Code injection

An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code...

Sql injection

An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php...

Command injection

An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts...

CVE-2020-14072

An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts...

CVE-2020-14072

CVE-2020-14072 affects MK-AUTH 19.01. The issue enables command execution as root through shell metacharacters in /auth admin scripts. Public sources in the connected set confirm the vulnerability but do not provide explicit exploit details, affected build variants beyond 19.01, or concrete remed...

CVE-2020-14071

The CVE-2020-14071 entry relates to MK-AUTH 19.01, where cross-site scripting (XSS) in both admin and client scripts allows an attacker to execute arbitrary JavaScript. The available connected documents confirm the affected product/version and the nature of the vulnerability but do not provide ex...

CVE-2020-14071

An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code...

CVE-2020-14070

MK-AUTH 19.01 suffers an authentication bypass in the web login, caused by guessable credentials to admin/executar_login.php, enabling admin access. CVE-2020-14070 affects MK-AUTH 19.01; impact is rated CRITICAL (CVSS v3.1: 9.8) with potential full compromise of confidentiality, integrity, and av...

CVE-2020-14070

An issue was discovered in MK-AUTH 19.01. There is authentication bypass in the web login functionality because guessable credentials to admin/executarlogin.php result in admin access...

CVE-2020-14069

An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php...

CVE-2020-14069

CVE-2020-14069 affects MK-AUTH 19.01, with SQL injection in the mkt/ PHP scripts (arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, wifi.php). Root cause is improper handling of user-supplied input leading to SQL injection. The public documents confirm the v...

CVE-2020-14068

CVE-2020-14068 affects MK-AUTH 19.01, where the web login feature is vulnerable to SQL injection in central/executar_login.php, enabling unauthenticated attackers to bypass authentication and obtain client privileges. Multiple sources (NVD, Red Hat, CNVD, CVE lists) corroborate the issue. NVD met...

CVE-2020-14068

An issue was discovered in MK-AUTH 19.01. The web login functionality allows an attacker to bypass authentication and gain client privileges via SQL injection in central/executarlogin.php...

openstack-keystone: failure to check signature TTL of the EC2 credential auth method

A flaw was found in Keystone, where the restriction was not checked for the Signature Version 4 V4 process of AWS signatures issued within a limited time window. This flaw allows an attacker to capture an auth header and reuse it, potentially maintaining indefinite access...

CVE-2020-4071

CVE-2020-4071 applies to the django-basic-auth-ip-whitelist package prior to version 0.3.4. The issue is a timing-attack vulnerability caused by a character-by-character string comparison of configured BASIC_AUTH_LOGIN/BASIC_AUTH_PASSWORD against user input, which may allow an attacker within a l...

CVE-2020-4071 Timing attack on django-basic-auth-ip-whitelist

In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e. BASICAUTHLOGIN and BASICAUTHPASSWORD is set. Currently the string comparison between configured credentials and the ones provided by users is...

With Pre-Auth policy in place, users get “Error: Not a privilege User” after logging in

From client machine Access website EPA kicks in and successful EPA response Got the login page Two factor Enter the Username and password Got an error “Not a privilege user” and stuck at /cgi/login...

CVE-2020-14408

An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content, creating a Reflected XSS attack vector...

EulerOS 2.0 SP2 : openssh (EulerOS-SA-2020-1657)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target...

PHP-Fusion 9.03.60 PHP Object Injection / SQL Injection

PHP-Fusion version 9.03.60 PHP object injection to SQL injection pre-authentication exploit. Exploit Title: PHP-Fusion v9.03.60, PHP Object Injection to SQL injection pre-auth Date: 2020-05-26 Exploit Author: coiffeur Vendor Homepage: https://www.php-fusion.co.uk/home.php Software Link:...