Input validation

Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.024.02 allows an attacker to cause network attack in case of using defalut admin ID/PW...

CVE-2024-22772

CVE-2024-22772 affects Hitron Systems DVR LGUVR-8H (and related models LGUVR-4H/16H, HVR-4781/8781/16781) with improper input validation when using the default admin credentials. The vulnerability enables a network-based denial-of-service/attack vector, with CVSS v3.1 base scores around 7.4–7.5 d...

CVE-2024-22772 Hitron Systems DVR LGUVR-8H Improper Input Validation Vulnerability

Improper Input Validation in Hitron Systems DVR LGUVR-8H 1.024.02 allows an attacker to cause network attack in case of using defalut admin ID/PW...

CVE-2024-22771 Hitron Systems DVR LGUVR-4H Improper Input Validation Vulnerability

Improper Input Validation in Hitron Systems DVR LGUVR-4H 1.024.02 allows an attacker to cause network attack in case of using defalut admin ID/PW...

CVE-2024-22771

CVE-2024-22771 affects Hitron Systems DVR LGUVR-4H (versions 1.02–4.02). The vulnerability is caused by improper input validation, enabling a network-adjacent attacker to cause a denial-of-service condition when default admin credentials are used. Public documents confirm affected models and vers...

CVE-2024-22770

CVE-2024-22770 affects Hitron Systems DVR HVR-16781 versions 1.03–4.02. The flaw is improper input validation (CWE-20) in the DVRs that can enable a network-based attack when the device is accessed with default admin credentials. Public documentation (including Red Hat and other advisories) confi...

CVE-2024-22770 Hitron Systems DVR HVR-16781 Improper Input Validation Vulnerability

Improper Input Validation in Hitron Systems DVR HVR-16781 1.034.02 allows an attacker to cause network attack in case of using defalut admin ID/PW...

CVE-2024-22769

The CVE-2024-22769 entry concerns Hitron Systems DVR HVR-8781. Affected products include DVR HVR-8781 (and related models) with firmware versions 1.03–4.02, where improper input validation can enable a network-based attack when the device is accessed with default admin credentials. The official R...

CVE-2024-22769 Hitron Systems DVR HVR-8781 Improper Input Validation Vulnerability

Improper Input Validation in Hitron Systems DVR HVR-8781 1.034.02 allows an attacker to cause network attack in case of using defalut admin ID/PW...

CVE-2024-22768 Hitron Systems DVR HVR-4781 Improper Input Validation Vulnerability

Improper Input Validation in Hitron Systems DVR HVR-4781 1.034.02 allows an attacker to cause network attack in case of using defalut admin ID/PW...

PT-2024-20117

Name of the Vulnerable Software and Affected Versions Hitron Systems DVR LGUVR-16H versions 1.02 through 4.02 Description The issue is related to improper input validation, which allows an attacker to cause a network attack if the default admin ID and password are used. Recommendations For versio...

CVE-2023-44324

Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An unauthenticated attacker can abuse this vulnerability to access the API and leak default admin's password. Exploitation of this...

CVE-2023-44324

Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An unauthenticated attacker can abuse this vulnerability to access the API and leak default admin's password. Exploitation of this...

PT-2023-7163 · Adobe · Framemaker Publishing Server

Name of the Vulnerable Software and Affected Versions: Adobe FrameMaker Publishing Server versions 2022 and earlier Description: The issue is related to an improper authentication vulnerability that could result in a security feature bypass. An unauthenticated attacker can exploit this to access...

Account Takeover

authentik is vulnerable to potential account takeover. authentik uses a blueprint to create default admin user, which also optionally sets an admin password from environment variable. When the default admin is deleted, it is possible for an attacker to set the password for admin user without...

Design/Logic Flaw

authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the...

CVE-2023-46249 authentik potential installation takeover when default admin user is deleted

authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the...

CVE-2023-46249 authentik potential installation takeover when default admin user is deleted

authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the...

PT-2023-29928

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2023.8.4 and 2023.10.2 Description authentik is an open-source Identity Provider. When the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin use...

Incorrect Authorization in User role

Description Incorrect Authorization in User role Proof of Concept 1 .Default, administrator User ID =1 cannot add user roles 2 .Remove the "disable" class at Inspect 3 .After that, add the user role success Video Poc https://drive.google.com/file/d/1vQPHZwaghByHsqEgQI9p3EiGeVCTbLK7/view?usp=shari...