419 matches found
Apache Tomcat 9.0.0.M1 < 9.0.46 Authentication Weakness
The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.5, 9.0.0.M1 to 9.0.45, 8.5.0 to 8.5.65 or 7.0.0 to 7.0.108. It is, therefore, affected by an authentication weakness due to queries made by the JNDI Realm which did not always correctly escape parameters. Note that the...
Apache Tomcat 8.5.x < 8.5.66 Authentication Weakness
The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.5, 9.0.0.M1 to 9.0.45, 8.5.0 to 8.5.65 or 7.0.0 to 7.0.108. It is, therefore, affected by an authentication weakness due to queries made by the JNDI Realm which did not always correctly escape parameters. Note that the...
Apache Tomcat JNDI Realm Authentication Weakness Vulnerability (Jul 2021) - Windows
Apache Tomcat is prone to an authentication weakness vulnerability in the JNDI Realm. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...
UBUNTU-CVE-2020-26558
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing in the Passkey authentication procedure by reflection of the public key and the authentication evidence of the initiati...
Intel Virtualization Technology for Direct I/O 授权问题漏洞
Intel Virtualization Technology for Direct I/O Intel VT-d is a part of Intel Virtualization Technology from Intel Corporation, which mainly targets the I/O subsystem, and is implemented by introducing a redirection unit in hardware, which is used to redirect DMA operations and interrupt passes to...
Fixed in Apache Tomcat 9.0.46
Low: Authentication weakness CVE-2021-30640 Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data eg user names as well as configuration data provided by an administrator. In limited circumstances it was possible for...
Fixed in Apache Tomcat 10.0.6
Low: Authentication weakness CVE-2021-30640 Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data eg user names as well as configuration data provided by an administrator. In limited circumstances it was possible for...
Fixed in Apache Tomcat 8.5.66
Low: Authentication weakness CVE-2021-30640 Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data eg user names as well as configuration data provided by an administrator. In limited circumstances it was possible for...
The vulnerability in the implementation of UI processes of anti-virus protection solutions from Kaspersky – such as Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Small Office Security, and Kaspersky Security Cloud – allows attackers to trigger a service failure.
The vulnerability of the UI implementation for anti-virus protection solutions from Kaspersky – including Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Small Office Security, and Kaspersky Security Cloud – is related to deficiencies in the authentication...
The vulnerability of the software for system management in the One-to-one Dell EMC OpenManage Server Administrator mode, related to authentication procedures that allow a malicious actor to gain access to the administrator’s privileges on the system.
The vulnerability of the software for managing systems in the One-to-one Dell EMC OpenManage Server Administrator mode is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the administrator’s...
Cisco Catalyst 9000 安全漏洞
The Cisco Catalyst 9000 is a switch from the American company Cisco. A security vulnerability exists in the Cisco Catalyst 9000 Family Wireless Controllers that stems from insufficient CAPWAP packet authentication. An attacker could exploit the vulnerability to cause a denial of service DoS...
The vulnerability of the web portal of D-Link DSL-2888A microprogramming software for routers allows a hacker to exploit it to increase their privileges.
The vulnerability of the D-Link DSL-2888A router’s microprogramming software web portal is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...
The vulnerability of the user API module of the software platform for developing and managing online stores Magento Commerce allows a hacker to gain unauthorized access to protected information.
The vulnerability of the user API module of the Magento Commerce software development and management platform is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
PT-2021-7746
Name of the Vulnerable Software and Affected Versions Veritas Backup Exec versions prior to 21.2 Description A flaw exists in Veritas Backup Exec related to weaknesses in the authentication process when using the SHA cryptographic algorithm. This allows a remote attacker to gain unauthorized acce...
The vulnerability of the File System API interface in the Google Chrome web browser allows a hacker to circumvent existing security restrictions.
The vulnerability of the File System API interface in the Google Chrome web browser is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...
The vulnerability of the File System API interface in the Google Chrome web browser allows a hacker to circumvent existing security restrictions.
The vulnerability of the File System API interface in the Google Chrome web browser is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...
The vulnerability in the vManage web interface of the software-defined Cisco SD-WAN network allows a malicious individual to gain unauthorized access to protected information.
The vulnerability in the vManage web interface of the Cisco SD-WAN program-defined network is due to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
Authentication flaw
HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An attacker could potentially decode the encoded credentials...
The vulnerability of D-Link DSL-2640B router software’s CGI modules allows attackers to increase their privileges.
The vulnerability of D-Link DSL-2640B router software’s CGI modules is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers, operating remotely, to gain increased privileges...
Multiple vulnerabilities in UNIVERGE SV9500/SV8500 series
Overview Remote system maintenance feature of UNIVERGE SV9500/SV8500 series' Web based remote maintenance console contains multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2020-5685 Incorrect Implementation of Authentication Algorithm CWE-303 - CVE-2020-5686 NEC Platforms,...