PT-2021-21740

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.10.7 Description The issue concerns the lack of authentication for SIP MESSAGE requests in FreeSWITCH, leading to potential spam and message spoofing. By default, SIP requests of the type MESSAGE are not...

Exploit for Missing Authentication for Critical Function in Estrongs Es_File_Explorer_File_Manager

CVE-2019-6447-ES file Explorer e...

CVE-2021-41317

XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...

CVE-2021-40866

Certain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the disabled by default /sqfs/bin/sccd daemon, which fails to check authentication when the authentication TLV is missing from a received NSDP packet. This affects GC108P before 1.0.8....

PYSEC-2021-326

The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...

The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M340, Modicon Quantum, and Modicon Premium lies in the absence of authentication for a critical function, allowing attackers to execute arbitrary commands.

The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M340, Modicon Quantum, and Modicon Premium lies in the absence of authentication for critical functions. Exploiting this vulnerability allows an attacker operating remotely to...

The vulnerability of the if_get_addbook.php component of the White Shark System platform allows a intruder to gain unauthorized access to protected information.

The vulnerability of the ifgetaddbook.php component of the White Shark System is related to the lack of authentication for the critical function. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

CVE-2021-32930

The affected product’s configuration is vulnerable due to missing authentication, which may allow an attacker to change configurations and execute arbitrary code on the iView versions prior to v5.7.03.6182...

CVE-2021-23847 Unauthenticated Information Extraction Vulnerability

A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and...

CVE-2021-1535

A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. To be affected by this vulnerability, the Cisco SD-WAN vManage Software must be in cluster mode. This...

The vulnerability of Siemens LOGO!8 BM programmable logic controller’s microprogramming software lies in the lack of authentication for a critical function, allowing an intruder to gain unauthorized access to protected information.

The vulnerability of Siemens LOGO!8 BM programmable logic controller’s microprogramming software is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow an intruder to gain unauthorized access to protected information...

CVE-2021-22995

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ high availability HA when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development EoSD are not evaluated...

The vulnerability of the _krb5_extract_ticket() function in the Samba networking software package arises from a lack of authentication mechanism checks. This vulnerability allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the krb5extractticket function in the Samba networking software package is related to the lack of a mechanism for verifying the authenticity of data. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause...

F5 BIG-IP 访问控制错误漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An information disclosure vulnerability exists in F5 BIG-IP, which stems from a failure to implement any form of authenticatio...

Apache Airflow 访问控制错误漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security vulnerability exists in Apache Airflow version 2.0.0, which stems from t...

CVE-2021-22159

Insider Threat Management Windows Agent Local Privilege Escalation Vulnerability The Proofpoint Insider Threat Management formerly ObserveIT Agent for Windows before 7.4.3, 7.5.4, 7.6.5, 7.7.5, 7.8.4, 7.9.3, 7.10.2, and 7.11.0.25 as well as versions 7.3 and earlier is missing authentication for a...

CVE-2020-27276

SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i & AnyDana-A mobile apps doesn't use adequate measures to authenticate the communicating entities before exchanging keys, which allows unauthenticated, physically proximate...

Scalance X Products Critical Function Authentication Missing Vulnerability

SCALANCE X is a switch for connecting industrial components such as programmable logic controllers plc or human machine interfaces HMIs. The Scalance X Products Critical Function Authentication Missing vulnerability can be exploited by an attacker to reboot the device over a network...

The vulnerability of the web interface of the Cisco Vision Dynamic Signage Director system allows a perpetrator to access protected information.

The vulnerability of the Cisco Vision Dynamic Signage Director digital content management web interface is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to gain access to protected information...

D-link DSR-250 输入验证错误漏洞

The D-Link DSR-250 is an 8-port Gigabit VPN router with dynamic Web content filtering. A command injection vulnerability exists in the Unified Services Router web interface of the D-Link DSR-250 3.17. The vulnerability stems from a lack of authentication of input provided in a multipart HTTP POST...