CVE-2019-3798: Improper Authentication

Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their...

CVE-2018-7340: Improper Authentication

Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authenticatio...

CVE-2017-11427: Improper Authentication

OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authenticatio...

CVE-2019-5426: Improper Authentication

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwarding" SOCKS proxy functionalities. Remote attackers without credentials can exploit this bug to access local services or forward traffic through the device if SS...

CVE-2019-0282: Improper Authentication

Several web pages in SAP NetWeaver Process Integration Runtime Workbench, fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authentication, which might expose internal data like release information, Java package and Java object names which can be misused by the...

CVE-2019-8990: Improper Authentication

The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be processed by the BusinessWorks engine even when authentication is required. This possibility is restricted to circumstances...

CVE-2019-11018: Improper Authentication

application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change...

CVE-2019-10884: Improper Authentication

Uniqkey Password Manager 1.14 contains a vulnerability because it fails to recognize the difference between domains and sub-domains. The vulnerability means that passwords saved for example.com will be recommended for usersite.example.com. This could lead to successful phishing campaigns and crea...

CVE-2019-10273: Improper Authentication

Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account...

Google Android Null Pointer Dereference Vulnerability (CNVD-2019-24155)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. A null pointer dereference vulnerability exists in the Qualcomm closed source component in Android. An attacker can exploit this vulnerability to lock a memory region with incorrect authenticatio...

PT-2019-4954

Name of the Vulnerable Software and Affected Versions FreeRADIUS versions prior to 3.0.19 Description The issue is related to improper authentication in the FreeRADIUS server, which can be exploited by a remote attacker to gain unauthorized access to protected information. This is similar to a...

CVE-2017-6047: Improper Authentication

Detcon Sitewatch Gateway, all versions without cellular, Passwords are presented in plaintext in a file that is accessible without authentication...

CVE-2019-5890: Improper Authentication

An issue was discovered in OverIT Geocall 6.3 before build 2:346977. Weak authentication and session management allows an authenticated user to obtain access to the Administrative control panel and execute administrative functions...

CVE-2018-11271

Improper authentication can happen on Remote command handling due to inappropriate handling of events in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607,...

CVE-2019-10661: Improper Authentication

On Grandstream GXV3611IRHD before 1.0.3.23 devices, the root account lacks a password...

CVE-2017-18106: Improper Authentication

The identifierhash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifierhash for another user or a user in a different directory, this allows remote attackers who can authenticate to Crowd or an application using Crowd for authentication to gain...

CVE-2019-1758: Improper Authentication

A vulnerability in 802.1x function of Cisco IOS Software on the Catalyst 6500 Series Switches could allow an unauthenticated, adjacent attacker to access the network prior to authentication. The vulnerability is due to how the 802.1x packets are handled in the process path. An attacker could...

Huawei AP4050DN-E Improper Authentication Vulnerability

The Huawei AP4050DN-E is a wireless access point device from Huawei China. A security vulnerability exists in the Huawei AP4050DN-E prior to version V200R009C00, which originates from a program that fails to properly authenticate the serial port. An attacker can exploit the vulnerability to conne...

PT-2019-4440

Name of the Vulnerable Software and Affected Versions Huawei AP2000 versions prior to V200R009C00SPC800 Huawei AP4000 versions prior to V200R009C00SPC800 Huawei AP4050DN-E versions prior to V200R009C00SPC800 Description The issue is related to improper authentication in the firmware of certain...

CVE-2019-6441: Improper Authentication

An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices. The password reset functionality of the router doesn't have backend validation for the current password and doesn't require any type of authentication. By...