CVE-2021-24017

An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler...

CVE-2021-20578: Improper Authentication

IBM Cloud Pak for Security CP4S 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing authentication controls. IBM X-Force ID: 199282...

PT-2021-15647

Name of the Vulnerable Software and Affected Versions: Fortinet FortiManager versions 6.4.3 and below Fortinet FortiManager versions 6.2.6 and below Description: The issue is related to improper authentication, allowing an attacker to assign arbitrary Policy and Object modules via crafted request...

CVE-2021-24017: Improper Authentication

An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler...

Security Advisory - Improper Authentication Vulnerability in Huawei Product

There is an improper authentication vulnerability in Hero-CT060. The vulnerability is due to that when an user wants to do certain operation, the software does not insufficiently validate the user's identity. Successful exploit could allow the attacker to do certain operations which the user are...

CVE-2021-31917: Improper Authentication

A flaw was found in Red Hat DataGrid 8.x 8.0.0, 8.0.1, 8.1.0 and 8.1.1 and Infinispan 10.0.0 through 12.0.0. An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and...

GitLab Dependency Proxy Incorrect Authentication Data Compromise

The vulnerability of the Dependency Proxy component in the Git-based software platform for collaborative code development on GitLab is related to improper authentication. Exploiting this vulnerability allows a malicious actor to compromise data integrity remotely...

Bitcoin Core PreChecks Authentication

The vulnerability of the PreChecks functionality in the standard Bitcoin Bitcoin Core implementation is related to the incorrect replacement of the child transaction. Exploiting this vulnerability can allow an attacker to compromise data integrity and also cause service failures...

CVE-2021-38412 Digi PortServer TS 16 Improper Authentication

Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to...

CVE-2021-41317: Improper Authentication

XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...

CVE-2021-41303: Improper Authentication

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0...

CVE-2021-38412: Improper Authentication

Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to...

CVE-2021-39215: Improper Authentication

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue...

CVE-2021-33045: Improper Authentication

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets...

Digi PortServer TS 16

1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Digi International, Inc. Equipment: PortServer TS 16 Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability allows write access, which grants control of...

CVE-2021-37414: Improper Authentication

Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication...

CVE-2021-28493: Improper Authentication

In Arista's MOS Metamako Operating System software which is supported on the 7130 product line, under certain conditions, a user may be able to execute commands despite not having the privileges to do so. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train...

CVE-2021-28495: Improper Authentication

In Arista's MOS Metamako Operating System software which is supported on the 7130 product line, under certain conditions, user authentication can be bypassed when API access is enabled via the JSON-RPC APIs. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train...

CVE-2021-39296: Improper Authentication

In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system...

CVE-2021-25466: Improper Authentication

Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and obtain Samsung Account token...