PT-2024-30612 · Microchip · Timeprovider 4100

Name of the Vulnerable Software and Affected Versions: Microchip TimeProvider 4100 versions 1.0 through 2.4.7 Description: The issue is related to improper authentication in the login modules of Microchip TimeProvider 4100, which allows session hijacking. Recommendations: For versions 1.0 through...

Microchip TimeProvider 4100 授权问题漏洞

Microchip TimeProvider 4100 is a gateway clock from Microchip, Inc. A security vulnerability exists in Microchip TimeProvider 4100 versions prior to 2.4.7 that stems from improper authentication and could lead to session hijacking...

The vulnerability of the Expressway-E server allows attackers to impersonate other users within the compromised system, using devices that are part of the Cisco Expressway Series and Cisco Telepresence VCS family.

The vulnerability of the Expressway-E server in Cisco Expressway Series and Cisco Telepresence VCS conference communication devices is related to improper authentication. Exploiting this vulnerability allows a malicious actor to impersonate another user within the compromised system...

Improper Authentication

Overview PyNinja is a Lightweight OS-agnostic service monitoring API Affected versions of this package are vulnerable to Improper Authentication due to insufficient authentication for the monitoring page. Remediation Upgrade PyNinja to version 0.0.4 or higher. References - GitHub Commit...

Google Go 后置链接漏洞

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google, Inc. Google Go suffers from a back-linking vulnerability that stems from improper authentication, where the container runtime may incorrectly handle certain file paths, allowing a...

Improper Authentication

github.com/ory/kratos is vulnerable to an Improper Authentication. The vulnerability is due to an incorrect assumption of the highest available Authentication Assurance Level AAL as aal1 instead of aal2, allowing users to access endpoints without the required aal2 session under certain...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication due to the improper handling of the requiredaal setting in the authentication process. An attacker can bypass multi-factor authentication requirements by exploiting the incorrect storage of availableaal values in...

Multiple vulnerabilities in TAKENAKA ENGINEERING digital video recorders

Overview Multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. contain multiple vulnerabilities listed below. Improper authentication CWE-287 - CVE-2024-41929 OS command injection CWE-78 - CVE-2024-43778 Hidden functionality CWE-912 - CVE-2024-47001 Yoshiki Mori, Ushimaru...

CVE-2024-41929

Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings...

CVE-2024-41929

TAKENAKA ENGINEERING CO., LTD. digital video recorders are affected by CVE-2024-41929 due to improper authentication (CWE-287). A remote, authenticated attacker can execute arbitrary operating system commands or alter device settings. The issue impacts multiple TAKENAKA DVR models (per JVN/CNNVD ...

IBM Business Automation Workflow 安全漏洞

IBM Business Automation Workflow is a suite of workflow automation solutions from International Business Machines IBM. The product is primarily used for workflow management, compliance management, and features workflow visibility and scalability. An input validation error vulnerability exists in...

TAKENAKA ENGINEERING多款产品 安全漏洞

TAKENAKA ENGINEERING HDVR-400 and others are a digital video recorder from TAKENAKA ENGINEERING. A security vulnerability exists in various TAKENAKA ENGINEERING products that originates from improper user authentication and could allow an authenticated, remote attacker to execute arbitrary...

The vulnerability of the corporate version of the GitHub Enterprise Server is related to improper authentication, which allows a malicious user to modify issues in public repositories.

The vulnerability of the corporate version of the GitHub Enterprise Server is related to improper authentication. Exploiting this vulnerability could allow a malicious actor to modify issues in public repositories remotely...

CVE-2024-45113

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does...

CVE-2024-45113

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does...

CVE-2024-45113 ColdFusion | Improper Authentication (CWE-287)

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does...

CVE-2024-45113

CVE-2024-45113 affects ColdFusion versions 2023.6, 2021.12 and earlier, introducing an Improper Authentication vulnerability that can lead to privilege escalation. An attacker could gain unauthorized access without user interaction, with a network attack vector and no required privileges. The bas...

Adobe ColdFusion 授权问题漏洞

Adobe ColdFusion is a suite of rapid application development platforms from the American company Audobee Adobe. The platform includes an integrated development environment and a scripting language. Adobe ColdFusion 2023.6, prior to version 2021.12 has an authorization issue vulnerability that ste...

CVE-2021-38133 Possible Improper authentication Vulnerability in OpenText eDirectory

Possible External Service Interaction attack in eDirectory has been discovered in OpenText™ eDirectory. This impact all version before 9.2.6.0000...

Rockwell Automation FactoryTalk Batch View

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely Vendor: Rockwell Automation Equipment: FactoryTalk Batch View Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker bypassing authentication...