123 matches found
CVE-2024-45494
An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 Fixed in 7.0.0. The FieldServer Gateway has an internally used shared administrative user account on all devices. The authentication for this user is implemented through an unsafe shared secret that is static in all affected...
CVE-2024-39707
Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could lead to a possible roll-back attack in certain platforms. This is fixed in: kernel 5.2, version 05.29.19; kernel 5.3, version 05.38.19; kernel 5.4, version...
PT-2024-6757 · Microsoft · Windows Remote Desktop Licensing Service +1
Name of the Vulnerable Software and Affected Versions: Windows Remote Desktop Licensing Service affected versions not specified Description: The issue is related to the use of insecure mechanisms for handling authentication data in the operating system's memory. It allows remote attackers to...
CVE-2024-47652 Insecure Authentication Vulnerability
This vulnerability exists in Shilpi Client Dashboard due to implementation of inadequate authentication mechanism in the login module wherein access to any users account is granted with just their corresponding mobile number. A remote attacker could exploit this vulnerability by providing mobile...
CVE-2024-41290
FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component...
FlatPress 安全漏洞
FlatPress is a Php-based blog builder without database support from the FlatPress community. A security vulnerability exists in FlatPress version v1.3.1, which stems from the use of an insecure method to store authentication data via the cookie component...
AutomationDirect DirectLogic H2-DM1E 授权问题漏洞
AutomationDirect DirectLogic H2-DM1E is a programmable logic controller from AutomationDirect. An authorization issue vulnerability exists in AutomationDirect DirectLogic H2-DM1E that stems from insecure authentication...
PT-2024-5715 · Microsoft · Windows Resource Manager Psm Service Extension +1
Name of the Vulnerable Software and Affected Versions: Windows Resource Manager PSM Service Extension affected versions not specified Description: The issue is related to the use of insecure mechanisms for handling authentication data in the operating system's memory. This can allow an attacker t...
CVE-2024-41808
CVE-2024-41808 concerns the OpenObserve open‑source observability platform. Multiple connected sources confirm that versions through 0.9.1 do not sufficiently sanitize user input in the log filter selection menu, creating a path to a full account takeover when combined with insecure frontend auth...
CVE-2024-29120
In Apache StreamPark (versions prior to 2.1.4 ), an information disclosure vulnerability exists because the Backend service incorrectly returns "Authorization" as the front-end authentication credential upon a successful login. An attacker can leverage this credential to request sensitive informa...
Insecure Authentication
magento/community-edition is vulnerable to Insecure authentication. The vulnerability is due to improper session handling that allows an unauthenticated user to append arbitrary session IDs which will not be invalidated by subsequent authentication, allowing attackers to hijack or manipulate user...
VulnCheck KEV: CVE-2023-35885
CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication...
It’s Still Easy for Anyone to Become You at Experian
In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly h...
NVIDIA Omniverse Workstation Launcher Security Vulnerability
NVIDIA Omniverse Launcher is an easily extensible open platform from NVIDIA. Built for virtual collaboration and real-time physically accurate simulations. A security vulnerability exists in the NVIDIA Omniverse Workstation Launcher, which stems from a security issue in the authentication process...
The vulnerability of the SatRLT.OS software for programmable logic controllers “Satellite-A” lies in the insecure transmission of authentication data. This allows attackers to escalate their privileges and execute arbitrary code.
The vulnerability of the SatRLT.OS software for programmable logic controllers “Satellite-A” lies in the insecure transmission of authentication data. Exploiting this vulnerability allows a remote attacker to enhance their privileges and execute arbitrary code...
SUSE CVE-2021-38502
Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication...
Lepin EP-KP001 安全漏洞
The Lepin EP-KP001 is a USB disk encryption device. A security vulnerability exists in the Lepin EP-KP001 KP001V19 and prior versions, which stems from an insecure design of the authentication. An attacker can exploit the vulnerability to read stored encrypted data in plaintext...
Spoofing Attack
github.com/fleetdm/fleet is vulnerable to spoofing attack. The vulnerability exists due to an insecure authentication allowing an attacker to reuse the SAML response to log into the system...
Design/Logic Flaw
MEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability in the session handling of the password authentication parameter of the wifi photo transfer module. This vulnerability allows attackers with network access privileges or on public wifi networks to re...