Authentication flaw

NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker with access to the Neuvector portal to authenticate as any valid LDAP user by providing a valid username and an empty password provided that the active directo...

DEBIAN-CVE-2011-4120

Yubico PAM Module before 2.10 performed user authentication when 'usefirstpass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the...

gitea -- multiple vulnerabilities

The Gitea Team reports: Hide credentials when submitting migration Never allow an empty password to validate Prevent redirect to Host Hide public repos owned by private orgs...

The vulnerability of the /etc/passwd file in Cisco Small Business router microprogramming devices series 250, 350, 350X, and 550X allows a hacker to elevate their privileges to the root level.

The vulnerability of the /etc/passwd file in Cisco Small Business routers of the 250, 350, 350X, and 550X series is related to the presence of empty password entries for the root and user accounts. Exploiting this vulnerability allows a remote attacker to elevate their privileges to the root leve...

CVE-2017-7546

It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to gain access to database accounts with empty passwords...

NewStart CGSL MAIN 4.05 : postgresql Vulnerability (NS-SA-2019-0121)

The remote NewStart CGSL host, running version MAIN 4.05, has postgresql packages installed that are affected by a vulnerability: - It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq's refusal to send an empty password. A remote...

CVE-2018-15556

The Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 allows login with root level access with the user "root" and an empty password by using the enabled onboard UART headers...

Default credentials

The Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 allows login with root level access with the user "root" and an empty password by using the enabled onboard UART headers...

CVE-2019-9950

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an authentication bypass vulnerability. The loginmgr.cgi file checks credentials...

D-Link DIR-825 "user" Account Empty Password Vulnerability

The D-Link DIR-825 is a router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DIR-825 B version 2.10, which stems from the use of an empty password for the 'user' account. The vulnerability can be exploited by an attacker to log into the router...

D-Link DIR-878 Empty Password Login Vulnerability

The D-Link DIR-878 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the /HNAP1 URI in the D-Link DIR-878 version 1.12B01. The vulnerability can be exploited by an attacker to log in to the device with the help of an empty password...

[SECURITY] [DLA 1671-1] coturn security update

Package : coturn Version : 4.2.1.2-1+deb8u1 CVE ID : CVE-2018-4056 CVE-2018-4058 CVE-2018-4059 Multiple vulnerabilities were discovered in coTURN, a TURN and STUN server for VoIP. CVE-2018-4056 An SQL injection vulnerability was discovered in the coTURN administrator web portal. As the...

Debian: Security Advisory (DLA-1671-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Symfony software platform for developing and managing web applications lies in errors in processing user authentication data, allowing attackers to bypass the authentication process.

The vulnerability of the Symfony software platform for developing and managing web applications is related to errors in processing user authentication data. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures by using the user’s existing username and an empt...

Debian DSA-4373-1 : coturn - security update

Multiple vulnerabilities were discovered in coTURN, a TURN and STUN server for VoIP. - CVE-2018-4056 A SQL injection vulnerability was discovered in the coTURN administrator web portal. As the administration web interface is shared with the production, it is unfortunately not possible to easily...

[SECURITY] [DSA 4373-1] coturn security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4373-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez January 28, 2019 https://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-4373-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Authentication Bypass

PostgreSQL is vulnerable to authentication bypass. It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to gain access to database accounts with...

Authentication Bypass

jbosssx2 is vulnerable to authentication bypass attacks. The vulnerability exists as the default configuration of the 1 LdapLoginModule and 2 LdapExtLoginModule modules in JBoss Enterprise Application Platform EAP 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform EWP 5.2.0 allow remote...

Authentication Bypass

openstack-keystone is vulnerable to authentication bypass attacks. The vulnerability exists as OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password...