2861 matches found
PYSEC-2020-264
In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's...
CVE-2020-12812
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication FortiToken if they changed the case of their username...
Authentication flaw
The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the server and execute some commands for high-level users. This affects:...
Authentication flaw
No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a password to the robot but as in xarmstudio 1.3.0 the option is missing from the menu. Assuming manual control, even by forcefully removing the...
Authentication flaw
Advantech iView, versions 5.6 and prior, has an improper authentication for critical function CWE-306 issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text. An attacker may also...
Authentication flaw
SAP NetWeaver AS JAVA LM Configuration Wizard, versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create ...
Authentication flaw
The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG file. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1...
Authentication flaw
Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page...
PT-2020-17863 · Prestashop · Prestashop
Name of the Vulnerable Software and Affected Versions: PrestaShop versions 1.5.0.0 through 1.7.6.6 PrestaShop versions 1.5.0.0 through 1.7.7.6 is not used because 1.7.6.6 is the fixed version mentioned in the NVD source which has higher priority than Telegram. Description: The authentication syst...
Authentication flaw
Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to view and/or alter Single sign-on settings via unspecified vectors...
Authentication flaw
Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to alter the data for the file attached to Report via unspecified vectors...
The vulnerability of Cisco IOS XE SD-WAN software, related to authentication flaws, allows a hacker to gain full control over the device.
The vulnerability of Cisco IOS XE SD-WAN software is related to authentication deficiencies. Exploiting this vulnerability can allow an attacker to gain full control over the device...
Authentication flaw
BIOTRONIK CardioMessenger II, The affected products do not properly enforce mutual authentication with the BIOTRONIK Remote Communication infrastructure...
Authentication flaw
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /cnr requests...
Hardcoded credentials
Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcoded IP address. Credentials to such wireless interface default to well known and widely spread users omitted and passwords omitted. This...
Apache Spark Remote Code Execution Vulnerability
Apache Spark is a fast, general-purpose compute engine designed for large-scale data processing.Apache Spark is an open-source clustered computing environment similar to Hadoop that enables in-memory distribution of datasets, which optimizes iterative workloads in addition to being able to provid...
The vulnerability of the enterprise-level catalog service 389 Directory Server, related to incorrect authentication, allows attackers to gain access to confidential data.
The vulnerability of the enterprise-level catalog service 389 Directory Server lies in the improper handling of comparison operations involving internal timestamps during authentication processes. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to...
The vulnerability of the SCADA platform for remote oil and gas applications from Emerson’s OpenEnterprise platform stems from improper implementation of authentication mechanisms. This allows attackers to execute arbitrary code.
The vulnerability of the SCADA platform for remote Emerson OpenEnterprise oil and gas applications is related to the improper implementation of authentication mechanisms. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted malicious...
Authentication flaw
HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B smartphones with versions earlier than 10.1.0.135C00E135R2P11; versions earlier than 10.1.0.135C00E135R2P8, versions earlier than 10.1.0.135 have an improper authentication vulnerability. Due to the identity of the message sender not being properly verified, a...