CVE-2019-0246

SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity...

Authentication flaw

The web service on Epson WorkForce WF-2861 10.48 LQ22I3Recovery-mode, WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA devices allows remote attackers to upload a firmware file and reset the printer without authentication by making a request to the /DOWN/FIRMWAREUPDATE/ROM1 URI and a POST request t...

Design/Logic Flaw

A Credential Management vulnerability exists in FoxView HMI SCADA All Foxboro DCS, Foxboro Evo, and IA Series versions prior to Foxboro DCS Control Core Services 9.4 CCS 9.4 and FoxView 10.5. which could cause unauthorized disclosure, modification, or disruption in service when the password is...

Authentication flaw

D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1, DCS-5020L, and many mor...

The vulnerability in the web interface of the Cisco Identity Services Engine allows a perpetrator to perform arbitrary actions on a vulnerable device.

The vulnerability of the Cisco Identity Services Engine ISE web interface relates to insufficient authentication of executed requests. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device using a specially crafted link cross-site request...

Authentication flaw

A vulnerability has been identified in SINUMERIK 808D V4.7 All versions, SINUMERIK 808D V4.8 All versions, SINUMERIK 828D V4.7 All versions V4.7 SP6 HF1, SINUMERIK 840D sl V4.7 All versions V4.7 SP6 HF5, SINUMERIK 840D sl V4.8 All versions V4.8 SP3. By sending a specially crafted authentication...

Authentication flaw

DISPUTED zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can...

kubernetes: authentication/authorization bypass in the handling of non-101 responses

A privilege escalation vulnerability exists in OpenShift Container Platform which allows for compromise of pods running co-located on a compute node. This access could include access to all secrets, pods, environment variables, running pod/container processes, and persistent volumes, including in...

The vulnerability of the Winbox component in the RouterOS operating system of MikroTik allows a hacker to bypass the authentication process.

The vulnerability of the Winbox component in the RouterOS operating system of MikroTik is caused by errors in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to read arbitrary files and bypass the authentication process...

The vulnerability of the JunOS operating system, related to deficiencies in authentication procedures, allows attackers to gain full control over the device.

The vulnerability of the JunOS operating system is related to deficiencies in the authentication process during system startup. Exploiting this vulnerability can allow an attacker to gain full control over the device upon initial startup...

Authentication flaw

Some Huawei smartphones ALP-AL00B 8.0.0.118DC00, ALP-TL00B 8.0.0.118DC01, BLA-AL00B 8.0.0.118DC00, BLA-L09C 8.0.0.127C432, 8.0.0.128C432, 8.0.0.137C432, BLA-L29C 8.0.0.129C432, 8.0.0.137C432 have an authentication bypass vulnerability. When the attacker obtains the user's smartphone, the...

keycloak: auth permitted with expired certs in SAML client

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks...

Authentication flaw

Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessible without authentication...

Authentication flaw

The time-based one-time-password TOTP function in the application logic of the Green Electronics RainMachine Mini-8 2nd generation uses the administrator's password hash to generate a 6-digit temporary passcode that can be used for remote and local access, aka a "Use of Password Hash Instead of...

Authentication flaw

MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late...

Authentication flaw

It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users...

MGASA-2018-0418 Updated kernel-tmb packages fix security vulnerabilities

This kernel-tmb update is based on the upstream 4.14.78 and adds additional fixes for the L1TF security issues. It also fixes at least the following security issues: Linux kernel from versions 3.9 and up, is vulnerable to a denial of service attack with low rates of specially modified packets...

SUSE-SU-2018:3265-1 Security update for the Linux Kernel (Live Patch 38 for SLE 12)

This update for the Linux Kernel 3.12.61-52146 fixes several issues. The following security issues were fixed: - CVE-2018-14633: A security flaw was found in the chapservercomputemd5 function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator i...

Authentication flaw

SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B devices improperly identifies users only by the authentication level sent in the cookies, which allow remote attackers to bypass authentication and gain administrator access by setting the authLevel cookie to 255...

Authentication flaw

The SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B is affected by an improper authentication vulnerability that allows requests to be made to back-end CGI scripts without a valid session. This vulnerability could be used to read and modify the...