ADiTaaS Authorization Issues Vulnerabilities

ADiTaaS is a service management platform from ADiTaaS, Inc. A security vulnerability exists in ADiTaaS version 5.1 that stems from the presence of an incorrect authentication vulnerability. A remote attacker could exploit the vulnerability by sending a specially crafted HTTP request to gain full...

CVE-2023-50089

A Command Injection vulnerability exists in NETGEAR WNR2000v4 version 1.0.0.70. When using HTTP for SOAP authentication, command execution occurs during the process after successful authentication...

Red Hat Keycloak Input Validation Error Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak, which stems from a flaw in the redirecturi authentication logic, which could allow a host ...

CVE-2023-45801

Improper Authentication vulnerability in Nadatel DVR allows Information Elicitation.This issue affects DVR: from 3.0.0 before 9.9.0...

CVE-2018-16153

An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary external services in some situations...

The vulnerability of the authentication function of ASUS RT-AX55 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the authentication function of ASUS RT-AX55 router software exists due to the failure to take measures to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the UDR-A authentication function in microprogrammed control devices like Red Lion SixTRAK and VersaTRAK allows attackers to execute arbitrary commands with administrative privileges.

The vulnerability of the UDR-A authentication function in microprogrammed control devices like Red Lion SixTRAK and VersaTRAK is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary commands wit...

CVE-2023-34388 Improper authentication could lead to session hijacking

An Improper Authentication vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote unauthenticated attacker to potentially perform session hijacking attack and bypass authentication. See product Instruction Manual Appendix A dated 20230830 for more details...

Schweitzer Engineering Laboratories SEL-411L Authorization Issue Vulnerability

The Schweitzer Engineering Laboratories SEL-411L is a state-of-the-art line differential protection, automation and control system from Schweitzer Engineering Laboratories, USA. A security vulnerability exists in the Schweitzer Engineering Laboratories SEL-411L that stems from the presence of an...

CVE-2023-29061 Lack of Adequate BIOS Authentication

There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this vulnerability to access the BIOS configuration and modify the drive boot order and BIOS pre-boot authentication...

CVE-2023-3104 Missing Authentication for Critical Function in Unitree Robotics A1

Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication...

Adobe FrameMaker 授权问题漏洞

Adobe Framemaker is the United States of America Odooby Adobe company's set of page layout software for writing and editing large or complex documents including structured documents. An authentication error vulnerability exists in Adobe FrameMaker version 2022 and prior versions, which stems from...

CVE-2023-47674

CVE-2023-47674 describes a missing authentication for a critical function in First Corporation’s DVRs, enabling a remote, unauthenticated attacker to rewrite or retrieve device configuration. Public details confirm affected models: late-model CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, an...

CVE-2023-47674

Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB...

python: TLS handshake bypass

Python ssl.SSLSocket is vulnerable to a bypass of the TLS handshake in certain instances for HTTPS servers and other server-side protocols that use TLS client authentication such as mTLS. This issue may result in a breach of integrity as its possible to modify or delete resources that are...

CVE-2021-43609

An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the orderbyforticket function in app/models/reporting/databasequery.rb allows an authenticated attacker to execute arbitrary SQL commands via the sort parameter. This can be...

CVE-2023-42554

Improper Authentication vulnerabiity in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication...

Mitsubishi Electric MELSEC iQ-F series Security Vulnerability

The Mitsubishi Electric MELSEC iQ-F series is a programmable logic controller from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric MELSEC iQ-F Series that stems from an improperly restricted authentication function...

CVE-2023-41345

ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the...

CVE-2023-41347

ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system...