2862 matches found
PT-2023-24731 · Keyfactor · Keyfactor Ejbca
Name of the Vulnerable Software and Affected Versions: Keyfactor EJBCA versions prior to 8.0.0 Description: The issue is related to an authentication problem in the RA web certificate distribution servlet, specifically at the "/ejbca/ra/cert" endpoint. This can lead to a partial denial of service...
The vulnerability of the phpcgi_main function in the D-Link DIR-859 router’s microprogramming system allows a hacker to increase their privileges.
The vulnerability of the phpcgimain function in the D-Link DIR-859 router’s microprogramming system is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow a malicious actor to gain increased privileges...
The vulnerability of the miniOrange OAuth SSO plugin for WordPress content management systems allows attackers to bypass existing security restrictions.
The vulnerability of the miniOrange OAuth SSO plugin for WordPress content management systems is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions remotely...
Authentication flaw
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handleinstallation function that is called via the inisevinstallation AJAX aciton in various versions. This makes it possible for authenticated attackers with...
Authentication flaw
Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change, and/or reset configuration settings of the affected products. Affected products and versions are as follows: Si-R 30B all versions, Si-R...
The vulnerability of the OTP component in the Erlang programming language allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the OTP component in the Erlang programming language is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to confidential data, compromise its integrity, and cause service failures...
CVE-2023-35134
Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only...
Authentication flaw
Weintek Weincloud v0.13.6 could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error message responses...
Authentication flaw
A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer...
Authentication flaw
Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit IDU before 11.4 allows remote attackers to obtain arbitrary control of the IDU/ODU system. Any attacker with layer-3 network access to the IDU can impersonate the Touch Panel Unit TPU within the IDU by sending crafte...
The vulnerability of the Telnet service of the cable modem Hitron CODA-5310, which allows a hacker to elevate their privileges to the level of an administrator.
The vulnerability of the Telnet service of the cable modem Hitron CODA-5310 is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to elevate their privileges to the level of an administrator...
Authentication flaw
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug...
dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method
A vulnerability was found in dotNET applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords and bypass security restrictions. This flaw allows a remote attacker to bypass security features, causing an impact on...
Authentication flaw
Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a...
Authentication flaw
An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, which allows a remote attacker to craft an e-mail message with a fake sender address such that programs that rely...
CVE-2023-35872
The Message Display Tool MDT of SAP NetWeaver Process Integration - version SAPXIAF 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The...
Authentication flaw
The Runtime Workbench RWB of SAP NetWeaver Process Integration - version SAPXITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The...
Authentication flaw
SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNEL 7.93, under some conditions, perfor...
PT-2023-4553 · Openssl +7 · Openssl +7
Name of the Vulnerable Software and Affected Versions: OpenSSL affected versions not specified Description: The AES-SIV cipher implementation in OpenSSL contains a bug that causes it to ignore empty associated data entries, which are unauthenticated as a consequence. This issue can mislead...