CVE-2019-16790

In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted...

Apple macOS Mojave EFI Component Authentication Vulnerability

Apple macOS Mojave is the operating system for Apple's line of Mac computers. An authentication vulnerability exists in the state management of the EFI component of Apple macOS Mojave, which can be exploited by an attacker to log in to another user account...

CVE-2019-18261

In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks...

CVE-2019-18261

In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks...

CVE-2014-8650

python-requests-Kerberos through 0.5 does not handle mutual authentication...

MGASA-2019-0385 Updated proftpd packages fix security vulnerability

An issue was discovered in tlsverifycrl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL skX509REVOKEDvalue function when encountering an empty CRL installed by a system administrator. The dereference occurs when validating the...

CVE-2019-5061

An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has completed. This could lead to different denial of service scenarios, either by causing CAM table...

UBUNTU-CVE-2019-13456

In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is...

CVE-2019-3424

authentication issues vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices. An attacker can automatically obtain access to web services from the authorized browser of the same computer and perform operations...

CVE-2019-5213

Honor play smartphones with versions earlier than Cornell-AL00A 9.1.0.321C00E320R1P1T8 have an insufficient authentication vulnerability. The system has a logic judge error under certain scenario. Successful exploit could allow the attacker to modify the alarm clock settings after a serious of...

CVE-2019-1384

A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability, an attacker could send a specially crafted authentication request, aka 'Microsoft Windows Security Feature Bypass Vulnerability'...

CVE-2011-4628

TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request...

Apple iOS < 13.2 Multiple Vulnerabilities

Binary data appleios132check.nbin...

CVE-2019-18226

CVE-2019-18226 affects Honeywell equIP series and Performance series IP cameras and Recorders. The root cause is an authentication bypass via capture-replay, retained for legacy compatibility, enabling unauthenticated access and potential playback attacks (per CVSS v3 base 7.5). Public disclosure...

The vulnerability of the microprogramming software used in Allen Bradley programmable logic controllers from Rockwell Automation relates to deficiencies in authentication procedures, allowing an intruder to execute arbitrary code.

The vulnerability of the microprogramming software used in Allen Bradley programmable logic controllers from Rockwell Automation is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code by...

Authentication flaw

The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP in cleartext that can be sniffed by unauthorized actors. Basic authentication is used for the authentication, making it possible to base64 decode the sniffed credentials and discover the username and...

CVE-2019-17187

/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication Directory Traversal for reading arbitrary files...

Regular Expression Denial of Service vulnerability of WEBrick's Digest access authentication

Regular expression denial of service vulnerability of WEBrick’s Digest authentication module was found. An attacker can exploit this vulnerability to cause an effective denial of service against a WEBrick service...

CVE-2019-3746

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system...

CVE-2019-3766

Dell EMC ECS CVE-2019-3766 affects Dell EMC ECS versions prior to 3.4.0.0 and is due to an improper restriction of excessive authentication attempts. An unauthenticated remote attacker could perform a password brute-force to gain access to targeted accounts. The vulnerability is rated HIGH/CRITIC...