963 matches found
Authentication flaw
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IGSS due to lack of validation of network messages. Affected Product: Interactive Graphical SCADA System Data Collector dc.exe V15.0.0.21320...
CVE-2021-22823
CVE-2021-22823 affects Schneider Electric IGSS Interactive Graphical SCADA System Data Collector (dc.exe) on v15.0.0.21320 and earlier. It is a CWE-306 Missing Authentication for Critical Function vulnerability caused by lack of validation of network messages, which could lead to deletion of arbi...
The vulnerability of the graphical interface of the Apache APISIX Dashboard cloud API gateway lies in the lack of authentication for a critical function, allowing attackers to bypass the authentication process.
The vulnerability of the graphical interface of the Apache APISIX Dashboard cloud API gateway is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow a malicious actor to bypass the authentication process...
Authentication flaw
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manner when an attacker attempts to modify the touch configurations. Affected Product: spaceLYnk V2.6.2 and prior, Wiser for KNX formerly...
CVE-2022-22809
CVE-2022-22809 describes a CWE-306 Missing Authentication for Critical Function affecting Schneider Electric spaceLYnk, Wiser for KNX (formerly homeLYnk), and fellerLYnk, all with version 2.6.2 and prior. The issue allows unauthorized modification of touch configurations due to missing authentica...
Siemens SICAM MMU, SICAM T, and SICAM SGU Missing Authentication For Critical Function (CVE-2020-10044)
A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. An attacker with access to the network could be able to install specially crafted firmware to the device. This plugin only works with Tenable.ot. Please visit...
Schneider Electric Modicon Controllers Uncaught Exception (CVE-2019-6808)
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a remote code execution by overwriting configuration settings of the controller over Modbus. This plugin only works with Tenable.ot...
CVE-2021-26264 Emerson DeltaV Missing Authentication for Critical Function
A specially crafted script could cause the DeltaV Distributed Control System Controllers All Versions to restart and cause a denial-of-service condition...
CVE-2021-26264 Emerson DeltaV Missing Authentication for Critical Function
A specially crafted script could cause the DeltaV Distributed Control System Controllers All Versions to restart and cause a denial-of-service condition...
Non-transferable critical privileged role
Handle gzeon Vulnerability details Impact DEPLOYER is a constant in Manager and it is the only role that can call setSherlockCoreAddress to change sherlockCore address. Consider this is a critical function and there might be a need to change the deplorer address in the future e.g. governance...
Missing Authentication for Critical Function in Apache NiFi
In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token one-time password mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens,...
GHSA-3PP3-77J6-8PH6 Missing Authentication for Critical Function in Apache NiFi
In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token one-time password mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens,...
Exploit for Missing Authentication for Critical Function in Apache Apisix_Dashboard
CVE-2021-45232-RCE CVE-2021-45232-RCE – Multi-threaded batch...
CVE-2021-36779
A Missing Authentication for Critical Function vulnerability in SUSE Longhorn allows any workload in the cluster to execute any binary present in the image on the host without authentication. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3...
Authentication flaw
A Missing Authentication for Critical Function vulnerability in SUSE Longhorn allows any workload in the cluster to execute any binary present in the image on the host without authentication. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3...
CVE-2021-36780 Unauthorized data access from replicas through vulnerable instance manager pods
A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance granting it the ability to read and write data to and from a replica that they should not have access to. This issue affects: SUSE Longhorn...
CVE-2021-36779
CVE-2021-36779 is a Missing Authentication for Critical Function in SUSE Longhorn. Affected: Longhorn before 1.1.3 and before 1.2.3. Root cause: lack of authentication allows any workload to execute binaries in an image on the host. Impact: workload compromise of host binaries across the cluster....
PT-2021-21352 · Suse · Longhorn
Name of the Vulnerable Software and Affected Versions: SUSE Longhorn longhorn versions prior to 1.1.3 longhorn versions prior to 1.2.3v Description: A Missing Authentication for Critical Function issue in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance,...
PT-2021-21350 · Suse · Suse Longhorn
Name of the Vulnerable Software and Affected Versions: SUSE Longhorn versions prior to 1.1.3 SUSE Longhorn versions prior to 1.2.3 Description: A Missing Authentication for Critical Function issue in SUSE Longhorn allows any workload in the cluster to execute any binary present in the image on th...
