CVE-2019-10039: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/setSysAdm to edit the web or system account without authentication...

CVE-2018-20220

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated,...

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

WeblogicWsatRCE POC for CVE-2017-10271. Since java.lang.Proc...

PT-2019-10021

Name of the Vulnerable Software and Affected Versions: Teracue ENC-400 devices with firmware 2.56 and below Description: An issue was discovered where a large portion of the HTTP endpoints are missing authentication, allowing an attacker to view these pages before being authenticated. Some of the...

CVE-2018-20220: Missing Authentication for Critical Function

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated,...

CVE-2019-3917: Missing Authentication for Critical Function

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on the router via a crafted HTTP request...

CVE-2018-19636: Missing Authentication for Critical Function

Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges...

CVE-2019-9484: Missing Authentication for Critical Function

The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb configuration tool allows remote attackers to obtain access via an HTTP session on port 10000, as demonstrated by reading the modem password which is 1234, or reconfiguring "party mode" or "vacation mode."...

CVE-2019-9201: Missing Authentication for Critical Function

Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to traverse all directories...

Teracue ENC-400 - Command Injection Missing Authentication

Teracue ENC-400 - Command Injection Missing Authentication Introduction ============ Multiple vulnerabilities were identified within the Teracue ENC-400, including pre-authenticated remote code authentication. While the vendor has released updated firmware after these issues were identified, they...

Teracue ENC-400 - Command Injection / Missing Authentication

Introduction ============ Multiple vulnerabilities were identified within the Teracue ENC-400, including pre-authenticated remote code authentication. While the vendor has released updated firmware after these issues were identified, they are not all resolved with the latest version of the...

Teracue ENC-400 Command Injection / Missing Authentication Vulnerabilities

Teracue ENC-400 suffers from hard-coded credential, missing authentication, and command injection vulnerabilities. Teracue ENC-400 Command Injection / Missing Authentication Vulnerabilities Introduction ============ Multiple vulnerabilities were identified within the Teracue ENC-400, including...

CVE-2019-0261: Missing Authentication for Critical Function

Under certain circumstances, SAP HANA Extended Application Services, advanced model XS advanced does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 running on SAP HANA 1 or SAP HANA 2 SPS0 second S stands for stack...

CVE-2019-6543: Missing Authentication for Critical Function

AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI formerly InTouch Machine Edition prior to Version 2017 Update. Code is executed under the program runtime privileges, which could lead to the compromise of the machine...

CVE-2019-7389: Missing Authentication for Critical Function

An issue was discovered in /bin/goahead on D-Link DIR-823G devices with the firmware 1.02B03. There is incorrect access control allowing remote attackers to reset the router without authentication via the SetFactoryDefault HNAP API. Consequently, an attacker can achieve a denial-of-service attack...

CVE-2019-7390: Missing Authentication for Critical Function

An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to hijack the DNS service configuration of all clients in the WLAN, without authentication, via the SetWanSettings HNAP API...

Kunbus PR100088 Modbus Gateway (Update B)

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Kunbus Equipment: PR100088 Modbus gateway Vulnerabilities: Improper Authentication, Information Exposure Through Query Strings in GET Request, Missing Authentication for Critical Function, Imprope...

CVE-2018-0181: Missing Authentication for Critical Function

A vulnerability in the Redis implementation used by the Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent software could allow an unauthenticated, remote attacker to modify key-value pairs for short-lived events stored by the Redis server. The vulnerability is due to...

CVE-2019-0246: Missing Authentication for Critical Function

SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity...

CVE-2018-18995: Missing Authentication for Critical Function

Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrative telnet or web interfaces, which could enable various effects vectors, including conducting device resets, reading or modifying registers, and changing...