CVE-2023-25556

A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation...

CVE-2023-25556

CVE-2023-25556 describes an improper authentication weakness in KNX-based devices where a key of fewer than seven digits can compromise a device if an attacker has KNX access. Connected sources tie this to Schneider Electric StruxureWare/KNX implementations and Merten KNX, noting the root cause a...

CVE-2023-0905

CVE-2023-0905 affects SourceCodester Employee Task Management System v1.0, specifically the file changePasswordForEmployee.php, where improper authentication is triggered by an unknown function. The vulnerability can be exploited remotely and has been disclosed publicly; an exploit is tracked in ...

CVE-2023-23928 reason-jose ignores signature checks

reason-jose is a JOSE implementation in ReasonML and OCaml.Jose.Jws.validate does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass...

CVE-2022-32514

A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Products: C-Bus Network Automation Controller - LSS5500NAC Versions prior to V1.10.0, Wiser for C-Bus Automation Controller - LSS5500SHAC...

CVE-2022-32514

A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Products: C-Bus Network Automation Controller - LSS5500NAC Versions prior to V1.10.0, Wiser for C-Bus Automation Controller - LSS5500SHAC...

JVN#78481846: TP-Link SG105PE vulnerable to authentication bypass

TP-Link SG105PE contains an authentication bypass vulnerability CWE-287. Impact Under certain conditions, an attacker may impersonate an administrator of the product. As a result, information may be obtained and the product's settings may be altered with the privilege of the administrator. Soluti...

JVN#55675303: Digital Arts m-FILTER vulnerable to improper authentication

m-FILTER provided by Digital Arts Inc. is an emaill security product. m-FILTER contains an improper authentication vulnerability CWE-287 when emails are being sent under certain conditions, and unintended emails may be sent by a remote attacker. Digital Arts Inc. states that attacks exploiting th...

FortiSIEM - Glassfish local credentials stored in plain text

An improper authentification vulnerability CWE-287 in FortiSIEM may allow a local attacker with CLI access to perform operations on the Glassfish server directly via a hardcoded password...

JVN#36454862: Multiple vulnerabilities in Trend Micro Apex One and Trend Micro Apex One as a Service

Trend Micro Apex One and Trend Micro Apex One as a Service provided by Trend Micro Incorporated contain multiple vulnerabilities listed below. Improper validation in some components of the rollback mechanism CWE-20 - CVE-2022-40139 Version| Vector| Score ---|---|--- CVSS v3|...

CVE-2022-29775

iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL...

CVE-2022-30238

A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks a session. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...

CVE-2022-30238

Schneider Electric Wiser Smart (EER21000/EER21001, v4.5 and prior) is affected by CVE-2022-30238, a CWE-287 Improper Authentication vulnerability. The issue allows an attacker to hijack a user session and take over an admin account. Public documentation across sources confirms the affected produc...

CVE-2022-30238

A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks a session. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...

CVE-2022-0715

A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series SMT Series ID=18: UPS 09.8 and prior / SMT Series...

Authentication flaw

A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series SMT Series ID=18: UPS 09.8 and prior / SMT Series...

CVE-2022-0715

CVE-2022-0715 describes an improper authentication vulnerability in Schneider Electric APC Smart-UPS devices across multiple series (SMT/SMC/SCL/SMX/SRT and SmartConnect/SMTL), where a leaked key could authorize uploading unsigned firmware, allowing an attacker to arbitrarily change UPS behavior....

CVE-2021-22796

A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded. Affected Product: C-Bus Toolkit V1.15.9 and prior, C-Gate Server V2.11.7 and prior...

CVE-2021-22796

The CVE-2021-22796 entry concerns an improper authentication flaw that could allow remote code execution when a malicious file is uploaded. Affected products are Schneider Electric’s C-Bus Toolkit (versions 1.15.9 and earlier) and C-Gate Server (versions 2.11.7 and earlier). Root cause is CWE-287...

Authentication flaw

The usage of an internal HTTP header created an authentication bypass vulnerability CWE-287, allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to...