Proficy Historian 访问控制错误漏洞

GE Digital Proficy Historian is a powerful tool with storage analysis and data collection capabilities from GE Digital. An access control error vulnerability exists in Proficy Historian v7.1 and prior versions, which stems from the fact that even if authentication to a local service fails,...

CVE-2022-46732 CVE-2022-46732

Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status...

CVE-2022-48195

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

PT-2022-27475 · Apache · Apache Shardingsphere-Proxy

Name of the Vulnerable Software and Affected Versions: Apache ShardingSphere-Proxy versions prior to 5.3.0 Description: The issue arises when Apache ShardingSphere-Proxy is used with MySQL as the database backend. In versions prior to 5.3.0, the database session is not properly cleaned up after a...

The vulnerability of the Linux operating system’s Bluetooth driver allows attackers to gain increased privileges.

The vulnerability of the Linux operating system’s Bluetooth driver kernel is related to errors during authentication processes. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

Apache ShardingSphere 安全漏洞

Apache ShardingSphere is an open source distributed database middleware solution from the Apache Foundation. A security vulnerability exists in Apache ShardingSphere-Proxy versions prior to 5.3.0, which stems from the fact that when using MySQL as a database backend, the database session is not...

389-ds-base: expired password was still allowed to access the database

A vulnerability was found in the 389 Directory Server. This issue allows expired passwords to access the database, causing improper authentication...

Cloudflare OctoRPKI 安全漏洞

Cloudflare OctoRPKI is an RPKI toolkit for the Cloudflare platform from Cloudflare, Inc. in the United States. A security vulnerability exists in Cloudflare OctoRPKI. An attacker exploiting this vulnerability could create an overly long CA chain, causing OctoRPKI to exceed its maximum iteration...

Xiaomi specific devices 安全漏洞

Xiaomi specific devices are a series of specific devices from the Chinese company Xiaomi. A security vulnerability exists in Xiaomi specific devices, which stems from an authentication failure. An attacker could exploit this vulnerability to gain a short-lived elevation of privilege...

[Citrix VPN] Citrix Secure Access Client for MacOS gets error: "Error while processing request"

When connecting Citrix VPN from the latest Citrix Secure Access Client for MacOS, you may see the following error message before login: Error while processing request. Contact your administrator. Errors in client logs: Jul 6, 2022 at 9:43:32 AM GMT+9 : No certificate extension matching Subject...

Airspan AirSpot 5410 跨站脚本漏洞

The Airspan AirSpot 5410 is an advanced LTE, CAT12, outdoor, multi-service product from Airspan USA. A security vulnerability exists in Airspan AirSpot 5410 version 0.3.4.1-4 and prior versions, which stems from a failure of its binary component /home/www/cgi-bin/login.cgi to check that the user ...

The vulnerability of the OAS Engine SecureAddSecurity function in the platform for data transmission between devices and applications allows a perpetrator to gain unauthorized access to the system.

The vulnerability of the OAS Engine SecureAddSecurity function in the platform for data transfer between devices and applications in the OAS Platform is related to the lack of authentication for this critical function. Exploiting this vulnerability could allow an attacker operating remotely to ga...

[CEM] MAM enrollment Fails in Authentication - Password window pops-up Repeatedly

When you enroll MAM to CEM server through Citrix Gateway, you may observe password box pops-up repeatedly without any error. It means your password is correct but SSO from Citrix Gateway to CEM server fails. Follow is the sample of Secure Hub's debug log. " 2022-06-22T14:50:06.638+0800 ",,DEBUG1...

GHSA-4XW6-HJ5P-4J79 OpenStack Glance sensitive information disclosure via logs

OpenStack Image Registry and Delivery Service Glance 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading th...

CVE-2022-1398

The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks...

WIZPLAT PD065 安全漏洞

WIZPLAT PD065 is a fingerprint-aware secure USB memory from WIZPLAT Korea.A denial of service vulnerability exists in WIZPLAT PD065 v1.19, which stems from a failure to properly verify authentication in the authentication module. An attacker could use this vulnerability to access sensitive data a...

The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications lies in the lack of authentication for critical functions, which allows a malicious actor to disable certain services.

The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications is related to the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to disable certain services by sending specially crafted commands remote...

DEBIAN-CVE-2022-0996

A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication...

CVE-2021-27464

CVE-2021-27464 affects Rockwell Automation FactoryTalk AssetCentre (ArchiveService.rem) on v10.00 and earlier, where functions lack proper authentication, enabling a remote, unauthenticated attacker to execute arbitrary SQL statements. Connected sources corroborate a broader set of SQL/command-in...

java-11-openjdk bug fix and enhancement update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Bug Fixes: The previous OpenJDK 11 release, 11.0.14, was found to contain a regression introduced by improvements to the HTTP client. It caused both the :authority' and...