2171 matches found
GHSA-CFHH-XGWQ-5R67 Sudden swap of user auth tokens in Volto
Impact Due to the usage of an outdated version of the react-cookie library, under the circumstances of given a server high load, it is possible that a user could get his/her auth cookie replaced with the auth cookie from another user, effectively giving him full access to the other users account...
Accounting User Can Download Patient Reports in openemr
Vulnerability Type Insecure Direct Object Reference Affected URL https://localhost/openemr/interface/patientfile/report/customreport.php Affected Parameters “Issue7” Authentication Required? Yes Issue Summary Non-privilege users accounting & front-office can download patient reports containing...
CVE-2021-42950
Remote Code Execution RCE vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new organization by which additional...
CVE-2021-38266
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign ...
CVE-2021-38266
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign ...
CVE-2021-38266
The CVE-2021-38266 issue affects the Portal Security module in Liferay Portal up to version 7.2.1 and Liferay DXP up to 7.2 (and older 7.0/7.1) where LDAP user import can fail, enabling remote attackers to prevent a legitimate user from authenticating by signing in as an LDAP user.根 The root caus...
CVE-2021-38266
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign ...
CVE-2022-24663 Remote Code Execution by Subscriber+ users via WordPress shortcode
PHP Everywhere = 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated user...
HP Support Assistant 授权问题漏洞
HP Support Assistant is a solution from Hewlett-Packard HP that provides support and other functions for PCs and printers. HP Support Assistant has an authorization issue vulnerability that stems from the product's failure to effectively authenticate users, which could be exploited by an untruste...
CVE-2021-46250
An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as other users on downstream components that rely on ScratchOAuth2...
Missing Authentication
shenyu is vulnerable to missing authentication. The vulnerability exists due to a lack of validation in user authentication allows attackers to register for the gateway...
Design/Logic Flaw
Discourse is an open source discussion platform. Versions prior to 2.7.13 in stable, 2.8.0.beta11 in beta, and 2.8.0.beta11 in tests-passed allow some users to log in to a community before they should be able to do so. A user invited via email to a forum with mustapproveusers enabled is going to ...
Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
This is a PoC exploit for CVE-2021-26084, a pre-auth RCE injecti...
CVE-2021-44600
The password parameter on Simple Online Mens Salon Management System MSMS 1.0 appears to be vulnerable to SQL injection attacks through the password parameter. The predictive tests of this application interacted with that domain, indicating that the injected SQL query was executed. The attacker c...
Open Redirect in OAuth2 Proxy
Impact As users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user...
CVE-2021-43812
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as...
SiPass integrated access control vulnerability (CNVD-2021-100377)
SiPass integrated is an access control system. With the SiPass integrated access control vulnerability, an affected application has insufficiently restricted access to internal user authentication services. A remote attacker could exploit the vulnerability to trigger multiple operational accounts...
CVE-2021-44524
A vulnerability has been identified in SiPass integrated V2.76 All versions, SiPass integrated V2.80 All versions, SiPass integrated V2.85 All versions, Siveillance Identity V1.5 All versions, Siveillance Identity V1.6 All versions V1.6.284.0. Affected applications insufficiently limit the access...
CVE-2021-44524
The CVE-2021-44524 entry affects Siemens SiPass Integrated (v2.76, v2.80, v2.85) and Siveillance Identity (v1.5, v1.6 prior to 1.6.284.0). The root cause is insufficient access control on the internal user authentication service, allowing an unauthenticated remote attacker to perform actions on b...
