CVE-2020-35231

The CVE-2020-35231 entry concerns the NETGEAR JGS516PE/GS116Ev2 NSDP protocol implementation (v2.6.0.43) with an authentication bypass that lets a remote attacker bypass access controls and obtain full device control. Multiple sources (NVD, Red Hat, CNVD, CNVD-derived entries) confirm an authenti...

CVE-2020-35231

The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an attacker to bypass access controls and obtain full control of the device...

CVE-2021-27215

An issue was discovered in genua genugate before 9.0 Z p19, 9.1.x through 9.6.x before 9.6 p7, and 10.x before 10.1 p4. The Web Interfaces Admin, Userweb, Sidechannel can use different methods to perform the authentication of a user. A specific authentication method during login does not check th...

Authentication flaw

Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to view sensitive syslog events without authentication...

SolarWinds Serv-U File Server Cross-Site Scripting Vulnerability (CNVD-2021-14808)

Solarwinds SolarWinds Serv-U File Server is a file transfer server from SolarWinds USA. A cross-site scripting vulnerability exists in SolarWinds Serv-U File Server before 15.2.2, which stems from a WEB application lacking proper authentication of client data. An authenticated attacker could...

LDAP authentication failed with error code 4003 and Group length is very large

One user cannot login Gateway with LDAP authentication and other users can login normally...

CS Money: Able to upload backgrounds before entering 2FA

Summary: Hi Team, I am able to see and use uploaded backgrounds and able to upload new ones without proper authentication of 2FA. I hope you remember this report 993786. Steps To Reproduce: 1. Login with a steam account and enable 2FA. 1. Now logout your account. Clear all the cookies. 1. Now aga...

CVE-2020-5686

Incorrect implementation of authentication algorithm issue in UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to access the remote system maintenance feature and obtain the information by sending a specially crafted request to a specific URL...

CVE-2020-5686

Incorrect implementation of authentication algorithm issue in UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to access the remote system maintenance feature and obtain the information by sending a specially crafted request to a specific URL...

Rocket.Chat 授权问题漏洞

Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat that stems from incorrectly handling SAML logins. No details of the vulnerability are provided at this time...

CVE-2020-26172

Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration timestamp...

Apache TomEE Authorization Issues Vulnerability

Apache TomEE is the United States Apache Software Apache Foundation of a lightweight Java EE application server . A security vulnerability exists in Apache TomEE versions 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5, which originates from the use of the embedded ActiveMQ proxy...

PT-2020-14125 · Askey · Ap5100W

Name of the Vulnerable Software and Affected Versions: Askey AP5100W devices through AP5100W Dual SIG 1.01.097 Description: The issue arises from problems with the random number selection for the Diffie-Hellman exchange, allowing an attacker to brute force the overall authentication exchange by...

CVE-2020-27902

An authentication issue was addressed with improved state management. This issue is fixed in iOS 14.2 and iPadOS 14.2. A person with physical access to an iOS device may be able to access stored passwords without authentication...

CVE-2020-27902

CVE-2020-27902 is an Apple iOS/iPadOS vulnerability describing an authentication issue where a user with physical access could access stored passwords without authentication. Apple fixed this issue in iOS 14.2 and iPadOS 14.2 by improving state management. The CVE appears under Keyboard in the Ap...

CVE-2020-28250

CVE-2020-28250 affects Cellinx NVT Web Server 5.0.0.014b.test (2019-09-05). The vulnerability allows a remote user to run commands as root via SetFileContent.cgi because authentication is performed on the client side. Exploitation details are not provided in the documents; no patch/version remedi...

A vulnerability in the SonicWall Capture Security Center was allowing access to the managed firewall without authentication

A vulnerability in the SonicWall Capture Security Center - Cloud Security Management Service was allowing users to access managed firewalls without authentication, this issue has been resolved and a security patch has been pushed out to all affected Capture Security Center - Management and...

CVE-2020-25251

CVE-2020-25251 affects Hyland OnBase prior to specific build revisions (16.0.2.83 and below; 17.0.2.109 and below; 18.0.0.37 and below; 19.8.16.1000 and below; 20.3.10.1000 and below). The issue stems from client-side authentication used for critical functions (e.g., adding users or retrieving se...

CVE-2020-25079

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddnsenc.cgi allows authenticated command injection...

CVE-2020-6871

The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the server and execute some commands for high-level users. This affects:...