CVE-2024-10776 SICK InspectorP61x and SICK InspectorP62x: missing authentication

Lua apps can be deployed, removed, started, reloaded or stopped without authorization via AppManager. This allows an attacker to remove legitimate apps creating a DoS attack, read and write files or load apps that use all features of the product available to a customer...

CVE-2024-11022 SICK InspectorP61x and SICK InspectorP62x are vulnerable for a replay attack

The authentication process to the web server uses a challenge response procedure which inludes the nonce and additional information. This challenge can be used several times for login and is therefore vulnerable for a replay attack...

CVE-2024-11022 SICK InspectorP61x and SICK InspectorP62x are vulnerable for a replay attack

The authentication process to the web server uses a challenge response procedure which inludes the nonce and additional information. This challenge can be used several times for login and is therefore vulnerable for a replay attack...

CVE-2024-11339

The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11323

CVE-2024-11323 affects the WordPress plugin AI Quiz | Quiz Maker (≤1.1). The root cause is a missing capability check in ai_quiz_update_style(), allowing authenticated users with Subscriber+ privileges to modify arbitrary options and potentially escalate to admin by changing default registration ...

QNAP Systems QTS和QuTS hero 安全漏洞

QNAP Systems QTS and QNAP Systems QuTS hero are both products of China Weilian Technology QNAP Systems, Inc.QNAP Systems QTS is an entry operating system.QNAP Systems QuTS hero is an operating system. A security vulnerability exists in QNAP Systems QTS and QuTS hero that stems from the inclusion ...

SonicWALL SMA100 安全漏洞

The SonicWALL SMA100 is a security access gateway device from SonicWALL USA. A security vulnerability exists in the SonicWALL SMA100. An authenticated, remote attacker could exploit the vulnerability to bypass certificate requirements during authentication...

QNAP Notes Station 3 Authentication Missing Vulnerability

QNAP Notes Station 3 is a private cloud notes software that runs on QNAP NAS devices and supports real-time multi-person collaboration, version control, data encryption and snapshot backup. QNAP Notes Station 3 suffers from an authentication missing vulnerability that stems from the inclusion of ...

Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras Use of Password Hash Instead of Password For Authentication (CVE-2017-7927)

A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH- IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC- HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH- HCVR5XXX,...

Devolutions Server 安全漏洞

Devolutions Server is an application from Devolutions Canada Inc. which provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2024.3.6.0 and prior versions, which stems from incorrect authorization of the Privilege...

Schneider Electric IONXXXX Series Power Meter Improper Access Control (CVE-2016-5815)

An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. No authentication is configured by default. An unauthorized user can access the device management portal and make...

Cisco Unified Computing System Command Injection (CVE-2017-12341)

A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. An attacker would need valid administrator credentials to perform this exploit. The vulnerability is due to insufficient input validation during the...

CVE-2024-11680

ProjectSend exposes an improper authentication/authorization vulnerability that affects versions prior to r1720 (r1605 and older per sources). An unauthenticated remote attacker can exploit crafted requests to options.php to modify configuration, enabling account creation, file uploads (including...

The vulnerability of the application software interface of the Cisco Nexus Dashboard Fabric Controller (NDFC) lies in the lack of authentication, which allows a malicious actor to influence the integrity and accessibility of the protected information.

The vulnerability of the application programming interface of the Cisco Nexus Dashboard platform for analyzing and automating operations in cloud computing data centers is related to the lack of authentication. Exploiting this vulnerability could allow a malicious actor to influence the integrity...

PT-2024-9119 · Hewlett Packard · Hpe Autopass License Server

Name of the Vulnerable Software and Affected Versions: Hewlett Packard Enterprise AutoPass License Server affected versions not specified Description: The issue is related to weaknesses in the authentication procedure of the HPE AutoPass License Server software. This allows a remote attacker to...

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway...

Exploit for CVE-2023-38646

Metabase Pre-Authentication RCE CVE-2023-38646 CVE-2023-38...

CVE-2024-47865

Missing authentication for critical function vulnerability exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote unauthenticated attacker may update or downgrade the firmware on the device...

Rockwell Automation ThinManager ThinServer Missing Authentication (CVE-2024-10386)

Binary data rockwellthinmanagerthinservercve-2024-10386.nbin...

CVE-2024-47533

CVE-2024-47533 – Cobbler XML-RPC Authentication Bypass : The issue arises in Cobbler’s XML-RPC interface where utils.get_shared_secret() can return -1, allowing unauthenticated access with empty username and password -1. Affected versions are 3.0.0 up to but not including 3.2.3 and 3.3.0 up to 3....