8644 matches found
CVE-2022-39238 Improper Authentication in Arvados when using PAM as identity provider
Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules PAM for user authentication, if a user presented valid credentials but the account is disabled or otherwise not allowed to access the host such...
CVE-2022-39231 Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, validation of the authentication adapter app ID for Facebook and Spotify may be circumvented. Configurations which allow users to...
CVE-2022-39231 Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, validation of the authentication adapter app ID for Facebook and Spotify may be circumvented. Configurations which allow users to...
CVE-2022-35248: Improper Authentication
A improper authentication vulnerability exists in Rocket.Chat...
CVE-2022-30124: Improper Authentication
An improper authentication vulnerability exists in Rocket.Chat Mobile App 4.14.1.22788 that allowed an attacker with physical access to a mobile device to bypass local authentication PIN code...
CVE-2021-45035: Improper Authentication
Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials...
CVE-2022-39238: Improper Authentication
Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules PAM for user authentication, if a user presented valid credentials but the account is disabled or otherwise not allowed to access the host such...
CVE-2022-39231: Improper Authentication
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, validation of the authentication adapter app ID for Facebook and Spotify may be circumvented. Configurations which allow users to...
EulerOS Virtualization 2.9.1 : curl (EulerOS-SA-2022-2341)
According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated...
CVE-2022-40616: Improper Authentication
IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensitive information or perform tasks they should not have access to. IBM X-Force ID: 236311...
CVE-2021-33076
Improper authentication in firmware for some IntelR SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access...
CVE-2021-33076: Improper Authentication
Improper authentication in firmware for some IntelR SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access...
PT-2022-10201
Name of the Vulnerable Software and Affected Versions IntelR SSD DC Products affected versions not specified Description The issue concerns improper authentication in the firmware of some IntelR SSD DC Products. This may allow an unauthenticated user to potentially enable escalation of privilege...
Improper Authentication
snipe/snipe-it is vulnerable to improper authentication. A remote authenticated attacker is able to access unauthorized files through the viewKeys function as long as they have the View permission, which exposes confidential information required to create the API keys without the corresponding...
GHSA-FHVV-P968-6VVJ Snipe-IT vulnerable to Improper Authentication
Snipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the View and Modify License Files permission may access files uploaded to licenses as long as they have the View permission for licenses...
Snipe-IT vulnerable to Improper Authentication
Snipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the View and Modify License Files permission may access files uploaded to licenses as long as they have the View permission for licenses...
Security Bulletin: Vulnerabilities in libcurl may affect IBM Spectrum Protect Plus (CVE-2021-22946, CVE-2022-27782, CVE-2022-27774, CVE-2022-22576, CVE-2021-22947, CVE-2022-27776)
Summary Vulnerabilities in libcurl such as bypassing security restrictions, obtaining sensitive information, and man-in-the-middle attacks may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID:CVE-2021-22946 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive...
CVE-2022-3173
Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-3173
CVE-2022-3173 affects Snipe-IT prior to 6.0.10. The issue is improper authentication/authorization, allowing a user with only limited license-view permissions to access files uploaded to licenses and, per sources, to create API keys despite lacking permission. Documents indicate a remote authenti...
