Security Bypass Vulnerability in IBM Security Guardium Database Activity Monitor

IBM Security Guardium Database Activity Monitor is a database activity monitor product from IBM USA. The product provides features such as automated controls for compliance and protection against internal and external threats. A security bypass vulnerability exists in IBM Security Guardium Databa...

CVE-2003-0588

admin.php in Digi-news 1.1 allows remote attackers to bypass authentication via a cookie with the username set to the name of the administrator, which satisfies an improper condition in admin.php that does not require a correct password...

CVE-2003-0589

CVE-2003-0589 affects Digi-ads 1.1 where admin.php allows remote authentication bypass by sending a cookie with the username set to the administrator’s name. The root cause is an improper condition in admin.php that does not require a correct password, enabling an attacker to gain admin access vi...

CVE-2016-5686

Johnson & Johnson Animas OneTouch Ping devices mishandle acknowledgements, which makes it easier for remote attackers to bypass authentication via a custom communication protocol...

Micro Focus NetIQ Sentinel Server SentinelContext Authentication Bypass (CVE-2016-1605)

The vulnerability is due to a flaw in SentinelContext Java class that allows a user to retrieve a valid authentication cookie from the vulnerable server by providing "admin" user name in an HTTP request. A remote, unauthenticated attacker could exploit this vulnerability by sending crafted HTTP...

Juniper Junos SRX Series Upgrade Handling Local Root Authentication Bypass (JSA10753)

According to its self-reported version number, the remote Juniper Junos device is affected by a security bypass vulnerability due to a flaw that is triggered when using the partition option during an upgrade. A local attacker can exploit this to bypass authentication checks and access the root...

Authentication Bypass Vulnerability in Multiple Moxa Products

Moxa MGate MB3180 and others are gateway products from Moxa. A security vulnerability exists in a number of Moxa products that stems from the program's use of weak encryption algorithms. A remote attacker could exploit this vulnerability by performing a brute force exploit to bypass authenticatio...

CVE-2016-5807

Tollgrade LightHouse SMS before 5.1 patch 3 allows remote authenticated users to bypass an intended administrative-authentication requirement, and read or change parameter values, via a direct request...

Authentication flaw

Tollgrade LightHouse SMS before 5.1 patch 3 allows remote authenticated users to bypass an intended administrative-authentication requirement, and read or change parameter values, via a direct request...

The vulnerability of the automated system for managing technological processes of SIMATIC WinCC OA allows a malicious individual to bypass the file system without going through the authentication procedures as a regular user.

The vulnerability of the SIMATIC WinCC OA software is related to errors that occur when processing specially crafted TCP packets. Exploiting this vulnerability allows a malicious individual to bypass the file system on the server in the context of the current user, without going through the...

openstack-ironic: Ironic Node information including credentials exposed to unauthenticated users

An authentication vulnerability was found in openstack-ironic. A client with network access to the ironic-api service could bypass OpenStack Identity authentication, and retrieve all information about any node registered with OpenStack Bare Metal. If an unprivileged attacker knew or was able to...

CVE-2016-3648

Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism, and conduct brute-force password-guessing attacks against management-console accounts, by entering data into the authorization window...

CVE-2016-4432

The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging...

CVE-2016-4422

Summary: CVE-2016-4422 affects libpam-sshauth (pam_sshauth.c). A weakness in pam_sm_authenticate could allow a local attacker to bypass authentication or gain root privileges by abusing system users. Affected component: libpam-sshauth, specifically the pam_sshauth PAM module. Root cause / impact ...

Cybozu Office Security Mechanism Bypass Vulnerability (CNVD-2016-01260)

Cybozu Office is a WEB-based cross-platform office solution developed by Cybozu Japan. A security mechanism bypass vulnerability exists in Cybozu Office versions 9.9.0 through 10.3.0, which can be exploited by a remote, authenticated user to bypass established access restrictions and read or writ...

CVE-2016-0487

Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Test Manager for Web Apps, a different vulnerability than...

CVE-2015-7907: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the web server on Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allows remote attackers to bypass authentication, and write to a configuration file or trigger a calibration or test, via unspecified vectors...

Authentication flaw

The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message...

Kaseya Virtual System Administrator Elevation of Privilege Vulnerability

Kaseya Virtual System Administrator is a suite of IT system management platforms for simplifying and automating IT services. Kaseya Virtual System Administrator does not enforce user authentication and does not restrict target file paths, allowing remote attackers to exploit vulnerabilities to...

CVE-2014-3612

The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier...