Authentication flaw

Huawei Mate 10 pro smartphones with the versions before BLA-AL00B 8.1.0.326C00 have an improper authentication vulnerability. App Lock is a function to prevent unauthorized use of apps on smartphones, an attacker could directly change the lock password after a series of operations. Successful...

PT-2018-2129 · Cisco · Cisco Wireless Lan Controller +1

Name of the Vulnerable Software and Affected Versions: Cisco Wireless LAN Controller WLC Software affected versions not specified Description: A vulnerability in TACACS authentication could allow an authenticated, local attacker to perform certain operations within the GUI that are not normally...

DEBIAN-CVE-2018-16738

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1...

ALPINE-CVE-2018-16738

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1...

UBUNTU-CVE-2018-16737

tinc before 1.0.30 has a broken authentication protocol, without even a partial mitigation...

UBUNTU-CVE-2018-16738

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1...

Authentication flaw

If RSH service is enabled on Junos OS and if the PAM authentication is disabled, a remote unauthenticated attacker can obtain root access to the device. RSH service is disabled by default on Junos. There is no documented CLI command to enable this service. However, an undocumented CLI command...

Authentication flaw

DISPUTED An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The FingerprintManager class for Biometric validation allows authentication bypass through the callback method from onAuthenticationFailed to onAuthenticationSucceeded with null, because the fingerprint...

Unspecified Vulnerability in IBM WebSphere Portal (CNVD-2018-24843)

IBM WebSphere Portal is a suite of enterprise portal software from IBM. The software creates a platform that connects an organization internally and externally, allowing employees, customers and suppliers to access internal data through the platform. A security vulnerability exists in IBM WebSphe...

PT-2018-13714 · Tinc +1 · Tinc +1

Name of the Vulnerable Software and Affected Versions: tinc versions 1.0.30 through 1.0.34 Description: The issue concerns a broken authentication protocol. Although there is a partial mitigation available, the problem is fully resolved in version 1.1. Recommendations: For versions 1.0.30 through...

Authentication flaw

A improper authentication using the HOST header in SUSE Linux SMT allows remote attackers to spoof a sibling server. Affected releases are SUSE Linux SMT: versions prior to 3.0.37...

Authentication flaw

On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change...

Authentication flaw

On D-Link DIR-823G devices, ExportSettings.sh, uploadsettings.cgi, GetDownLoadSyslog.sh, and uploadfirmware.cgi do not require authentication, which allows remote attackers to execute arbitrary code...

Authentication flaw

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token JWT. In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timi...

Elastic Cloud Enterprise (ECE) Incorrect Authentication Vulnerability

Elastic Cloud Enterprise ECE is a suite of software packages for managing, monitoring, and configuring Elasticsearch, Kibana, and X-Pack from Elasticsearch Netherlands. Elastic Cloud Enterprise ECE suffers from an incorrect authentication vulnerability that can be exploited by an attacker to add ...

Authentication flaw

The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android, which results in an attacker being able to reuse cookies to bypass authentication and...

Authentication flaw

In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web...

Authentication flaw

LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsrserver/device/reboot on port 9080...

CVE-2018-17011

The CVE-2018-17011 entry concerns TP-Link TL-WR886N devices (versions 6.0 2.3.4 and 7.0 1.1.0). The vulnerability allows authenticated attackers to crash router services (inetd, HTTP, DNS, UPnP) by sending long JSON data for the hosts_info parameter sun. The underlying issue is triggered by exces...

Authentication flaw

An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller butc process accepts incoming RPCs but does not require or allow for authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, includin...