The vulnerability of the Grafana monitoring and observation platform, related to incorrect authentication, allows attackers to block attempts to access the system.

The vulnerability of the Grafana monitoring and observation platform lies in the registration of another person’s email address as a user name. Exploiting this vulnerability could allow a malicious actor to block attempts to access the system remotely...

The vulnerability of the Grafana monitoring and observation platform, related to incorrect authorization, allows a violator to increase their privileges.

The vulnerability of the Grafana monitoring and observation platform is related to incorrect authentication. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

The vulnerability of the AI application scaling framework and Python Ray, related to deficiencies in the authentication process, allows attackers to read arbitrary files from the /static/ directory.

The vulnerability of the AI application scaling framework and Python Ray is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to read arbitrary files from the /static/ directory using a specially crafted HTTP request...

The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar, related to authentication flaws, allows attackers to intercept and modify data in Pulsar streams.

The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to intercept and modify data in Pulsar streams remotely...

CVE-2024-31134

In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled...

Schneider Electric Easergy T200 Security Vulnerability

Schneider Electric Easergy T200 is an intelligent digital protection terminal from Schneider Electric France. It is mainly used for protection and control in power systems to help monitor and protect power equipment from faults and abnormal operations, thus ensuring stable operation of the power...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, related to deficiencies in the authentication mechanism, allows attackers to circumvent existing security restrictions.

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of JetBrains TeamCity is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions from a remote location...

Online-College-Event-Hall-Reservation-System SQL Injection Vulnerability

Online-College-Event-Hall-Reservation-System is an online college event hall reservation system by Magesh K individual developer. Designed to automate the hall booking process to eliminate manual logging and increase efficiency. Online-College-Event-Hall-Reservation-System suffers from a SQL...

The vulnerability of the FortiAuthenticator HA component in FortiOS operating systems allows attackers to increase their privileges.

The vulnerability of the FortiAuthenticator HA component in FortiOS operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

Authentication flaw

Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application...

PT-2024-2610 · Apache · Apache Pulsar

Name of the Vulnerable Software and Affected Versions: Apache Pulsar versions 2.6.0 through 2.10.5 Apache Pulsar versions 2.11.0 through 2.11.2 Apache Pulsar versions 3.0.0 through 3.0.1 Apache Pulsar version 3.1.0 Description: The issue is related to an improper authentication vulnerability in t...

Authentication flaw

The issue was addressed with improved checks. This issue is fixed in iOS 17.4 and iPadOS 17.4. Shake-to-undo may allow a deleted photo to be re-surfaced without authentication...

QNAP Systems Multiple Product Licensing Issues Vulnerabilities

QNAP Systems QuTScloud and others are products of China Weilian Technology QNAP Systems.QNAP Systems QuTScloud is a cloud-optimized version of the QNAP NAS operating system.QNAP Systems QTS is an operating system for entry- to mid-range QNAP NAS use. QNAP Systems QuTS hero is an operating system...

Authentication flaw

RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the xmlsec1 command line tool is called internally to verify the signature of SAML assertions. When xmlsec1 is used without defining the enabled...

Authentication flaw

A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to bypass secondary authentication and access an affected Windows device. This vulnerability is due to a failure to invalidate locally created trusted sessions after a reboot of t...

Authentication flaw

Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM credentials unavailable...

Authentication flaw

Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number...

The vulnerability of the SCP utility for access control and remote authentication, as well as software such as BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Application Visibility and Reporting (AVR), BIG-IP Camer-Grade NAT (CGNAT), BIG-IP DDos Hybrid Defender, BIG-IP Domain Name System, BIG-IP Edge Gateway, BIG-IP Fraud Protection Service, BIG-IP Global Traffic Manager, BIG-IP Link Controller, BIG-IP Local Traffic Manager, BIG-IP Policy Inforcement Manager, BIG-IP SSL Orchestrator, BIG-IP Webaccelerator, and BIG-IP WebSafe—is related to unlimited resource distribution. This allows attackers to execute arbitrary commands.

The vulnerability of the SCP utility for access control and remote authentication, as well as software such as BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP...

Authentication flaw

If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an admin role and then be able to use this new account to have elevated privileges on the instance...

PT-2024-2301 · Linksys · Linksys E2000

Name of the Vulnerable Software and Affected Versions: Linksys E2000 version Ver.1.0.06 build 1 Description: The issue is related to a flaw in the authentication procedure of the Linksys E2000 router, which can be exploited to bypass authentication and gain full access to the device. This can...