CVE-2016-4422

Summary: CVE-2016-4422 affects libpam-sshauth (pam_sshauth.c). A weakness in pam_sm_authenticate could allow a local attacker to bypass authentication or gain root privileges by abusing system users. Affected component: libpam-sshauth, specifically the pam_sshauth PAM module. Root cause / impact ...

Cybozu Office Security Mechanism Bypass Vulnerability (CNVD-2016-01260)

Cybozu Office is a WEB-based cross-platform office solution developed by Cybozu Japan. A security mechanism bypass vulnerability exists in Cybozu Office versions 9.9.0 through 10.3.0, which can be exploited by a remote, authenticated user to bypass established access restrictions and read or writ...

CVE-2016-0487

Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Test Manager for Web Apps, a different vulnerability than...

Authentication flaw

The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message...

Kaseya Virtual System Administrator Elevation of Privilege Vulnerability

Kaseya Virtual System Administrator is a suite of IT system management platforms for simplifying and automating IT services. Kaseya Virtual System Administrator does not enforce user authentication and does not restrict target file paths, allowing remote attackers to exploit vulnerabilities to...

CVE-2014-3612

The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier...

CVE-2014-3612

The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier...

Ubuntu 14.04 LTS : OpenSSH vulnerabilities (USN-2710-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2710-1 advisory. Moritz Jodeit discovered that OpenSSH incorrectly handled usernames when using PAM authentication. If an additional vulnerability were discovered in the...

Ubuntu: Security Advisory (USN-2710-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Moodle learning management system allows a perpetrator to bypass the authentication process for arbitrary users.

The vulnerability of the auth/shibboleth/logout.php component of the Moodle learning management system is related to the。 Exploiting this vulnerability could allow a malicious actor, operating remotely, to bypass authentication procedures for arbitrary users using specially crafted requests...

CVE-2015-1130

The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors...

CVE-2015-1130

The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

CVE-2015-2109

Unspecified vulnerability in HP Operations Orchestration 10.x allows remote attackers to bypass authentication, and obtain sensitive information or modify data, via unknown vectors...

CVE-2015-2109

CVE-2015-2109 affects HP Operations Orchestration 10.x where an authentication bypass vulnerability exists due to an unspecified flaw. Public documents show affected versions are HP O.O. 10.x prior to 10.21 (per Tenable NASL reference) and HP security bulletin HPSBMU03292 rev.1 (SSRT101981) confi...

KLA10520 Multiple vulnerabilities in HP Operations Orchestration

An unspecified vulnerabilities were found in HP Operations Orchestration. By exploiting these vulnerabilities malicious users can bypass authentication,obtain sensitive information or modify data. These vulnerabilities can be exploited remotely via an unknown vector. Original advisories HP securi...

CVE-2015-0198

CVE-2015-0198 affects IBM GPFS (V3.4/V3.5/V4.1) where cipherList configurations could allow remote authentication bypass and root-level code execution. IBM advisories and GPFS security bulletins detail affected versions and provide fixes: upgrade GPFS to 4.1.0.7, 3.5.0.24, or 3.4.0.32 as appropri...

IBM General Parallel File System Bypass Authentication to Execute Code Vulnerability

The IBM General Parallel File System is a shared file system that originated from the virtual shared disk technology used on IBM SP systems. A security vulnerability exists in IBM General Parallel File System that allows remote attackers to exploit the vulnerability to bypass authentication and...

Cisco ASA Clientless SSL VPN Portal Customization Integrity Vulnerability (cisco-sa-20141008-asa)

A vulnerability in the Clientless SSL VPN portal customization framework could allow an unauthenticated, remote attacker to modify the content of the Clientless SSL VPN portal, which could lead to several attacks including the stealing of credentials, cross-site scripting XSS, and other types of...

CVE-2014-9583

common.c in infosvr in ASUS WRT firmware 3.0.0.4.3761071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the MAC address for a request, which allows remote attackers to bypass authentication and execute arbitrary commands via ...

Authentication flaw

VDG Security SENSE formerly DIVA before 2.3.15 allows remote attackers to bypass authentication, and consequently read and modify arbitrary plugin settings, via an encoded : colon character in the Authorization HTTP header...