The vulnerability of the microprogrammed software of the programmable logic controller LS ELECTRIC XBC-DN32U lies in the lack of authentication for a critical function. This allows attackers to escalate their privileges and gain control over the device.

The vulnerability of the microprogrammed logic controller LS ELECTRIC XBC-DN32U lies in the absence of authentication for a critical function. Exploiting this vulnerability allows an attacker to enhance their privileges and gain control over the device...

CVE-2023-30969

The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints...

The vulnerability of the HNAP interface of the D-Link DAP-1325 wireless signal booster’s microprogramming software allows a intruder to execute arbitrary code.

The vulnerability of the HNAP interface of the D-Link DAP-1325 wireless signal booster software exists due to the lack of authentication checks before access to functions is granted. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2023-36669

Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit IDU before 11.4 allows remote attackers to obtain arbitrary control of the IDU/ODU system. Any attacker with layer-3 network access to the IDU can impersonate the Touch Panel Unit TPU within the IDU by sending crafte...

CVE-2023-3028

Insufficient authentication in the MQTT backend broker allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were identified: - The MQTT...

PT-2023-24779 · Bmc · Bmc Patrol

Name of the Vulnerable Software and Affected Versions: BMC Patrol versions through 23.1.00 Description: An issue was discovered where the agent's configuration can be remotely modified, and by default, authentication is not required. Some configuration fields related to SNMP, such as...

CVE-2023-0116

The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect availability...

CBOT Chatbot 访问控制错误漏洞

CBOT Chatbot is an AI-powered real-time chat solution from CBOT. A security vulnerability exists in CBOT Chatbot Core prior to v4.0.3.4, Panel prior to v4.0.3.7, which stems from a lack of origin authentication in WebSockets and allows content spoofing via the application API...

PT-2023-19027 · T&D +1 · Tr-71W/72W +7

Name of the Vulnerable Software and Affected Versions: T&D Corporation data logger products versions TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions ESPEC MIC CORP. data logger products versio...

The communication module of the Mitsubishi Electric WS0-GETH00200 security controller is vulnerable due to the lack of authentication. This allows attackers to escalate their privileges and gain access to the device.

The vulnerability of the communication module for Mitsubishi Electric WS0-GETH00200 security controllers is related to the absence of authentication. Exploiting this vulnerability allows a malicious actor to remotely increase their privileges and gain access to the device via the TELNET network...

The vulnerability of microprogrammed software in logic controllers for building and facility control systems from Schneider Electric—such as spaceLYnk, Wiser for KNX (formerly homeLYnk), and FellerLYnk—is related to the lack of authentication for critical functions. This allows attackers to alter the configuration of the system.

The vulnerability of microprogramming software for logic controllers used in building and facility management systems from Schneider Electric—such as spaceLYnk, Wiser for KNX formerly homeLYnk, and FellerLYnk—is related to the absence of authentication for critical functions. Exploiting this...

The vulnerability of the server-side components of WAGO’s programmable logic controllers, such as WAGO PFC100/PFC200, CC100, Edge Controller, as well as the WAGO Touch Panel 600, allows a malicious actor to record arbitrary data with root privileges.

The vulnerability of the server-side components of WAGO PFC100/PFC200, CC100, Edge Controller programmable logic controllers, and WAGO Touch Panel 600 sensor panels lies in the absence of authentication for critical functions. Exploiting this vulnerability allows an attacker to remotely record...

The vulnerability of the database server of the software solution for monitoring the status of B&R APROL industrial systems allows a hacker to read and modify configuration data.

The vulnerability of the database server of the B&R APROL software solution for monitoring the status of industrial systems is related to the absence of an authentication procedure. Exploiting this vulnerability allows a malicious actor to read and modify configuration data remotely...

CVE-2023-24526

SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user identity, resulting in escalation of privileges. This failure has a low impact on confidentiality of the data such that an unassigned user c...

CVE-2023-22803

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to change the PLC's mode arbitrarily...

SUSE CVE-2008-4576

sctp in Linux kernel before 2.6.25.18 allows remote attackers to cause a denial of service OOPS via an INIT-ACK that states the peer does not support AUTH, which causes the sctpprocessinit function to clean up active transports and triggers the OOPS when the T1-Init timer expires...

CVE-2022-48299

The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

plugin: Lack of authentication mechanism in Git Plugin webhook

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository...

CVE-2022-3841

RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery SSRF vulnerability was found in the console API endpoint from Red Hat Advanced Cluster Management for Kubernetes RHACM. An attacker could take advantage of this as the console API endpoint is missing an...

The vulnerability of the Cisco Software-Defined Application Visibility and Control (SD-AVC) function in the centralized network management system, the Cisco Catalyst SD-WAN Manager, allows a intruder to gain unauthorized access to the system.

The vulnerability of the Cisco Software-Defined Application Visibility and Control SD-AVC function in the centralized network management system, Cisco Catalyst SD-WAN Manager, is related to the lack of authentication for this critical function. Exploiting this vulnerability could allow a maliciou...