CVE-2024-20894

Improper handling of exceptional conditions in Secure Folder prior to SMR Jul-2024 Release 1 allows physical attackers to bypass authentication under certain condition. User interaction is required for triggering this vulnerability...

CVE-2024-20894

CVE-2024-20894 affects Samsung Secure Folder on devices with firmware before SMR Jul-2024 Release 1. It stems from improper handling of exceptional conditions, enabling a physical attacker to bypass authentication under certain conditions, with user interaction required to trigger. Affected due t...

CVE-2024-31898

IBM InfoSphere Information Server 11.7 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references. IBM X-Force ID: 288182...

Ivanti Sentry Authentication Bypass

Ivanti Sentry, formerly known as MobileIron Sentry, is vulnerable to an API authentication bypass on the Sentry administrator interface. A remote and unauthenticated attacker can leverage this vulnerability to gain access to sensitive APIs and achieve OS command execution as the root user on the...

The vulnerability of cloud software in creating and using Nextcloud Server and Nextcloud Enterprise Server lies in the authentication procedures’ flaws, which allow attackers to bypass the authentication process.

The vulnerability of cloud-based software for creating and using Nextcloud Server and Nextcloud Enterprise Server is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to bypass the 2FA authentication process...

Ubuntu 14.04 LTS / 16.04 LTS : OpenVPN vulnerability (USN-6850-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6850-1 advisory. It was discovered that OpenVPN incorrectly handled certain configurations with multiple authentication plugins. A remote attacker could possibly use...

CVE-2024-27157 Leak of authentication sessions in secure logs

The sessions are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL...

CVE-2024-27156 Leak of authentication sessions in secure logs

The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL...

CVE-2024-38279

The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain password hashes...

CVE-2024-36787

An issue in Netgear WNR614 JNR1010V2 N300-V1.1.0.541.0.1 allows attackers to bypass authentication and access the administrative interface via unspecified vectors...

CVE-2023-50804

An issue was discovered in Samsung Mobile Processor, and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos Modem 5123, Exynos Modem 5300. The baseband software does not properly check format typ...

Amazon Linux 2 : php (ALASPHP8.2-2024-004)

The version of php installed on the remote host is prior to 8.2.19-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2024-004 advisory. The vulnerability allows a remote attacker to bypass implemented security restrictions. The vulnerability exists due to...

Progress Software Telerik Report Server 安全漏洞

Progress Software Telerik Report Server is an enterprise-class report management and distribution solution from Progress Software. A security vulnerability exists in Progress Software Telerik Report Server version 10.0.24.305 and prior versions, which originates from a vulnerability that can be...

Prodys Quantum Audio 访问控制错误漏洞

Prodys Quantum Audio is a family of audio encoder and decoder devices from Prodys. An access control error vulnerability exists in Prodys Quantum Audio that stems from the presence of an improper access control vulnerability. An unauthenticated attacker could use this vulnerability to completely...

CVE-2024-33625

CyberPower PowerPanel business application code contains a hard-coded JWT signing key. This could result in an attacker forging JWT tokens to bypass authentication...

NetIQ iManager 授权问题漏洞

NetIQ iManager is an advanced web-based management console from NetIQ UK. Customized secure access to network management utilities and content can be provided from any location in the world. A security vulnerability exists in NetIQ iManager version 3.2.6.0200 that stems from the presence of a...

CVE-2023-39457

Triangle MicroWorks SCADA Data Gateway Missing Authentication Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2023-44427

Summary of CVE-2023-44427 : Affects D-Link DIR-X3260 routers. The flaw resides in the prog.cgi handling of HNAP requests to the lighttpd webserver on ports 80/443, where a user-supplied string is not properly validated before being passed to a system call. This enables a network-adjacent attacker...

CVE-2023-42034

Visualware MyConnection Server is affected by CVE-2023-42034 in the doRTAAccessCTConfig path, enabling Cross-Site Scripting that bypasses authentication. The flaw arises from insufficient validation of user-supplied data, permitting injection of arbitrary script and resulting in a remote authenti...

CVE-2023-39457 Triangle MicroWorks SCADA Data Gateway Missing Authentication Vulnerability

Triangle MicroWorks SCADA Data Gateway Missing Authentication Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw...