2867 matches found
Authentication flaw
A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Affected Products: APC Easy UPS Online Monitoring Software Windows 7, 10, 11 & Windows...
Authentication flaw
Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login...
UFLO 代码注入漏洞
UFLO is a pure Java process engine based on Spring that supports various flow methods such as parallel, dynamic parallel, serial, and countersign. A code injection vulnerability exists in UFLO uflo-core, which stems from incorrect user authentication...
GHSA-G25R-GVQ3-WRQ7 Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster
Impact An issue was discovered in Rancher where an authorization logic flaw allows an authenticated user on any downstream cluster to 1 open a shell pod in the Rancher local cluster and 2 have limited kubectl access to it. The expected behavior is that a user does not have such access in the...
Authentication flaw
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication...
Authentication flaw
In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 SCG200 before 3.6.2.0.795, SmartZone 100 SZ-100 before 3.6.2.0.795, SmartZone 300 SZ300 before 3.6.2.0.795, Virtua...
Authentication flaw
A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploi...
The vulnerability of the Portainer container management platform, related to deficiencies in the authentication process, allows a perpetrator to gain full access to the file system.
The vulnerability of the Portainer container management platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain full access to the host’s file system through the host management API...
PT-2023-1297 · Tp Link · Tp-Link Sg105Pe
Name of the Vulnerable Software and Affected Versions: TP-Link SG105PE versions prior to 1.0 1.0.0 Build 20221208 Description: The issue is related to an authentication bypass vulnerability in the firmware of TP-Link SG105PE switches. This vulnerability is associated with weaknesses in the...
The vulnerability of the Jenkins Tuleap Git Branch Source Plugin, related to deficiencies in authentication procedures, allows attackers to gain unauthorized access to protected information.
The vulnerability of the Jenkins Tuleap Git Branch Source Plugin is related to deficiencies in the authentication process when processing the /tuleap-hook/ endpoint. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected informati...
CVE-2022-4102
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know...
Authentication flaw
A vulnerability, which was classified as critical, was found in holdennb CollabCal. Affected is the function handleGet of the file calenderServer.cpp. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The patch is identified as...
Authentication flaw
The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required...
Authentication flaw
aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access API function to perform arbitrary system command or disrupt service...
Authentication flaw
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users...
CVE-2022-4861
Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource...
CVE-2022-4861
Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource...
M-Files Client 授权问题漏洞
M-Files is an innovative metadata-driven document management platform from M-Files, Inc. A security vulnerability exists in M-Files Client versions prior to 22.5.11356.0 that stems from an incorrect implementation of the authentication protocol and allows an elevated privilege user to obtain...
PT-2022-28147
Name of the Vulnerable Software and Affected Versions M-Files Client versions prior to 22.5.11356.0 M-Files Server versions prior to 22.5.11356.0 Description The issue is related to an incorrect implementation in the authentication protocol, allowing a high-privileged user to obtain other users'...