526 matches found
October 12, 2021—KB5006699 (OS Build 20348.288)
None None...
Improper Access Control in passport-oauth2
The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants...
Huawei Hero-Ct060 授权问题漏洞
Huawei Hero-Ct060 is a smart wireless Bluetooth headset from Huawei China.A security vulnerability exists in versions prior to Huawei Hero-Ct060 1.0.0.200. The vulnerability stems from the program's failure to adequately authenticate the user's identity. An attacker could exploit the vulnerabilit...
CVE-2021-41580
The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants...
CVE-2021-41580
The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants...
Design/Logic Flaw
DISPUTED The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application...
CVE-2017-16629
In SapphireIMS 40971, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login form. For "Incorrect User" - it gives an error "The application failed to identify the user. Please contact administrator for help." For...
activemq: improper authentication allows MITM attack
Apache ActiveMQ uses LocateRegistry.createRegistry to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to...
GHSA-M738-3RC4-5XV3 A user without PR can reset user authentication failures information
Impact The script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights as it should have. Note that being able to reset the authentication failure record mean that an attacker with script right might...
Advisory ROSA-SA-2021-1824
Software: dovecot 2.2.36 OS: Cobalt 7.9 CVE-ID: CVE-2019-10691 CVE-Crit: HIGH CVE-DESC: The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly cause the authentication service to fail by attempting to authenticate with an invalid UTF-8 sequence as the username. CVE-STATUS:...
XWiki Platform licensing issue vulnerability
Xwiki Platform is a Wiki platform for creating Web collaboration applications from the French company Xwiki. XWiki Platform is vulnerable to authorization issues, which can be exploited by attackers to reset authentication failure records...
Xwiki Platform 授权问题漏洞
Xwiki Platform is a Wiki platform for creating Web collaboration applications from the French company Xwiki. XWiki Platform is vulnerable to authorization issues, which can be exploited by attackers to reset authentication failure records...
Lightweight facebook-styled blog 1.3 - Remote Code Execution (RCE) (Authenticated) (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Lightweight facebook-styled blog authenticated remote code execution", 'Description' = %q This module exploits the file upload vulnerability of...
Liferay DXP 安全漏洞
Liferay DXP is a suite of digital experience collaboration platforms from Liferay USA. A security vulnerability exists in Liferay DXP versions prior to 7.3, which can be exploited by an attacker to prevent any user authentication from passing before remote authentication...
SSON/Passthrough authentication not working with Edge browser
User tries to logon to MS Edge browser via SSON User is prompted to enter username and password instead of getting logged in automatically with SSON as expected...
Cisco SD-WAN vManage Information Disclosure Vulnerability (CNVD-2021-37692)
Cisco SD-WAN vManage is a software from Cisco that provides software-defined networking capabilities. The software provides a way to virtualize the network. An information disclosure vulnerability exists in the cluster management interface of Cisco SD-WAN vManage versions prior to 20.5.1. The...
eclipse: Help Subsystem does not authenticate active help requests
It was found that the Eclipse Platform does not authenticate requests to the Help subsystem on the local web server. A local attacker could use this vulnerability to disrupt the Eclipse user's session, potentially causing Eclipse to damage or disclose data owned by that user...
Tobesoft Xplatform Command Injection Vulnerability
Xplatform is a set of Korean Tobesoft application development platform. The platform supports form and composite component inheritance, CSS auto-setting, and multi-document interfaces. A command injection vulnerability exists in XPlatform versions prior to 9.2.2.280. The vulnerability stems from...
F5 BIG-IP Information Disclosure Vulnerability (CNVD-2021-29556)
F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An information disclosure vulnerability exists in F5 BIG-IP, which stems from a failure to implement any form of authenticatio...
Apache Airflow Authorization Issues Vulnerability
Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security vulnerability exists in Apache Airflow version 2.0.0, which stems from t...