PT-2020-16808 · Google +6 · Go +6

Name of the Vulnerable Software and Affected Versions: crewjam/saml affected versions not specified Description: A signature verification issue exists, allowing an attacker to bypass SAML Authentication, posing a threat to confidentiality, integrity, and system availability. This issue can be...

Sql injection

SQL injection vulnerability in BloodX 1.0 allows attackers to bypass authentication...

CVE-2020-29282

SQL injection vulnerability in BloodX 1.0 allows attackers to bypass authentication...

CVE-2019-19873

CVE-2019-19873 affects B&R Industrial Automation APROL before R4.2 V7.08. The issue allows an attacker to bypass authentication to retrieve information from the AprolSqlServer DBMS. This is described as a separate vulnerability from CVE-2019-16356 and CVE-2019-9983. Connected sources confirm the ...

CVE-2020-28211

CVE-2020-28211 affects Schneider Electric EcoStruxure Control Expert (PLC Simulator) with an Incorrect Authorization weakness (CWE-863) that could allow authentication bypass by overwriting memory via a debugger. Affected software is EcoStruxure Control Expert (Unity Pro) across all versions; the...

CVE-2020-28211: Incorrect Authorization

A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause bypass of authentication when overwriting memory using a debugger...

CVE-2020-25952

SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System With admin panel 2.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication...

CVE-2020-25592

Removed by vendor...

CVE-2020-25592

CVE-2020-25592 affects SaltStack Salt via salt-netapi, where eauth credentials/tokens are not properly validated, allowing an unauthenticated user to bypass authentication and invoke Salt SSH. Evidence in connected advisories confirms the issue and that multiple distributions issued fixes (e.g., ...

Micro Focus Operations Bridge Manager WatchServerAPI Deserialization Of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Micro Focus Operations Bridge Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2020-3410

A vulnerability in the Common Access Card CAC authentication feature of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to bypass authentication and access the FMC system. The attacker must have a valid CAC to initiate the access attempt. The...

CVE-2020-1676: Improper Input Validation

When SAML authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly handle SAML responses, allowing a remote attacker to modify a valid SAML response without invalidating its cryptographic signature to bypass SAML authentication security controls. This issue affects all Juniper...

CVE-2020-4499

IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216...

CVE-2020-12676

FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack"...

WordPress + Microsoft Office 365 < 11.7 - JWT Signature Verification Bypass

The plugin does not correctly verify JWT signatures, allowing attackers to forge tokens and bypass authentication and authorisation checks...

FusionAuth-SAMLv2 0.2.3 Message Forging

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: SAML v2.0 bindings in Java using JAXB Vendor: FusionAuth CSNC ID: CSNC-2020-002 CVE ID: CVE-2020-12676 Subject: Signature Exclusion Attack Risk: High Effect: Remotely exploitable Author: Felix Sieges Date:...

CVE-2020-25762

CVE-2020-25762 affects SourceCodester Seat Reservation System 1.0. The vulnerability lies in admin_class.php which does not validate input for username/password, enabling an attacker to send crafted input to /admin/ajax.php?action=login to bypass authentication and potentially access sensitive in...

Authentication flaw

A vulnerability in the REST API endpoint of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected device. The vulnerability is due to missing authentication on some of the API calls. An attacker could exploit this vulnerabili...

Seat Reservation System 1.0 SQL Injection

Title: Seat Reservation System 1.0 - Unauthenticated SQL Injection Exploit Author: Rahul Ramkumar Date: 2020-09-16 Vendor Homepage: www.sourcecodester.com Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/seat-reservation-system-using-php0.zip Version: 1.0...

SUSE SLES15 Security Update : slurm (SUSE-SU-2020:2602-1)

This update for slurm fixes the following issues : Fix Authentication Bypass when Message Aggregation is enabled CVE-2020-12693 This fixes and issue where authentication could be bypassed via an alternate path or channel when message Aggregation was enabled. A race condition allowed a user to...