Authentication flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be executed by any user with Script right...

Authentication flaw

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...

Vulnerability of Telnet and SSH services on the Android emulator AndyOS, allowing attackers to elevate their privileges to root level.

The vulnerability of Telnet and SSH services in the Android emulator AndyOS is related to authentication flaws. Exploiting this vulnerability can allow a hacker to gain root-level privileges...

PT-2021-7759 · Red Hat +5 · 389-Ds-Base +6

Name of the Vulnerable Software and Affected Versions: 389-ds-base affected versions not specified Description: A flaw was found in the authentication procedure of 389 Directory Server, allowing an attacker to successfully authenticate as a user whose password was disabled. This occurs when an...

The vulnerability of the elFinder file manager stems from the incorrect implementation of authentication mechanisms, allowing attackers to execute arbitrary code.

The vulnerability of the elFinder file manager is related to the incorrect implementation of authentication mechanisms. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

CVE-2021-31337

The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow a remote attacker to gain access to the device if the service is enabled. Telnet is disabled by default on the SINAMICS Medium Voltage Products SINAMICS SL15...

Ubuntu: Security Advisory (USN-4998-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4998-1 ceph vulnerabilities

It was discovered that in some situations Ceph logged passwords from the mgr module in clear text. An attacker could use this to expose sensitive information. CVE-2020-25678 Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user credentials in Ceph could be manipulated in certain...

Ubuntu 20.04 LTS : Ceph vulnerabilities (USN-4998-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4998-1 advisory. It was discovered that in some situations Ceph logged passwords from the mgr module in clear text. An attacker could use this to expose sensitive...

The vulnerability of the software for implementing the hypertext environment MediaWiki, related to deficiencies in the authentication process, allows a violator to disclose protected information.

The vulnerability of the software for implementing the hypertext environment MediaWiki is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a perpetrator to disclose protected information...

Authentication flaw

In archiveStoredConversation of MmsService.java, there is a possible way to archive message conversation without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

Authentication flaw

Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via unspecified vectors...

The vulnerability in the implementation of the network authentication protocol NT LAN Manager (NTLM) on Windows operating systems allows a perpetrator to increase their privileges.

The vulnerability of the Windows operating system’s Network Authentication Protocol NTLM implementation is related to privilege management errors. Exploiting this vulnerability can allow a malicious actor to elevate their privileges remotely...

PT-2021-3443 · Elfinder · Elfinder

Name of the Vulnerable Software and Affected Versions: elFinder versions 2.1.58 Description: The issue is related to the incorrect implementation of the authentication mechanism in the elFinder file manager. This can allow a remote attacker to execute arbitrary code. Several vulnerabilities affec...

Authentication flaw

The affected product’s configuration is vulnerable due to missing authentication, which may allow an attacker to change configurations and execute arbitrary code on the iView versions prior to v5.7.03.6182...

Authentication flaw

Improper authentication vulnerability in Tizen bluetooth-frwk prior to Firmware update JUN-2021 Release allows bluetooth attacker to take over the user's bluetooth device without user awareness...

Authentication flaw

There is an Assertion 'contextp-stackdepth == contextp-contextstackdepth' failed at js-parser-statm.c:2756 in parserparsestatements in JerryScript 2.2.0...

Authentication flaw

Apache HTTP Server versions 2.4.6 to 2.4.46 modproxywstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authenticati...

Authentication flaw

A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and...

Authentication flaw

SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. Only versions after 2.0.5a are affected...