ManageEngine Desktop Central 权限许可和访问控制问题漏洞

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A privilege permissio...

Mageia: Security Advisory (MGASA-2014-0327)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Insecure Access Control

shenyu has insecure access control. The vulnerability exists due to a lack of validation of the user access via the /plugin api allowing an attacker to access the system without authentication...

The vulnerability of NETGEAR’s Wi-Fi router software, including models CBR750, RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850, stems from deficiencies in authentication mechanisms. This allows attackers to circumvent security restrictions.

The vulnerability of Wi-Fi router microprogramming software from NETGEAR, including models CBR750, RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850, is related to deficiencies in authentication mechanisms. Exploiting this vulnerability could allow a malicious actor to circumvent security...

CVE-2021-33846

Fresenius Kabi Vigilant Software Suite Mastermed Dashboard version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitrary users...

PT-2022-9375 · Unknown · Agilia Link+

Name of the Vulnerable Software and Affected Versions: Agilia Link+ version 3.0 Description: The web application implements authentication and session management mechanisms exclusively on the client-side and does not protect authentication attributes sufficiently. Recommendations: For Agilia Link...

Red Hat Satellite 授权问题漏洞

Red Hat Satellite is a system management platform from Red Hat. The platform can be used to extend Linux infrastructures and provide system management functions such as administration, configuration, and monitoring. Red Hat Satellite has an authorization issue vulnerability that stems from Red Ha...

Default credentials

In the case of instances where the SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to...

PT-2022-1639 · Zabbix +1 · Zabbix +1

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the SAML SSO authentication in Zabbix. When SAML SSO authentication is enabled, a malicious actor can modify session data because the user login stored in the session...

CVE-2021-20148

ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another...

CVE-2021-45917

The server-request receiver function of Shockwall system has an improper authentication vulnerability. An authenticated attacker of an agent computer within the local area network can use the local registry information to launch server-side request forgery SSRF attack on another agent computer,...

CVE-2021-45917

CVE-2021-45917 describes an improper authentication vulnerability in the server-request receiver function of the Shockwall system by Sun & Moon Rise. An authenticated attacker on an agent computer in the local network can use local registry information to perform a server-side request forgery (SS...

Stack overflow

A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2021-21879

A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary file overwrite. An attacker can make an authenticated HTTP request to trigger this vulnerability...

The vulnerability of the software for the Zoho ManageEngine SupportCenter Plus service lies in its authentication procedures. This vulnerability allows a perpetrator to bypass the authentication process and gain unauthorized access to the device.

The vulnerability of the Zoho ManageEngine SupportCenter Plus software lies in its authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and gain unauthorized access to the device...

Read-Only LDAP Authentication Bypass Vulnerability in Lenovo XClarity Controller (XCC) Firmware - Lenovo Support US

No description provided...

CVE-2021-44966

SQL injection bypass authentication vulnerability in PHPGURUKUL Employee Record Management System 1.2 via index.php. An attacker can log in as an admin account of this system and can destroy, change or manipulate all sensitive information on the system...

CVE-2021-44966

SQL injection bypass authentication vulnerability in PHPGURUKUL Employee Record Management System 1.2 via index.php. An attacker can log in as an admin account of this system and can destroy, change or manipulate all sensitive information on the system...

The vulnerability of the mechanism for verifying the authenticity of TLS connections on Apache Traffic Server allows a perpetrator to carry out a type of “man-in-the-middle” attack.

The vulnerability of the TLS authentication verification mechanism of the Apache Traffic Server web server is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a remote attacker to carry out a “man-in-the-middle” attack...

Cybele Software Thinfinity VirtualUI授权问题漏洞

Cybele Software Thinfinity VirtualUI is a solution from Cybele Software, Inc. that supports embedding remote Windows applications into standard web applications to allow two-way interaction with Javascript programming. A security vulnerability exists in Cybele Software Thinfinity VirtualUI, which...