3093 matches found
CVE-2016-2124
A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required...
Code injection
PHP Everywhere = 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated user...
Synology DiskStation Manager 操作系统命令注入漏洞
Synology Mail Station provides you with webmail service to access emails stored on your DiskStation. An OS command injection vulnerability exists in Synology Mail Station, which allows remote attackers to exploit the vulnerability to authenticate users to execute arbitrary commands via unspecifie...
Schneider Electric Modicon Improper Authentication (CVE-2012-0931)
Schneider Electric Modicon Quantum PLC does not perform authentication between the Unity software and PLC, which allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors. This plugin only works with Tenable.ot. Please visit...
ManageEngine Desktop Central 权限许可和访问控制问题漏洞
ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A privilege permissio...
Mageia: Security Advisory (MGASA-2014-0327)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Insecure Access Control
shenyu has insecure access control. The vulnerability exists due to a lack of validation of the user access via the /plugin api allowing an attacker to access the system without authentication...
The vulnerability of NETGEAR’s Wi-Fi router software, including models CBR750, RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850, stems from deficiencies in authentication mechanisms. This allows attackers to circumvent security restrictions.
The vulnerability of Wi-Fi router microprogramming software from NETGEAR, including models CBR750, RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850, is related to deficiencies in authentication mechanisms. Exploiting this vulnerability could allow a malicious actor to circumvent security...
CVE-2021-33846
Fresenius Kabi Vigilant Software Suite Mastermed Dashboard version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitrary users...
PT-2022-9375 · Unknown · Agilia Link+
Name of the Vulnerable Software and Affected Versions: Agilia Link+ version 3.0 Description: The web application implements authentication and session management mechanisms exclusively on the client-side and does not protect authentication attributes sufficiently. Recommendations: For Agilia Link...
Red Hat Satellite 授权问题漏洞
Red Hat Satellite is a system management platform from Red Hat. The platform can be used to extend Linux infrastructures and provide system management functions such as administration, configuration, and monitoring. Red Hat Satellite has an authorization issue vulnerability that stems from Red Ha...
Default credentials
In the case of instances where the SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to...
PT-2022-1639 · Zabbix +1 · Zabbix +1
Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the SAML SSO authentication in Zabbix. When SAML SSO authentication is enabled, a malicious actor can modify session data because the user login stored in the session...
CVE-2021-20148
ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another...
CVE-2021-45917
The server-request receiver function of Shockwall system has an improper authentication vulnerability. An authenticated attacker of an agent computer within the local area network can use the local registry information to launch server-side request forgery SSRF attack on another agent computer,...
CVE-2021-45917
CVE-2021-45917 describes an improper authentication vulnerability in the server-request receiver function of the Shockwall system by Sun & Moon Rise. An authenticated attacker on an agent computer in the local network can use local registry information to perform a server-side request forgery (SS...
Stack overflow
A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2021-21879
A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary file overwrite. An attacker can make an authenticated HTTP request to trigger this vulnerability...
The vulnerability of the software for the Zoho ManageEngine SupportCenter Plus service lies in its authentication procedures. This vulnerability allows a perpetrator to bypass the authentication process and gain unauthorized access to the device.
The vulnerability of the Zoho ManageEngine SupportCenter Plus software lies in its authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and gain unauthorized access to the device...
