CVE-2022-37422

Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded...

PT-2022-17958

Name of the Vulnerable Software and Affected Versions: Sequi PortBloque S affected versions not specified Description: The issue is related to improper authentication, which may allow an attacker to bypass the authentication process and gain user-level access to the device. Recommendations: At th...

The vulnerability of the Jenkins Compuware ISPW Operations Plugin, related to deficiencies in authentication procedures, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Jenkins Compuware ISPW Operations Plugin is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the WS-UsernameToken authentication mechanism in Dahua cameras, related to the possibility of intercepting ONVIF requests. Exploiting this vulnerability could allow a malicious actor to gain full access to the IP camera.

The vulnerability of the WS-UsernameToken authentication mechanism in Dahua IP cameras lies in the ability to intercept ONVIF requests. Exploiting this vulnerability could allow a malicious actor to gain full access to the IP camera...

@newskit-render/auth (>=0.5.1 <=0.31.0), @newskit-render/core (>=0.57.0 <=1.40.0) +4 more potentially affected by CVE-2022-35924 via next-auth (>=0.0.0-manual.83c4ebd1 <=3.1.0)

next-auth NPM version =0.0.0-manual.83c4ebd1, =0.5.1, =0.57.0, =0.35.0, =1.1.0, =0.0.1, =0.0.5 Source cves: CVE-2022-35924 Source advisory: OSV:GHSA-XV97-C62V-4587...

CVE-2022-29957

The Emerson DeltaV Distributed Control System DCS through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety of functionality. These protocols include Firmware upgrade 18508/TCP, 18518/TCP; Plug-and-Play 18510/UDP; Hawk services 18507/UDP; Managemen...

CVE-2022-20893 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

CVE-2022-2141

SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication...

Oracle MySQL 输入验证错误漏洞

Oracle MySQL is an open source relational database management system from Oracle Corporation. MySQL Server is one of the database server components, and an input validation error vulnerability exists in Oracle MySQL 8.0.28 and earlier versions, which originates in the PAM Auth component of MySQL...

PT-2022-3718 · Apache · Apache Cloudstack

Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions 4.5.0 and later Description: The issue is related to the SAML 2.0 authentication Service Provider plugin in Apache CloudStack, which is vulnerable to XML external entity XXE injection attacks. This plugin is not...

FlyteAdmin 代码问题漏洞

FlyteAdmin is a control plane for Flyte open source. It is responsible for managing entities tasks, workflows, startup plans and managing workflow execution. A code issue vulnerability exists in FlyteAdmin versions prior to 1.1.30, which stems from the fact that authenticated users using an...

CVE-2022-20768 Cisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure Vulnerability

A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint CE and RoomOS Software could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to the storage of certain unencrypted credentials...

The vulnerability of the Slurm resource manager management module, related to deficiencies in authentication procedures, allows attackers to circumvent existing security restrictions.

The vulnerability of the Slurm resource manager is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions from a remote location...

Nakama 安全漏洞

Nakama is a distributed server for social and real-time games and applications. A security vulnerability exists in Nakama version 3.12.0 that stems from the fact that the Nakama console does not have any limit on the number of unsuccessful login attempts within a short period of time...

CVE-2022-28713

CVE-2022-28713 describes an improper authentication vulnerability in the Scheduler component of Cybozu Garoon, allowing a remote attacker to obtain some Facility Information data without logging in. Affected software: Cybozu Garoon versions 4.0.0 through 5.5.1 (per multiple connected sources) wit...

passport 授权问题漏洞

passport is an Express-compatible Node.js authentication middleware from Jared Hanson, an individual developer in the United States. A security vulnerability exists in passport, which stems from the fact that when a user logs in or logs out, the session is regenerated instead of being closed...

CVE-2022-23717

PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of authentication...

IBM Spectrum Protect Server 安全特征问题漏洞

IBM Spectrum Protect Server is a spectrum protection system from IBM USA, Inc. providing comprehensive data resiliency for physical file servers, virtual environments, and a wide range of applications.IBM Spectrum Protect Server versions 8.1.0.000 through 8.1.14 have a security feature issue...

The vulnerability of many protocols in the Ovation distributed system management framework stems from deficiencies in the authentication process. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of many protocols in the Ovation distributed system management framework is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and even cause service...

SOFTCREATE L2Blocker authentication error vulnerability

SOFTCREATE L2Blocker is a device type security system from SOFTCREATE Japan. It detects and blocks unauthorized connections from network devices to the internal network to prevent information leakage.An authentication error vulnerability exists in SOFTCREATE L2Blockeron-premise version 4.8.5 and...