CVE-2021-21538

Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access to the virtual console. Recent assessments: Assessed Attacker Value: 0 Assessed...

GHSA-72W9-FCJ5-3FCG Improper Authentication in Apache Shiro

Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass...

CVE-2020-36333

themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a resetwizardactions hook...

Check Point Response to CVE-2021-21538 - Dell iDRAC9 improper authentication vulnerability

Symptoms - Dell published CVE-2021-21538 for iDRAC9 versions 4.40.00.00 and later, but lower than 4.40.10.00 - A remote unauthenticated attacker could potentially exploit this authentication vulnerability to gain access to the virtual console Solution Important Note: If you have not enabled iDRAC...

CVE-2021-21544

Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to manipulate the username field under the comment section and set the value to any user...

PT-2021-14594 · Dell Emc · Idrac9

Name of the Vulnerable Software and Affected Versions: Dell EMC iDRAC9 versions prior to 4.40.00.00 Description: The issue concerns an improper authentication vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this to manipulate the username field...

Dell EMC iDRAC9 授权问题漏洞

Dell EMC iDRAC9 is a system management solution comprising hardware and software from Dell USA. The solution provides remote management, crash system recovery and power control for Dell PowerEdge systems. An authentication error vulnerability exists in Dell EMC iDRAC9 versions prior to 4.40.00.00...

CVE-2021-25898

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when accessing the svc-login.php file. The value is used to authenticate a high-privileged user upon authenticating with the server...

CVE-2020-28973

The ABUS Secvest FUAA50000 system (v3.01.17) contains an authentication flaw in its built‑in HTTPS interface that can disclose sensitive credentials (e.g., usernames and passwords). An attacker can use this to reconfigure or disable the alarm system. The root cause is described as improper authen...

PT-2021-18225 · Npm · A12Nserver

Name of the Vulnerable Software and Affected Versions: a12n-server versions 0.18.0 through 0.18.1 Description: The issue concerns a12n-server, an npm package for simple authentication. A feature to edit users via a new HAL-Form was introduced in version 0.18.0 but was incorrectly made accessible ...

The vulnerability of Huawei’s microprogrammed router software, related to authentication errors, allows attackers to escalate their privileges, execute arbitrary code, or cause service failures.

The vulnerability of Huawei’s microprogrammed router software is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to increase their privileges, execute arbitrary code, or cause service failures...

The vulnerability of the Apache TomEE application server, related to authentication errors, allows attackers to escalate their privileges, execute arbitrary code, or cause service failures.

The vulnerability of the Apache TomEE application server is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to increase their privileges, execute arbitrary code, or cause service failures...

NetIQ Advanced Authentication 授权问题漏洞

NetIQ Advanced Authentication is an application from NetIQ UK. It provides a move away from usernames and passwords to a more secure way to protect your sensitive information. A security vulnerability previously existed in Advanced Authentication version 6.3 SP4, which stemmed from an improper...

SonicWall Email Security post-authentication arbitrary file creation vulnerability

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host. CVE: CVE-2021-20022 Last updated: April 9, 2021, 10:03 p.m...

OAuth2 Proxy Access Control Error Vulnerability

OAuth2 Proxy is a reverse proxy that provides authentication with Google, Github or other providers. OAuth2 Proxy suffers from an access control error vulnerability that stems from the fact that none of the authorizations are restricted. No details of the vulnerability are available at this time...

MikroTik RouterOS 命令注入漏洞

MikroTik RouterOS is a Linux-based router operating system developed by the Latvian company MikroTik. The system can be deployed in a PC to enable it to provide router functionality. A security vulnerability exists in MikroTik RouterOS version 6.47.9 that allows remote authenticated ftp users to...

CVE-2021-28374

The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowing an attacker to read user information. This may include a cleartext password in some configurations. In general, it includes the user's...

SonicWall SMA100 post-authentication configuration export to the a specified email address

A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. This vulnerability impacts SMA100 version 10.2.0.5 and earlier. CVE: CVE-2021-20018 Last updated: March 13, 2021, 1:19 a.m...

Red Hat Keycloak Access Control Error Vulnerability (CNVD-2021-19376)

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that stems from a re-authentication not occurring when a password is updated. An attacker...

CVE-2021-25315 salt-api unauthenticated remote code execution

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior t...