Omron SYSMAC CS/CJ/CP Series 访问控制错误漏洞

The Omron SYSMAC CS/CJ/CP Series is a series of programmable controllers from Omron Corporation Japan. A security vulnerability exists in the Omron SYSMAC CS/CJ/CP Series due to a security issue with the FINS protocol that involves clear-text communication, undefined authentication, and other...

PT-2023-5724

Name of the Vulnerable Software and Affected Versions Jetty versions 9.4.21 through 9.4.51 Jetty version 10.0.15 Jetty version 11.0.15 Description The issue is related to weak authentication in Jetty when using the OpenIdAuthenticator with a nested LoginService. If the LoginService revokes an...

CVE-2023-24890: Weak Authentication

Microsoft OneDrive for iOS Security Feature Bypass Vulnerability...

The vulnerability of the shell_exec() function in the software for video surveillance by ZoneMinder, which allows a intruder to execute arbitrary code.

The vulnerability of the shellexec function in the software for video surveillance by ZoneMinder is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Osprey Pump Controller 1.0.1 Predictable Session Token / Session Hijacking Vulnerabilities

Osprey Pump Controller version 1.0.1 has an ELF binary called MirageCreateSessionCode.x that contains a weak session token generation algorithm that can be predicted and can aid in authentication and authorization bypass attacks. Further, session hijacking is possible due to MitM attack exploitin...

The vulnerability of the get_IFTTTTtoken.cgi function in the microprogramming software for Wi-Fi routers from ASUS, RT-AX82U, allows a hacker to completely compromise the system.

The vulnerability of the getIFTTTTtoken.cgi function in the microprogramming software for Wi-Fi routers from ASUS, the RT-AX82U, is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to completely compromise the system by sending a series...

SUSE CVE-2018-1139

A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client...

The vulnerability of the iotdb-web-workbench component of the IoT database for Apache IoTDB allows a hacker to escalate their privileges.

The vulnerability of the iotdb-web-workbench component of the IoT database solution from Apache IoTDB is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker to enhance their privileges remotely...

Huawei HOTA-Fara-B19 授权问题漏洞

Huawei HOTA-Fara-B19 is a smartwatch from Chinese company Huawei. The Huawei HOTA-Fara-B19 suffers from a security vulnerability that stems from the presence of an insufficient authentication vulnerability that could allow an attacker to spoof and then connect to the bracelet...

GHSA-JFP7-79G7-89RF TYPO3 CMS vulnerable to Weak Authentication in Frontend Login

Problem Restricting frontend login to specific users, organized in different storage folders partitions, can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. Solution Update to TYPO3...

TYPO3 CMS vulnerable to Weak Authentication in Frontend Login

Problem Restricting frontend login to specific users, organized in different storage folders partitions, can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. Solution Update to TYPO3...

TYPO3-CORE-SA-2022-013: Weak Authentication in Frontend Login

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-013...

TYPO3-CORE-SA-2022-013: Weak Authentication in Frontend Login

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-013...

typo3 -- multiple vulnerabilities

TYPO3 reports: TYPO3-CORE-SA-2022-012: Denial of Service in Page Error Handling. TYPO3-CORE-SA-2022-013: Weak Authentication in Frontend Login. TYPO3-CORE-SA-2022-014: Insufficient Session Expiration after Password Reset. TYPO3-CORE-SA-2022-015: Arbitrary Code Execution via Form Framework...

The vulnerability of the command-line interface (CLI) of the security management system FortiSIEM, which allows a attacker to gain unauthorized access to protected information

The vulnerability of the command-line interface CLI of the security management system FortiSIEM is related to deficiencies in authentication procedures and the use of default credentials when connecting to the Glassfish server. Exploiting this vulnerability can allow an attacker to gain...

DEBIAN-CVE-2022-43504

Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7...

Splunk 安全漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. Splunk...

The vulnerability of the FortiSIEM security management interface allows a attacker to execute a CSRF attack.

The vulnerability of the FortiSIEM security management interface is related to insufficient verification of the authenticity of executed requests. Exploiting this vulnerability allows a malicious actor, operating remotely, to carry out CSRF attacks...

CVE-2022-43400: Weak Authentication

A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 All versions V22.2a 80. The mobile server component of affected applications improperly handles the log in for Active Directory accounts that are part of Administrators group. This could allow an unauthenticated remot...

Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control

Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server...