CVE-2023-47463

Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the glnassys authentication function...

PT-2023-30460 · Gl.Inet · Gl-Inet Ax1800

Name of the Vulnerable Software and Affected Versions: GL.iNet AX1800 versions 4.0.0 through 4.4.x Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the gl nas sys authentication function. This enables the attacker to potentially gain unauthorized...

CVE-2023-47463

Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the glnassys authentication function...

GL.iNet AX1800 Security Vulnerability

The GL.iNet AX1800 is a wireless router from China's Guanglian Zhitong GL.iNet. A security vulnerability exists in the GL.iNet AX1800 that stems from a vulnerability that allows an attacker to execute arbitrary code with the specially crafted GLnassys authentication function...

CVE-2023-41346

ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the syst...

The vulnerability of TP-Link Tapo L530 Wi-Fi light controller software lies in the lack of protection for sensitive data, allowing intruders to obtain confidential information.

The vulnerability of the Wi-Fi lamp controller software from TP-Link, the Tapo L530, lies in the lack of protection for sensitive data. Exploiting this vulnerability could allow a remote attacker to obtain confidential information through the TSKEP authentication function...

CVE-2023-38908

An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the TSKEP authentication function...

Authentication flaw

An issue in TPLink Smart bulb Tapo series L530 v.1.0.0 and Tapo Application v.2.8.14 allows a remote attacker to obtain sensitive information via the TSKEP authentication function...

CVE-2023-39550

Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 were discovered to contain multiple buffer overflows via the httppasswd and httpusername parameters in the checkauth function...

Percona Monitoring and Management 路径遍历漏洞

Percona Monitoring and Management is an open-source database monitoring solution from Percona, USA. A security vulnerability exists in Percona Monitoring and Management server version 2.x prior to 2.37.1, which stems from the authentication function in authserver.go that does not properly formali...

The vulnerability of the UPGCGI_CheckAuth() function in D-Link’s wireless access points DAP-2020 and DAP-1360 allows a hacker to execute arbitrary code.

The vulnerability of the UPGCGICheckAuth function in D-Link’s wireless access points DAP-2020 and DAP-1360 is related to buffer overflow in the stack. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2023-30394: Improper Neutralization of Input During Web Page Generation

The MoveIt framework 1.1.11 for ROS allows cross-site scripting XSS via the API authentication function. NOTE: this issue is disputed by the original reporter because it has "no impact."...

Synology DiskStation Manager Buffer Overflow Vulnerability

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A buffer overflow vulnerability exists in Synology DiskStation Manager DSM,...

Command injection

SAP Internet Communication framework ICM - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to repeat executions of the initial command by a GET request a...

CVE-2021-40496: Exposure of Resource to Wrong Sphere

SAP Internet Communication framework ICM - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to repeat executions of the initial command by a GET request a...

PT-2021-22902 · Sap · Sap Internet Communication Framework

Name of the Vulnerable Software and Affected Versions: SAP Internet Communication framework ICM versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785 Description: The issue allows an attacker with logon functionality to exploit the authentication function. This can be done...

Denial Of Service

libssh is vulnerable to denial of service. The vulnerability exists due to authentication function which is using the buffer size of the initial secret key which can cause a heap-buffer overflow...

CVE-2020-15836: Undefined Security Weakness

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untrusted data to the operating system without proper sanitization. A crafted request can be sent to execute arbitrary commands as root...

httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4

It was discovered that in httpd 2.4, the internal API function apsomeauthrequired could incorrectly indicate that a request was authenticated even when no authentication was used. An httpd module using this API function could consequently allow access that should have been denied...

httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4

It was discovered that in httpd 2.4, the internal API function apsomeauthrequired could incorrectly indicate that a request was authenticated even when no authentication was used. An httpd module using this API function could consequently allow access that should have been denied...