CVE-2020-15688

The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel...

Authentication flaw

The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel...

The vulnerability of the microprogrammed industrial Ethernet switch Moxa MGate 5105-MB-EIP, related to the bypassing of authentication through capture/replay, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the microprogrammed industrial Ethernet switch Moxa MGate 5105-MB-EIP lies in its ability to bypass authentication through capture/replay. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2022-6561 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: Gitea versions prior to 1.11.2 Description: The issue is related to trusting HTTP permission methods on the server side when referencing the vulnerable admin or user API, which could allow a remote malicious user to execute arbitrary code. It...

CVE-2020-6972

In Notifier Web Server NWS Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay attack from a web browser...

CVE-2020-6972

In Notifier Web Server NWS Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay attack from a web browser...

Authentication flaw

In Notifier Web Server NWS Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay attack from a web browser...

CVE-2020-6972

In Notifier Web Server NWS Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay attack from a web browser...

CVE-2020-6972

CVE-2020-6972 affects Honeywell/NWS Notifier Web Server (NWS-3) versions 3.50 and earlier. The vulnerability is an authentication bypass by a capture-replay attack from a web browser, with CVSS v3.1 base score 9.1 (Network, Privileges None, User Interaction None; Confidentiality/Integrity High, A...

Omron PLC CJ and CS Series

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : Omron Equipment : PLC CJ and CS Series Vulnerabilities : Authentication Bypass by Spoofing, Authentication Bypass by Capture-replay, Unrestricted Externally Accessible Lock 2. UPDATE This updated...

Schneider-electric Modicon Authentication Bypass by Capture-replay

An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product all references, all versions prior to firmware V1.6.2.0. The vulnerability allows unauthorized users to replay authentication sequences. If an attacker exploits this vulnerability and connects to a...

CVE-2019-11334

An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources that are not otherwise accessible without proper authentication via capture-replay. Physically proximate attackers can use this informatio...

Authentication flaw

An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources that are not otherwise accessible without proper authentication via capture-replay. Physically proximate attackers can use this informatio...

CVE-2019-11334

The CVE-2019-11334 issue is an authentication bypass in the Tzumi Electronics Klic Lock ecosystem. The vulnerability affects the Klic Lock mobile app (version 1.0.9) and the Klic Smart Padlock (Firmware 6.2). Attackers can exploit capture-replay of website POST requests to access resources that s...

CVE-2019-11334

An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources that are not otherwise accessible without proper authentication via capture-replay. Physically proximate attackers can use this informatio...

PT-2019-12246 · Tzumi Electronics · Klic Lock +1

Name of the Vulnerable Software and Affected Versions: Tzumi Electronics Klic Lock application version 1.0.9 Tzumi Electronics Klic Smart Padlock Model 5686 Firmware 6.2 Description: The issue allows attackers to bypass authentication in website post requests, enabling them to access resources th...

CVE-2019-3915

Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway G1100 firmware version 02.01.00.05 allows an unauthenticated attacker with adjacent network access to intercept and replay login requests to gain access to the administrative web interface...

CVE-2019-3915

Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway G1100 firmware version 02.01.00.05 allows an unauthenticated attacker with adjacent network access to intercept and replay login requests to gain access to the administrative web interface...

Authentication flaw

Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway G1100 firmware version 02.01.00.05 allows an unauthenticated attacker with adjacent network access to intercept and replay login requests to gain access to the administrative web interface...

CVE-2019-3915

CVE-2019-3915 applies to Verizon Fios Quantum Gateway (G1100) firmware 02.01.00.05. The vulnerability is an authentication bypass via capture‑replay: because the web admin interface relies on HTTP (not HTTPS), an adjacent‑network attacker can intercept login requests and replay them to gain admin...