: Red Hat Single Sign-On security update

A security update is now available for Red Hat Single Sign-On 7.0 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Dovecot auth component remote denial of service vulnerability

Dovecot is an open source based on Linux/UNIX-like systems IMAP and POP3 mail server . A remote denial of service vulnerability exists in the auth component of Dovecot versions 2.2.25.1 through 2.2.26.1. An attacker can exploit this vulnerability to cause a denial of service...

Moxa NPort Authentication Vulnerability

MOXA Nport is a serial communication server. An authentication vulnerability exists in the Moxa NPort. An attacker can exploit the vulnerability to brute-force bypass authentication...

ABB RobotWare Authentication Vulnerability

ABB is a global leader in power and automation technology, ranked among the top 500 companies in the world. An authentication vulnerability exists in ABB RobotWare, which could be exploited by an attacker to bypass certain security restrictions or execute arbitrary code...

Authentication Remote Code Execution Vulnerability in Memcached SASL

Memcached is a high-performance distributed in-memory object caching system for dynamic Web applications to reduce database load. An authentication remote code execution vulnerability exists in Memcached SASL. processbinsaslauth function handling multiple commands of the Memcached binary protocol...

iTrack Easy Plaintext Password Acquisition Vulnerability

The iTrack Easy is a versatile Bluetooth device. The iTrack Easy uses base64 encoding to store account passwords. A remote attacker could use this vulnerability to submit a special request to obtain passwords in plaintext...

CVE-2016-6445

A vulnerability in the Extensible Messaging and Presence Protocol XMPP service of the Cisco Meeting Server CMS before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 could allow an unauthenticated, remote attacker to masquerade as a legitimate user. This vulnerability is due to the XM...

Login CAPTCHA Bypass Vulnerability in AVTECH Device Cookies

AVTECH, founded in 1996, is one of the world's leading CCTV manufacturers. The main products are surveillance equipment, network cameras, network video recorders and so on. AVTECH device cookie has login authentication code bypass vulnerability.AVTECH device use base64 encoded username and passwo...

SQL Injection Vulnerability in Tongda OA System

Ltd. OA-Office Anywhere system is a network intelligent office system developed using PHP. There is a SQL injection vulnerability in this product, the vulnerability URL is: http://host/interface/auth.php?&PASSWORD=1&USERID= The vulnerability URL is: The injected parameter is: USERID The attacker...

Authentication Vulnerability in OsmoCOM Osmo-TRX/Osmo-BTS

Osmocom is a series of projects on open source mobile communications, including software tools for GSM, DECT, TETRA and other mobile communication standards. An authentication vulnerability exists in OsmoCOM Osmo-TRX/Osmo-BTS. An unauthenticated, remote attacker could exploit the vulnerability to...

Legba Incorporated YateBTS Has Authentication Vulnerabilities

Legba Incorporated YateBTS is software for analog protocol stacks for GSM networks. An authentication vulnerability exists in Legba Incorporated YateBTS. An unauthenticated, remote attacker could exploit the vulnerability to execute commands in the transceiver module of the BTS. The transceiver i...

Unspecified vulnerability in Red Hat IPA server

Red Hat IPA server is an authentication solution from Red Hat. A security vulnerability exists in Red Hat IPA server, which is caused by the program failing to adequately check certificates. The vulnerability can be exploited by an attacker to log in as 'retrieve certificate', revoke a certificat...

Pgbouncer 1.6 Invalid User Authentication Bypass

The version of Pgbouncer running on the remote host is affected by an authentication bypass vulnerability due to a flaw in the startauthrequest function within file client.c when handling requests for invalid users. A remote attacker can exploit this issue to bypass authentication and log into...

CVE-2016-5797

CVE-2016-5797 affects Tollgrade LightHouse SMS Software prior to Version 5.1 Patch 3. The issue is information exposure through error messages that reveal whether a username exists, enabling remote account-name enumeration. Affected component is the web-based LightHouse SMS software; the root cau...

Shopify: Stealing livechat token and using it to chat as the user - user information disclosure

Hi , I have found an issue through which an attacker can steal users' livechat access token and use it to login and chat with the support agents as them , he also will be able to get access to sensitive user information such as his email and his first name and last name. Details: When you go to...

Red Hat libvirt Design Vulnerability

Red Hat libvirt is a Linux API for implementing Linux virtualization features from Red Hat, Inc. It supports a variety of Hypervisors, including Xen and KVM, as well as QEMU and a number of virtual products for other operating systems. A design vulnerability exists in Red Hat libvirt that stems...

CVE-2016-4985

An authentication vulnerability was found in openstack-ironic. A client with network access to the ironic-api service could bypass OpenStack Identity authentication, and retrieve all information about any node registered with OpenStack Bare Metal. If an unprivileged attacker knew or was able to...

CVE-2010-5326

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack...