Authentication flaw

An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it...

Design/Logic Flaw

A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier All versions, SIMATIC Process Historian 2014 All versions SP3 Update 6, SIMATIC Process Historian 2019 All versions, SIMATIC Process Historian 2020 All versions. An interface in the software that is used for critica...

Siemens Simatic Process Historian 访问控制错误漏洞

Siemens Simatic Process Historian is a centralized archiving system from Siemens, Germany. An authentication vulnerability exists in Siemens SIMATIC Process Historian, which arises from a lack of authentication of interfaces used for critical functions in the software, and can be exploited by an...

Authentication flaw

There is an improper authentication vulnerability in Hero-CT060 before 1.0.0.200. The vulnerability is due to that when an user wants to do certain operation, the software does not insufficiently validate the user's identity. Successful exploit could allow the attacker to do certain operations...

PT-2021-21345 · Digi · Digi Realport

Name of the Vulnerable Software and Affected Versions: Digi RealPort versions 4.8.488.0 through 4.10.490 Description: The authentication mechanism in Digi RealPort relies on a challenge-response system that provides access to the server password, rendering the protection ineffective. An attacker...

CVE-2021-41129

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a confirmationtoken input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can...

Authentication flaw

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a confirmationtoken input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can...

The vulnerability of the OpenDMARC authentication implementation, related to pointer assignment errors, allows a perpetrator to trigger a service denial.

The vulnerability of the OpenDMARC authentication implementation is related to pointer assignment errors. Exploiting this vulnerability could allow a malicious actor to trigger a service failure remotely...

The vulnerability of the authentication method for the SOGo collaborative work system, which stems from incorrect verification of the cryptographic signature of data, allows attackers to compromise the integrity of the data.

The vulnerability of the SOGo collaborative computing software’s authentication method is related to improper verification of the data’s cryptographic signature. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the data...

Authentication flaw

Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See...

Authentication flaw

Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol RESP request, Redis allocates memory according to user-specified values which determine the number of elements in the multi-bulk header and size of each element in the bulk header. ...

PT-2021-23112 · Unknown · Pterodactyl

Name of the Vulnerable Software and Affected Versions: Pterodactyl affected versions not specified Description: A malicious user can modify the contents of a confirmation token input during the two-factor authentication process to reference a cache value not associated with the login attempt. Thi...

GitLab CE/EE 安全特征问题漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security signature issue vulnerability exists in GitLab...

CVE-2021-24017

An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler...

The vulnerability of the Apache Shiro framework, related to deficiencies in authentication mechanisms, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Apache Shiro framework is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected information through a specially crafted HTTP request...

Authentication flaw

A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Network Appliance Filers 5.8, and ServerProtect for Microsoft Windows / Novell Netware 5.8 could allow a remote attacker to bypass authentication on affected installations...

Authentication flaw

A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in D-Link DIR-X1560, v1.04B04, and DIR-X6060, v1.11B04 allows a remote unauthenticated attacker to disconnect a wireless client via sending specific spoofed SAE authentication frames...

Authentication flaw

A vulnerability in the authentication, authorization, and accounting AAA function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass NETCONF or RESTCONF authentication and do either of the following: Install, manipulate, or delete the configuration of an affected...

The vulnerability of the FortiOS operating system, related to deficiencies in authentication procedures, allows attackers to gain access to the system without requiring a second authentication factor.

The vulnerability of the FortiOS operating system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain access to the system remotely, without requiring a second authentication factor FortiToken...

The vulnerability in the web interface of the Cisco BroadWorks CommPilot Application Software allows a hacker to delete arbitrary user accounts.

The vulnerability of the Cisco BroadWorks CommPilot Application Software’s web interface is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to delete arbitrary user accounts remotely...