Authentication flaw

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. Photos belonging to the Hidden Photos Album could be viewed without authentication through Visual Lookup...

CVE-2023-1651

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to...

Authentication flaw

A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2//. The manipulation leads to direct request. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-228015. NOTE: The...

Authentication flaw

A weak authentication vulnerability CWE-1390 in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated attacker to perform password spraying attacks with an increas...

PT-2023-2815 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: The issue is related to a flaw in the authentication procedure of the ksmbd module in Linux operating systems. This flaw can be exploited by a remote attacker to hijack an active...

PT-2023-2819

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description The issue is related to a flaw in the authentication procedure of the ksmbd module in Linux operating systems. This flaw can be exploited by a remote attacker to perform a brute force...

Authentication flaw

Sangoma FreePBX 1805 through 2302 when obtained as a ,.ISO file places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This exposes cleartext authentication credentials for the Asterisk Database MariaDB/MySQL and Asterisk Manager Interface. For example, an attack...

Odoo 安全漏洞

Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in Python language with PostgreSQL as the database and includes modules for sales management, inventory management, and financial management. A security...

CVE-2023-27351

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 Build 63914. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper...

Authentication flaw

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unauthenticated user on the Schneider UPS Monitor service...

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

...

Schneider Electric Easy UPS Online Monitoring Software 访问控制错误漏洞

Schneider Electric Easy UPS Online Monitoring Software is a power monitoring software from Schneider Electric France. The Schneider Electric Easy UPS Online Monitoring Software suffers from an access control error vulnerability that stems from an authentication vulnerability that lacks critical...

Authentication flaw

An Improper Authentication vulnerability in upload-file.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to upload arbitrary files to temporary folders on the device. This issue affects Juniper Networks Junos OS: All versions prior to...

Authentication flaw

The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept possibly cleartext target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point such as authentication...

B&R Industrial Automation B&R VC4 授权问题漏洞

B&R Industrial Automation B&R VC4 is a visualization system from B&R Industrial Automation, Austria. It can be used to create line displays or to control integrated or remote XGA displays with keys and/or touch screens. A security vulnerability exists in the B&R Industrial Automation B&R VC4 that...

PT-2023-20188 · Mitel · Mitel Micollab

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions through 9.6.2.9 Description: A vulnerability in the web conferencing component could allow an unauthenticated attacker to download a shared file via a crafted request, including the exact path and filename, due to...

The vulnerability of the NTLM network authentication protocol for Windows operating systems allows attackers to circumvent security restrictions and gain increased privileges.

The vulnerability of the NTLM network authentication protocol for Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to circumvent security restrictions and enhance their privileges...

The vulnerability of the WLAN module of the Android EMUI operating system and the HarmonyOS operating system allows attackers to interfere with the WLAN service.

The vulnerability of the WLAN layer of the Android EMUI operating system and the HarmonyOS platform is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to influence WLAN services through third-party applications...

Authentication flaw

An improper restriction of excessive authentication attempts vulnerability CWE-307 in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 administrative interface allows an attacker with a valid user account to perform brute-forc...

CVE-2023-0944

Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, email and password. This is possible because the application is vulnerable to IDOR, it does not correctly validate user permissions with respect to certain...