CVE-2019-17437

An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges and become superuser. This issue affects PAN-OS 7.1 versions prior to 7.1.25; 8.0 versions prior to 8.0.20; 8.1 versions prior to 8.1.11; 9....

CVE-2019-17437 PAN-OS: Custom-role users may escalate privileges

An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges and become superuser. This issue affects PAN-OS 7.1 versions prior to 7.1.25; 8.0 versions prior to 8.0.20; 8.1 versions prior to 8.1.11; 9....

PAN-OS: Custom-role users may escalate privileges

An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges and become superuser. This issue affects PAN-OS 7.1 versions prior to 7.1.25; 8.0 versions prior to 8.0.20; 8.1 versions prior to 8.1.11; 9....

PT-2019-5494

Name of the Vulnerable Software and Affected Versions PAN-OS versions 7.1 prior to 7.1.25 PAN-OS versions 8.0 prior to 8.0.20 PAN-OS versions 8.1 prior to 8.1.11 PAN-OS versions 9.0 prior to 9.0.5 Description The issue is related to an improper authentication check in the PAN-OS operating system,...

CVE-2019-0379

SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is changed to BouncyCastle BC, leading to Missing Authentication Check...

Authentication flaw

SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is changed to BouncyCastle BC, leading to Missing Authentication Check...

CVE-2019-0379

SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is changed to BouncyCastle BC, leading to Missing Authentication Check...

CVE-2019-0379

CVE-2019-0379 affects SAP NetWeaver Process Integration (PI) – B2B Add-On versions 1.0 and 2.0. When the default security provider is switched to BouncyCastle (BC) , authentication checks are not performed properly, causing a Missing Authentication Check vulnerability. Public documents in the pro...

PT-2019-4347

Name of the Vulnerable Software and Affected Versions SAP Process Integration, business-to-business add-on, versions 1.0 through 2.0 Description The issue is related to insufficient authentication check, which can be exploited by a remote attacker to impact the integrity of protected information...

CVE-2019-0379: Missing Authentication for Critical Function

SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is changed to BouncyCastle BC, leading to Missing Authentication Check...

Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly

With the consul ruby gem before 1.0.3, if a controller checks multiple powers using :if or :except conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions...

Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly

With the consul ruby gem before 1.0.3, if a controller checks multiple powers using :if or :except conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions...

PT-2019-3059

Name of the Vulnerable Software and Affected Versions Cisco Integrated Management Controller IMC Supervisor versions affected versions not specified Cisco UCS Director versions affected versions not specified Cisco UCS Director Express for Big Data versions affected versions not specified...

CVE-2017-8227

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are detected using the Web and HTTP API interface provided by the device. However, if the same brute force attempt is performed using the ONVIF specification which...

CVE-2018-19110

The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/user/skin/list directly because controller\usercontroller.java maps a /skin/list request to the function skinList, and lacks an authorization chec...

CVE-2018-18891

MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late...

Debian DLA-1556-1 : paramiko security update

CVE-2018-1000805 Fix to prevent malicious clients to trick the Paramiko server into thinking an unauthenticated client is authenticated. CVE-2018-7750 Fix check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step. F...

PT-2018-15494

Name of the Vulnerable Software and Affected Versions SAP KERNEL versions 7.45 through 7.52 Description The issue is related to the SAP Startup Service, which lacks an authentication check for certain functionalities that require user identity. This omission can lead to the consumption of file...

IBM BigFix Platform 9.2.x < 9.2.12 / 9.5.x < 9.5.7 Multiple Vulnerabilities

According to its self-reported version, the IBM BigFix Platform application running on the remote host is 9.2.x prior to 9.2.12, or 9.5.x prior to 9.5.7. It is, therefore, affected by multiple vulnerabilities : - An unspecified cross-site request forgery XSRF vulnerability allows an attacker to...

PT-2017-12410

Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager versions 9.2 through 9.5 Description The issue allows anonymous users access to protected areas due to a lack of authentication check for a critical resource or functionality. Recommendations For versions 9.2 throug...