CVE-2022-2533

An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions...

CVE-2022-2533

An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions...

GoCD 安全漏洞

GoCD is a continuous delivery server. A security vulnerability exists in GoCD versions 19.2.0 through 19.11.0 that originates from allowing an authenticated agent to impersonate another agent, resulting in an access control outage and incorrect authentication of agent tokens in the GoCD server to...

CVE-2022-41489

WAYOS LQ09 22.03.17V was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to send crafted requests to the server from the affected device. This vulnerability is exploitable due to a lack of authentication in the component Usbupload.htm...

Trend Micro Apex One 信任管理问题漏洞

Trend Micro Apex One is an endpoint protection software from Trend Micro, Inc. Trend Micro Apex One 2019 on-prem, SaaS version has a trust management issue vulnerability that stems from the Apex One agent not being properly authenticated, which could be exploited by an attacker to load DLL files...

PT-2022-15493 · Carlo Gavazzi · Carlo Gavazzi Uwp3.0

Name of the Vulnerable Software and Affected Versions: Carlo Gavazzi UWP3.0 affected versions not specified CPY Car Park Server version 2.8.3 Description: An improper authentication issue exists, allowing an authentication bypass in the context of an unauthorized user if free-access is disabled...

PT-2022-24832 · Arvados · Arvados

Name of the Vulnerable Software and Affected Versions: Arvados versions prior to 2.4.3 Description: The issue affects Arvados, an open source platform for managing and analyzing biomedical big data. When using Portable Authentication Modules PAM for user authentication, if a user presents valid...

CVE-2021-33076

Improper authentication in firmware for some IntelR SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

PT-2022-6341 · Unknown · Mklogic-500

Name of the Vulnerable Software and Affected Versions: MKLogic-500 affected versions not specified Description: The issue is related to a lack of authentication for a critical function in the MKLogic-500 PLC configuration protocol. This could allow a remote attacker to modify the device's logic,...

PT-2022-11750 · Unknown +1 · Hoteldruid Hotel Management +1

Name of the Vulnerable Software and Affected Versions: HotelDruid Hotel Management Software version 3.0.3 Description: The issue concerns the controlla login function in the software, which generates a predictable session token. This predictability allows attackers to bypass authentication throug...

CVE-2022-36105 User Enumeration via Response Timing in TYPO3

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication backend and frontend can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd part...

PT-2022-24996 · Sap · Sap Gui For Html

Name of the Vulnerable Software and Affected Versions: SAP GUI for HTML affected versions not specified Description: The issue allows an attacker with no prior authentication to craft and send malicious scripts to SAP GUI for HTML within Fiori Launchpad, resulting in a reflected cross-site...

PT-2022-17826 · Baxter · Baxter Spectrum Wbm

Name of the Vulnerable Software and Affected Versions: Baxter Spectrum WBM affected versions not specified Description: The issue concerns a lack of mutual authentication with the gateway server host. This could allow an attacker to perform a man-in-the-middle attack, modifying parameters to caus...

CVE-2022-31020 Remote code execution in Indy's NODE_UPGRADE transaction

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the pool-upgrade request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The pool-upgrade request...

CVE-2022-36640

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint...

PT-2022-4607 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.10 through 15.1.6 GitLab versions 15.2 through 15.2.4 GitLab versions 15.3 through 15.3.2 Description: The issue is related to incorrect authentication with some Package Registries when IP address restrictions are configure...

PT-2022-8928 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: keycloak versions 11.0.3 through 13.0.0 Description: A flaw was found in the direct-grant authenticator of keycloak, where an expired certificate would be accepted due to missing time stamp validations. The highest threat from this issue is t...

CVE-2022-2377 Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail Sending

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog...

CVE-2022-24378

Improper initialization in the IntelR Data Center Manager software before version 4.1 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2022-38368

An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands...