Emerson Smart Wireless Gateway 访问控制错误漏洞

The Emerson Smart Wireless Gateway is an infinite gateway from Emerson. It is used to interconnect networks above the network layer. An access control error vulnerability exists in the Emerson Smart Wireless Gateway that stems from a lack of authentication...

Authentication flaw

A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients like client secret without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this...

Authentication flaw

Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the server...

Authentication flaw

An issue was discovered in IdentityModel aka ScottBrady.IdentityModel before 1.3.0. The Branca implementation allows an attacker to modify and forge authentication tokens...

Authentication flaw

An issue was discovered in genua genugate before 9.0 Z p19, 9.1.x through 9.6.x before 9.6 p7, and 10.x before 10.1 p4. The Web Interfaces Admin, Userweb, Sidechannel can use different methods to perform the authentication of a user. A specific authentication method during login does not check th...

CVE-2021-27215

Genua GenuGate High Resistance Firewall is affected by CVE-2021-27215. The vulnerability is an authentication bypass in the admin web interfaces (Admin, Userweb, Sidechannel) where a login data manipulation causes the system to return OK for any authentication attempt, enabling an attacker to log...

The vulnerability of the order formatting module of the Magento Commerce software platform, which is used for developing and managing online stores, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the order processing module of the Magento Commerce software platform for developing and managing online stores is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized...

CVE-2021-27876

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to ga...

Authentication flaw

An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can retrieve the administrative configuration by sending a POST request to the /sdm-ws-rest/preconfiguration URI...

Exploit for Improper Authentication in Saltstack Salt

CVE-2021-25281...

CVE-2021-3252

KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure...

The vulnerability of the Apache Shiro framework, related to authentication flaws, allows attackers to escalate their privileges.

The vulnerability of the Apache Shiro framework is related to authentication deficiencies. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain increased privileges...

Authentication flaw

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7450 1.2.0.621.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the minihttpd service, which listens on TCP port 80 by...

Authentication flaw

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2...

CVE-2020-15836

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untrusted data to the operating system without proper sanitization. A crafted request can be sent to execute arbitrary commands as root...

CVE-2020-15835

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function contains undocumented code that provides the ability to authenticate as root without knowing the actual root password. An adversary with the private key can remotely authenticate to the...

CVE-2020-15835

CVE-2020-15835 affects Mofi Network MOFI4500-4GXeLTE devices running 4.1.5-std. The issue is an authentication function containing undocumented code that enables authenticating as root without knowing the root password. An adversary with the private key can remotely authenticate to the management...

Authentication flaw

Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several parameters of the affected device as an authenticated user...

Authentication flaw

HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS authentication method...

CVE-2021-25312

HTCondor before 8.9.11 is affected by CVE-2021-25312 due to a flaw in the IDTOKENS authentication method, enabling a user to submit a job as another user on the system. The available sources consistently describe the vulnerability as an authentication error in HTCondor’s IDTOKENS flow, with impac...