CloudBees Jenkins SonarQube Scanner Plugin Authentication Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. It is mainly used to monitor continuous software release/testing projects and some timed tasks.SonarQube Scanner Plugin is a plugin used in the scanning and checking the qualit...

CVE-2019-0543

An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012,...

Siemens TIM 1531 IRC Authentication Vulnerability

The Siemens TIM 1531 IRC is a communication module from Siemens, Germany. A security vulnerability exists in the Siemens TIM 1531 IRC prior to version 2.0, which originates from the device failing to properly authenticate itself when connecting on port 102/tcp. An attacker could use this...

Sql injection

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter...

USN-3795-3: libssh regression

USN-3795-1 and USN-3795-2 fixed a vulnerability in libssh. The upstream fix introduced a regression. This update fixes the problem. Original advisory details: Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this...

CVE-2018-17922

CVE-2018-17922 affects Circontrol CirCarLife: all versions before 4.3.1. The PAP credentials are stored in clear text in a log file that is accessible without authentication, enabling credential exposure. NVD lists a CVSSv3 base score of 9.8 (CRITICAL) with remote, unauthenticated access and impa...

Nextcloud Server Privilege Authentication Vulnerability

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform.Nextcloud Server is one of the server version. A privilege authentication vulnerability exists in versions of Nextcloud Server prior to 14.0.0, which can be exploited by an attacker t...

Nextcloud Server Privilege Authentication Vulnerability (CNVD-2019-18774)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform.Nextcloud Server is one of the server version. A privilege validation vulnerability exists in versions of Nextcloud Server prior to 14.0.0 that can be exploited by an attacker to bypa...

CVE-2018-18891

MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late...

CURL-CVE-2018-16839 SASL password overflow via integer overflow

libcurl contains a buffer overrun in the SASL authentication code. The internal function Curlauthcreateplainmessage fails to correctly verify that the passed in lengths for name and password are not too long, then calculates a buffer size to allocate. On systems with a 32-bit sizet, the math to...

CVE-2018-13400

Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version...

SUSE-SU-2018:3311-1 Security update for pam_pkcs11

This update for pampkcs11 provides the following fixes: Security issues fixed bsc1105012: - Fixed a logic bug in pampkcs11.c, leading to an authentication replay vulnerability - Fixed a stack-based buffer overflow in opensshmapper.c - Make sure memory is properly cleaned before invoking free Othe...

Authentication flaw

A vulnerability in the authentication and authorization checking mechanisms of Cisco Wireless LAN Controller WLC Software could allow an authenticated, adjacent attacker to gain network access to a Cisco TrustSec domain. Under normal circumstances, this access should be prohibited. The...

GHSA-J84C-J8QM-G47R The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...

Discourse: Account takeover at https://try.discourse.org due to no CSRF protection in connecting Yahoo account

Hi There is an option in https://try.discourse.org/u/testh1ay/preferences/account to connect our Yahoo account. I noticed Connect Yahoo account option have the workflow with GET method and there is lack of csrf protection on connecting yahoo account which can help attacker into inducing victim to...

IBM Security Key Lifecycle Manager Authentication Missing Vulnerability

IBM Security Key Lifecycle Manager centralizes, simplifies and automates the encryption key management process, helping to minimize the risks and operational costs of encryption key management. An authentication missing vulnerability exists in IBM Security Key Lifecycle Manager. An unauthenticate...

CVE-2018-16738

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1...

CVE-2018-16738

tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1...

CVE-2018-0463

A vulnerability in the Cisco Network Plug and Play server component of Cisco Network Services Orchestrator NSO could allow an unauthenticated, remote attacker to gain unauthorized access to configuration data that is stored on an affected NSO system. The vulnerability exists because the Network...