DEBIAN-CVE-2017-11104

Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check...

Authentication flaw

An Improper Authentication issue was discovered in Newport XPS-Cx and XPS-Qx. An attacker may bypass authentication by accessing a specific uniform resource locator URL...

CVE-2016-7830

Sony PCS-XG100, PCS-XG100S, PCS-XG100C, PCS-XG77, PCS-XG77S, PCS-XG77C devices with firmware versions prior to Ver.1.51 and PCS-XC1 devices with firmware version prior to Ver.1.22 allow an attacker on the same network segment to bypass authentication to perform administrative operations via...

CVE-2016-6594

Blue Coat Advanced Secure Gateway 6.6, CacheFlow 3.4, ProxySG 6.5 and 6.6 allows remote attackers to bypass blocked requests, user authentication, and payload scanning...

USN-3316-1: FreeRADIUS vulnerability

Stefan Winter and Luboš Pavlíček discovered that FreeRADIUS incorrectly handled the TLS session cache. A remote attacker could possibly use this issue to bypass authentication by resuming an unauthenticated session...

CVE-2017-9148

The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers such as malicious 802.1X supplicants to bypass authentication via PE...

CVE-2017-7915

An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Build 09123015 and previous versions, OnCell G3150-HSDPA Version 1.4 Build 11051315 and previous versions,...

PlaySms Remote Code Execution Vulnerability (CNVD-2017-10383)

PlaySMS is an open source WEB SMS platform. A remote code execution vulnerability exists in PlaySms. The vulnerability stems from poor filtering on the "sendfromfile.php" page, resulting in the construction of malformed filenames to bypass authentication, which can be exploited by an attacker to...

Unauthorized Access Vulnerability in dLAN 200 AVeasy

The dLAN 200 AVeasy is a German networking device that works by converting the home power grid into a convenient data network. An unauthorized access vulnerability exists in the dLAN 200 AVeasy that could allow an attacker to bypass privilege authentication and access sensitive directories or fil...

CVE-2017-7927

CVE-2017-7927 describes an authentication bypass in various Dahua devices (DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-...

UBUNTU-CVE-2016-5410

firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the 1 addPassthrough, 2 removePassthrough, 3 addEntry, 4 removeEntry, or 5 setEntries D-Bus API method...

CVE-2016-5410

firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the 1 addPassthrough, 2 removePassthrough, 3 addEntry, 4 removeEntry, or 5 setEntries D-Bus API method...

CVE-2016-5410

firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the 1 addPassthrough, 2 removePassthrough, 3 addEntry, 4 removeEntry, or 5 setEntries D-Bus API method...

CVE-2016-7552

On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a sessionid cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS...

CVE-2016-9165

The getsessions servlet in CA Unified Infrastructure Management formerly CA Nimsoft Monitor before 8.5 and CA Unified Infrastructure Management Snap formerly CA Nimsoft Monitor Snap allows remote attackers to obtain active session ids and consequently bypass authentication or gain privileges via...

Authentication flaw

The getsessions servlet in CA Unified Infrastructure Management formerly CA Nimsoft Monitor before 8.5 and CA Unified Infrastructure Management Snap formerly CA Nimsoft Monitor Snap allows remote attackers to obtain active session ids and consequently bypass authentication or gain privileges via...

TYPO3 Remote Privilege Bypass Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. A privilege bypass vulnerability exists in TYPO3 Table Configuration Queue TCA, which can be exploited by remote attackers to bypass authentication and perform unauthorized...

CVE-2017-6062

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" aka modauthopenidc module before 2.1.5 for the Apache HTTP Server does not skip OIDCCLAIM and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HT...

CVE-2017-6062

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" aka modauthopenidc module before 2.1.5 for the Apache HTTP Server does not skip OIDCCLAIM and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HT...

CVE-2017-6413

The vulnerability CVE-2017-6413 affects the OpenID Connect Relying Party and OAuth 2.0 Resource Server component (mod_auth_openidc) for Apache HTTP Server, where versions prior to 2.1.6 do not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an AuthType oauth20 configuration. This allows remote at...