PT-2023-32685 · Aditaas · Aditaas

Name of the Vulnerable Software and Affected Versions: ADiTaaS version 5.1 Description: A vulnerability exists in the ADiTaaS backend API due to improper authentication. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerabl...

Improper Authentication

bluez is vulnerable to Improper authentication. The vulnerability due to permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. It leads to allow an attacker get access to inject a malicious message...

CVE-2023-49646

Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access...

CVE-2023-44252

UNSUPPORTED WHEN ASSIGNED An improper authentication vulnerability CWE-287 in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5.1.2 may allow an authenticated attacker to escalate his privileges via HTTP or HTTPs requests with crafted JWT token values...

CVE-2023-44252

Fortinet FortiWAN is affected by an improper authentication vulnerability (CWE-287) in versions 5.1.1–5.1.2 and 5.2.0–5.2.1. The issue arises from using a static key when handling JWT tokens, enabling an authenticated attacker to escalate privileges by sending crafted HTTP/HTTPS requests. Impact ...

CVE-2023-45801

Improper Authentication vulnerability in Nadatel DVR allows Information Elicitation.This issue affects DVR: from 3.0.0 before 9.9.0...

Authentication flaw

Improper Authentication vulnerability in Nadatel DVR allows Information Elicitation.This issue affects DVR: from 3.0.0 before 9.9.0...

CVE-2023-45801

CVE-2023-45801 affects Nadatel DVR devices, specifically versions 3.0.0 through 9.9.0. The root cause is improper authentication, which enables information elicitation (confidentiality impact). The vulnerability is network‑accessible with low attack complexity and no user interaction required, an...

Nadatel DVR Authorization Issues Vulnerability

Nadatel DVR is a series of hard disk recorders from the US company Nadatel. A security vulnerability exists in Nadatel DVR versions 3.0.0 through 9.9.0, which stems from an attacker being able to gain access to information through improper authentication...

CVE-2023-44252: Improper Authentication

UNSUPPORTED WHEN ASSIGNED An improper authentication vulnerability CWE-287 in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5.1.2 may allow an authenticated attacker to escalate his privileges via HTTP or HTTPs requests with crafted JWT token values...

PT-2023-31277 · Zoom · Zoom

Name of the Vulnerable Software and Affected Versions: Zoom versions prior to 5.16.5 Description: The issue is related to improper authentication in some Zoom clients, which may allow an authenticated user to conduct a denial of service via network access. Recommendations: For versions prior to...

CVE-2023-45801: Improper Authentication

Improper Authentication vulnerability in Nadatel DVR allows Information Elicitation.This issue affects DVR: from 3.0.0 before 9.9.0...

Improper Authentication

github.com/treeverse/lakefs is vulnerable to Improper Authentication. The vulnerability is due to the NewSecureString function in securestring.go lacking the security measures handle environment variables. Specifically, it directly accesses environment variables using os.LookupEnv without any for...

PT-2023-29695 · Unknown · Nadatel Dvr

Name of the Vulnerable Software and Affected Versions: Nadatel DVR versions 3.0.0 through 9.9.0 Description: The issue is related to an Improper Authentication vulnerability, which allows Information Elicitation. This vulnerability affects Nadatel DVR devices, potentially allowing unauthorized...

CVE-2023-36004: Improper Authentication

Windows DPAPI Data Protection Application Programming Interface Spoofing Vulnerability...

CVE-2023-36648: Improper Authentication

Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read potentially sensitive information and deny service to users by directly reading and writing data in Apache Kafka as consumer and producer...

CVE-2023-50430: Improper Authentication

The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol SDCP when enrolling via Linux, and accepts an unauthenticated configuration packet to select the Windows template database, which allows bypass of Windows Hello...

CVE-2023-45866: Improper Authentication

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such...

CVE-2023-36655: Improper Authentication

The login REST API in ProLion CryptoSpike 3.0.15P2 when LDAP or Active Directory is used as the users store allows a remote blocked user to login and obtain an authentication token by specifying a username with different uppercase/lowercase character combination...

Authentication flaw

Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass...