3086 matches found
Microsoft Exchange Server Request Forgery Vulnerability
Exchange is a messaging and collaboration system that is a suite of e-mail service components from Microsoft. Microsoft Exchange Server request forgery vulnerability can be exploited by an attacker to be able to send arbitrary HTTP requests and authenticate with Exchange Server...
Microsoft Exchange Server Arbitrary File Write Vulnerability (CNVD-2021-14810)
Exchange is a messaging and collaboration system that is a suite of e-mail service components from Microsoft. Microsoft Exchange Server Arbitrary File Write Vulnerability. An attacker can exploit this vulnerability to write a file to any path on the server after authenticating through the Exchang...
CVE-2021-27878
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to ga...
UBUNTU-CVE-2021-3144
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. They might be used to run command against the salt master or minions...
The vulnerability of Google Chrome’s web browser extensions, which allows a hacker to bypass existing security restrictions
The vulnerability of Google Chrome web browser extensions is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions through a specially created Chrome extension...
Siemens SIMATIC WinCC Bypass Authentication Vulnerability
Siemens SIMATIC WinCC is an automated data acquisition and monitoring SCADA system from Siemens, Germany. A security vulnerability exists in Siemens SIMATIC WinCC. The vulnerability is caused due to an insecure password authentication process, which can be exploited by an attacker to bypass the...
Pi-hole 授权问题漏洞
Pi-hole is a multi-platform, network-wide ad-blocking tool. A session fixation vulnerability exists in Pi-hole 5.0, 5.1, 5.1.1. The vulnerability stems from the application failing to generate a new session cookie after a user logs in.An attacker can exploit this vulnerability to gain access to...
CVE-2020-35559
MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 (up to version 2.6.2) contain an unused function that allows an authenticated attacker to exhaust all available IPs for an account, preventing creation of new devices and users. This is categorized as Uncontrolled Resource Consumption (CWE-400). The C...
IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x <= 8.5.5.18 / 9.0.x <= 9.0.5.5 Directory Traversal (CVE-2020-4782)
The IBM WebSphere Application Server running on the remote host is version 7.0.0.0 through 7.0.0.45, 8.0.0.0 through 8.0.0.15, 8.5.0.x through to 8.5.5.18, or 9.0.x through to 9.0.5.5. It is, therefore, affected by a directory traversal vulnerability. An authenticated, remote attacker can exploit...
CVE-2020-13185
Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify authentication tokens, which allowed an attacker in the ability to execute sensitive functions without credentials...
FiberHome HG6245D devices 信任管理问题漏洞
The HG6245D is an FTTH ONT router from FiberHome. A hard-coded credentials vulnerability exists in the FiberHome HG6245D. The vulnerability stems from the web daemon containing hardcoded admin/8888888 credentials against an ISP. No details of the vulnerability are provided at this time...
JetBrains Hub Open Redirect Vulnerability
JetBrains Hub is a server that can handle authentication, authorization, users, groups, permissions, and projects across multiple JetBrains Team Tools installations. An open redirection vulnerability exists in JetBrains Hub versions prior to 2020.1.12629. No detailed vulnerability details are...
CVE-2021-25910
Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several parameters of the affected device as an authenticated user...
Cisco Content Security Management Appliance Information Disclosure (cisco-sa-esa-wsa-sma-info-RHp44vAC)
According to its self-reported version, Cisco Content Security Management Appliance SMA is affected by a vulnerability in the authentication for the general purpose APIs due to the absence of a secure authentication token requirement when authenticating to the general purpose API. An...
CVE-2021-20187
CVE-2021-20187 affects Moodle prior to versions 3.10.1, 3.9.4, 3.8.7 and 3.5.16. The issue allows site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication. The connected documents confirm the vulnerable condition and the root cause, but do not p...
CVE-2021-25312
HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS authentication method...
IBM Security Identity Governance Authentication Vulnerability
IBM Security Identity Governance and Intelligence IGI is a suite of identity management and governance solutions from IBM in the United States. The product includes features such as lifecycle management, access risk assessment and identity management. An authentication vulnerability exists in IBM...
Cisco Data Center Network Manager Server-Side Request Forgery Vulnerability
Cisco Data Center Network Manager DCNM is a suite of data center network managers from Cisco that provides multiprotocol management of the network and troubleshooting of switch operating conditions and performance. A server-side request forgery vulnerability exists in the session authentication...
CVE-2021-1129
The CVE-2021-1129 vulnerability affects Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA). Root cause: missing requirement for a secure authentication token when accessing the general purpose APIs, allowing an unauthent...
