CVE-2019-1845

A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence Unified CM IM&P Service, Cisco TelePresence Video Communication Server VCS, and Cisco Expressway Series could allow an unauthenticated, remote attacker to cause a service outage for users...

CVE-2019-12500

The CVE-2019-12500 entry concerns the Xiaomi M365 scooter. The vulnerability is rooted in Bluetooth Low Energy commands lacking server-side authentication, enabling spoofing of critical controls such as a sudden acceleration, braking, locking, and unlocking. Affected firmware is prior to 1.5.1. D...

GHSA-G86P-HGX5-2PFH Improper Authentication in Buildbot

Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim...

Authentication flaw

A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiality, integrity, and availability when a remote attacker crafts a malicious request to the encoder webUI...

MGASA-2019-0176 Updated freeradius packages fix security vulnerability

An attacker can reflect the received scalar and element from the server in it's own commit message, and subsequently reflect the confirm value as well. This causes the adversary to successfully authenticate as the victim CVE-2019-11234. An invalid curve attack allows an attacker to authenticate a...

Blue Angel Software Suite - Command Execution Exploit

Exploit Title: Blue Angel Software Suite - Authenticated Command Execution Exploit Author: Paolo Serracino Vendor Homepage: http://www.5vtechnologies.com Software Link: N/A Version: All Tested on: Embedded Linux OS CVE : N/A Description: Blue Angel Software Suite, an application that runs on...

ALPINE-CVE-2019-9499

The implementations of EAP-PWD in wpasupplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection...

SUSE-SU-2019:0900-1 Security update for dovecot22

This update for dovecot22 fixes the following issues: Security issues fixed: - CVE-2019-7524: Fixed an improper file handling which could result in stack overflow allowing local root escalation bsc1130116. - CVE-2019-3814: Fixed a vulnerability related to SSL client certificate authentication...

HP Remote Graphics Software Trust Management Issues Vulnerability

HP Remote Graphics Software is a remote desktop graphics software from Hewlett-Packard HP. The software is primarily used for remote access to graphics-intensive applications and complex 3D models. A security vulnerability exists in the authentication process in HP Remote Graphics Softwares 7.5.0...

Security Advisory - Improper Authentication Vulnerability in Some Huawei AP Products

There is an improper authentication vulnerability in some Huawei AP products. Due to the improper implementation of authentication for the serial port, an attacker could exploit this vulnerability by connecting to the affected products and run a series of commands. Vulnerability ID:...

CVE-2019-1608 Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1608)

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker coul...

GPON Router Authentication Stack Overflow Vulnerability

GPON Gigabit-Capable PON technology is the latest generation of broadband passive optical integrated access standard based on the ITU-TG.984.x standard. Gigabit-Capable PON GPON technology is the latest generation of broadband passive optical integrated access standard based on ITU-TG.984.x...

CVE-2019-9124

An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password...

Insufficient Session Expiration of user sessions - CVE-2018-20238

Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration vulnerability...

CVE-2019-3584

McAfee MVision Endpoint vulnerable before 1811 Update 1 (18.11.31.62). A authentication flaw permits authenticated administrator users to remove MVision Endpoint via unspecified vectors. Affected product/version: MVision Endpoint prior to 1811 Update 1. Underlying cause: authentication-based acce...

CVE-2019-3584 Exploitation of Authentication vulnerability

Exploitation of Authentication vulnerability in MVision Endpoint in McAfee MVision Endpoint Prior to 1811 Update 1 18.11.31.62 allows authenticated administrator users -- administrators to Remove MVision Endpoint via unspecified vectors...

CVE-2018-20735

An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if...

Design/Logic Flaw

The TIBCO Spotfire authentication component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability in the handling of the authentication that theoretically may allow an attacker to gain full access to a target account,...

Information Disclosure

openstack-ironic is vulnerable to information disclosure. An authentication vulnerability was found in openstack-ironic. A client with network access to the ironic-api service could bypass OpenStack Identity authentication, and retrieve all information about any node registered with OpenStack Bar...

etcd 3.2.x, 3.3.x Authentication Vulnerability

etcd is vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...