2861 matches found
Authentication flaw
An authentication bypass vulnerability in the Direct Connection Module in Ezviz CS-C6N-xxx prior to v5.3.x build 20230401, Ezviz CS-CV310-xxx prior to v5.3.x build 20230401, Ezviz CS-C6CN-xxx prior to v5.3.x build 20230401, Ezviz CS-C3N-xxx prior to v5.3.x build 20230401 allows remote attackers t...
Authentication flaw
Netwrix Usercube before 6.0.215, in certain misconfigured on-premises installations, allows authentication bypass on deployment endpoints, leading to privilege escalation. This only occurs if the configuration omits the required restSettings.AuthorizedClientId and restSettings.AuthorizedSecret...
The vulnerability of the Metabase data visualization and reporting software, related to deficiencies in authentication procedures, allows attackers to circumvent existing security restrictions and execute arbitrary code.
The vulnerability of the Metabase data visualization and reporting software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and execute arbitrary code remotely...
Authentication flaw
The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any...
Unitree Robotics A1 Security Breach
Unitree Robotics A1 is a quadrupedal robot from Chinese company Unitree Robotics. A security vulnerability exists in Unitree Robotics A1 version 1.16, which stems from a lack of authentication and allows a local attacker to use a web server to view through a webcam...
Authentication flaw
Statamic CMS is a Laravel and Git powered content management system CMS. Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or...
CVE-2023-48303
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of user configured external storage...
CVE-2023-42770
Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentication challenge...
Authentication flaw
Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentication challenge...
Authentication flaw
The Strapi Protected Populate Plugin protects get endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has bee...
PT-2023-27012 · Unknown · Clusterpro X +3
Name of the Vulnerable Software and Affected Versions: CLUSTERPRO X versions 5.1 and earlier EXPRESSCLUSTER X versions 5.1 and earlier CLUSTERPRO X SingleServerSafe versions 5.1 and earlier EXPRESSCLUSTER X SingleServerSafe versions 5.1 and earlier Description: The issue allows an attacker to log...
Authentication flaw
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...
Authentication flaw
An attacker is able to read any file on the server hosting the H2O dashboard without any authentication...
Authentication flaw
An attacker can overwrite any file on the server hosting MLflow without any authentication...
Authentication flaw
VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older version. On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass log...
AsyncSSH Rogue Session Attack
Summary An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation. Details The rogue session attack targets any SSH client connecting to an AsyncSSH server, on which the attacker must have a shell...
Authentication flaw
Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment...
The vulnerability of the NPort 6000 terminal server’s microprogramming software arises from the improper implementation of authentication algorithms, allowing attackers to escalate their privileges.
The vulnerability of the NPort 6000 terminal server’s microprogramming software is related to the improper implementation of the authentication algorithm. Exploiting this vulnerability allows a malicious actor to increase their privileges remotely...
Authentication flaw
Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are recommended to upgrade to version 18.12.09...
