OpenSSL -- Man-in-the-Middle vulnerability

The OpenSSL project reports: RFC7250 handshakes with unauthenticated servers don't abort as expected High. Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSLVERIFYPEE...

CVE-2021-40866

Certain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the disabled by default /sqfs/bin/sccd daemon, which fails to check authentication when the authentication TLV is missing from a received NSDP packet. This affects GC108P before 1.0.8....

CVE-2020-10627

Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Insulet manufactured Personal Diabetes Manager device. This wireless RF communication protocol does not properly implement authentication or authorization. An...

CVE-2024-47575

A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4,...

CVE-2024-4898

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...

CVE-2024-57435

In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a null pointer dereference occurring in all subsequent operations that require authentication, which triggers a denial-of-service attack and service restart failure...

CVE-2024-57435

In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a null pointer dereference occurring in all subsequent operations that require authentication, which triggers a denial-of-service attack and service restart failure...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS version 18.2 and iPadOS version 18.2, which stems from a password autofill...

CVE-2025-0637 Inadequate access control in Beta10

It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to access private areas and/or areas intended for other roles. The vulnerability has been...

WordPress plugin Adifier System 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

The vulnerability of the SAP Enable Now program for creating and managing training materials, related to deficiencies in the authentication process, allows a user to escalate their privileges and gain unauthorized access to protected information.

The vulnerability of the SAP Enable Now software for creating and managing training materials is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to enhance their privileges and gain unauthorized access to protected...

CVE-2024-11349 AdForest <= 5.1.6 - Authentication Bypass

The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the sbloginuserwithotpfun function. This makes it possible for unauthenticat...

BIT-MATTERMOST-2024-2447

Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action...

Lenovo Display Control Center和Lenovo Accessories and Display Manager 安全漏洞

Lenovo Display Control Center LDCC and Lenovo Accessories and Display Manager LADM are both products of Lenovo, China.Lenovo Display Control Center is a software platform for Lenovo displays. Lenovo Accessories and Display Manager LADM are both products of Lenovo, China. Lenovo Display Control...

PYSEC-2024-158

Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks...

PT-2024-17419 · Pcvue Web · Pcvue Web

Name of the Vulnerable Software and Affected Versions: PcVue Web affected versions not specified Description: The issue occurs when a user attempts to authenticate using an incompatible Web client version with the PcVue Web back end, resulting in user credentials login and password being inserted...

CVE-2024-36242

Protection mechanism failure in the SPP for some IntelR Processors may allow an authenticated user to potentially enable escalation of privilege via local access...

The vulnerability of the software tools for managing identification and access control, as well as the ID Link Manager and the resource planning software FUJITSU Software TIME CREATOR, allows a perpetrator to gain unauthorized access to read and modify confidential information.

The vulnerability of the software tools for managing identification and access to the ID Link Manager, as well as the resource planning software FUJITSU Software TIME CREATOR, is related to the lack of authentication checks for a critical function. Exploiting this vulnerability could allow an...

Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041

The Smart IP Ban module enables a site to automatically ban an IP address based upon too many failed authentications. The module doesn't sufficiently protect access to certain paths provided by the module allowing a malicious user to view and modify the settings...

The vulnerability of the Palo Alto Networks Expedition configuration migration tool, related to the lack of authentication for a critical function, allows a perpetrator to obtain administrator credentials.

The vulnerability of the Palo Alto Networks Expedition configuration migration tool is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain the administrator account...