1903 matches found
SUSE: Security Advisory (SUSE-SU-2022:2159-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2022-20942 · 3S Smart Software Solutions · Codesys Gateway Server
Name of the Vulnerable Software and Affected Versions: CODESYS Gateway Server V2 versions prior to V2.3.9.38 Description: The issue allows an attacker to perform authentication by specifying a small password that matches a part of the longer real CODESYS Gateway password, as only a part of the...
CVE-2022-22967
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an...
Schneider Electric IGSS Data Server Access Control Error Vulnerability (CNVD-2023-38195)
The Schneider Electric IGSS Data Server is a data server for the interactive graphical Scada system from Schneider Electric, France. An Access Control Error vulnerability exists in Schneider Electric IGSS Data Server versions prior to 15.0.0.22140, which stems from the application's lack of...
GE Voluson 授权问题漏洞
GE Voluson is a diagnostic ultrasound solution from General Electric GE. A security vulnerability exists in GE Voluson S8 that originates from incorrect authentication in the service browser file /uscgi-bin/users.cgi. An attacker could exploit the vulnerability to launch an attack against the loc...
CVE-2022-1982 A crafted SVG attachment can crash a Mattermost server
Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post...
CVE-2022-26724
An authentication issue was addressed with improved state management. This issue is fixed in tvOS 15.5. A local user may be able to enable iCloud Photos without authentication...
CVE-2022-26724
An authentication issue was addressed with improved state management. This issue is fixed in tvOS 15.5. A local user may be able to enable iCloud Photos without authentication...
CVE-2022-26724
An authentication issue was addressed with improved state management. This issue is fixed in tvOS 15.5. A local user may be able to enable iCloud Photos without authentication...
CVE-2022-26724
The CVE-2022-26724 issue affects tvOS and is described as an authentication issue that was addressed with improved state management. It is fixed in tvOS 15.5, where a local user may previously have been able to enable iCloud Photos without authentication. The Apple security content entry for tvOS...
CVE-2022-26724
An authentication issue was addressed with improved state management. This issue is fixed in tvOS 15.5. A local user may be able to enable iCloud Photos without authentication...
CVE-2022-29446 WordPress Counter Box plugin <= 1.1.1 - Authenticated Local File Inclusion (LFI) vulnerability
Authenticated administrator or higher role Local File Inclusion LFI vulnerability in Wow-Company's Counter Box plugin = 1.1.1 at WordPress...
HC Custom WP-Admin URL <= 1.4 - Unauthenticated Secret URL Disclosure
The plugin leaks the secret login URL when sending a specific crafted request PoC curl -sIXGET -H "Cookie: validloginslug=1" https://example.com/wp-login.php HTTP/2 302 x-redirect-by: WordPress location: secret...
CVE-2022-21151
Processor optimization removal or modification of security-critical code for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...
CVE-2021-34590
In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration values. These values are not properly escaped when displayed...
CVE-2022-24885 Improper Authentication in Nextcloud Android Files
Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.1, users can bypass a lock on the Nextcloud app on an Android device by repeatedly reopening the app. Version 3.19.1 contains a fix for the problem. There are currently no known...
PT-2022-9182 · Red Hat · Wildfly Elytron
Name of the Vulnerable Software and Affected Versions: WildFly Elytron affected versions not specified Description: A flaw was found in WildFly Elytron, related to a session fixation exploit when using Undertow, despite Undertow switching the session ID after authentication. Recommendations: At t...
SUSE-SU-2022:0743-2 Security update for cyrus-sasl
This update for cyrus-sasl fixes the following issues: - CVE-2022-24407: Fixed SQL injection in sqlauxpropstore in plugins/sql.c bsc1196036. The following non-security bugs were fixed: - postfix: sasl authentication with password fails bsc1194265...
CVE-2020-14479 ICSA-20-147-01 Inductive Automation Ignition (Update B)
Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server...