CVE-2017-3775: Improper Authentication

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code...

CVE-2018-10641: Improper Authentication

D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext...

PT-2018-7267

Name of the Vulnerable Software and Affected Versions: Lenovo System x server BIOS/UEFI affected versions not specified Description: The issue concerns the improper authentication of signed code before booting when Secure Boot mode is enabled. This could allow an attacker with physical access to...

CVE-2018-10544: Improper Authentication

Meross MSS110 devices through 1.1.24 contain an unauthenticated admin.htm administrative interface...

CVE-2018-9232: Improper Authentication

Due to the lack of firmware authentication in the upgrade process of T&W WIFI Repeater BE126 devices, an attacker can craft a malicious firmware and use it as an update...

CVE-2018-10576: Improper Authentication

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentication handling by the native Access Point web UI allows authentication using a local system account instead of the dedicated web-only user...

PT-2018-9974

Name of the Vulnerable Software and Affected Versions: WatchGuard AP100 versions prior to 1.2.9.15 WatchGuard AP102 versions prior to 1.2.9.15 WatchGuard AP200 versions prior to 1.2.9.15 Description: An issue was discovered that allows improper authentication handling by the native Access Point w...

CVE-2018-1418: Improper Authentication

IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM X-Force ID: 138824...

CVE-2017-12712: Improper Authentication

The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be compromised or bypassed, which may allow a nearby attacker to issue unauthorized commands to the pacemaker via RF communications. CVSS v3...

CVE-2018-10362: Improper Authentication

An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1. Due to loose comparison with '==' instead of '===' in classes/Authorization.php for the user-provided login password, it is possible to login with a simpler password if the password has the form of a power in scientific notation like...

CVE-2018-1112: Improper Authentication

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression...

CVE-2018-0238

A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...

CVE-2018-0238: Improper Authentication

A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...

CVE-2016-10434: Improper Authentication

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 820 and SD 820A, the input to RPMB write response function is a buffer from HLOS that needs to be authenticated using HMAC and then processed. However, some of the processing...

CVE-2017-12196: Improper Authentication

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the...

AMD Driver Installer and Gaming Evolved Product plays.tv Service Code Execution Vulnerability

AMD driver-installation packages and Gaming Evolved products are both products of AMD, Inc. AMD driver-installation packages are a set of driver installation packages for AMD graphics cards. Gaming Evolved products are game optimization products. plays.tv is one of the game recording and sharing...

CVE-2017-2871: Improper Authentication

Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is in the same subnetwork of the camera or has remote administrator access can fully compromise the device by performing a firmware recovery...

AMD Driver Installer and Gaming Evolved Product plays.tv Service Write File Vulnerability

AMD driver-installation packages and Gaming Evolved products are both products of AMD, Inc. AMD driver-installation packages are a set of driver installation packages for AMD graphics cards. Gaming Evolved products are game optimization products. plays.tv is one of the game recording and sharing...

Exploit for Improper Authentication in Plays.Tv

CVE-2018-6546 POC Exploit ===== This is a proof of concept expl...

CVE-2018-6546: Improper Authentication

playsservice.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, executes code at a user-defined local or SMB path as SYSTEM when the executeinstaller parameter is used in an HTTP message. This occurs without properly...