Authentication flaw

Improper authentication for some IntelR Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2020-8713

CVE-2020-8713 affects Intel® Server Boards, Server Systems and Compute Modules prior to firmware version 1.59, where improper authentication may let an unauthenticated user potentially escalate privileges via adjacent access. NVD reports a CVSS v3.1 base score of 8.8 (High) with ADJACENT attack v...

CVE-2020-9244

HUAWEI Mate 20 versions Versions earlier than 10.1.0.160C00E160R3P8;HUAWEI Mate 20 Pro versions Versions earlier than 10.1.0.270C431E7R1P5,Versions earlier than 10.1.0.270C635E3R1P5,Versions earlier than 10.1.0.273C636E7R2P4;HUAWEI Mate 20 X versions Versions earlier than...

CVE-2020-9244

HUAWEI Mate 20 versions Versions earlier than 10.1.0.160C00E160R3P8;HUAWEI Mate 20 Pro versions Versions earlier than 10.1.0.270C431E7R1P5,Versions earlier than 10.1.0.270C635E3R1P5,Versions earlier than 10.1.0.273C636E7R2P4;HUAWEI Mate 20 X versions Versions earlier than...

Yokogawa CENTUM (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Yokogawa Equipment: CENTUM Vulnerabilities: Improper Authentication, Path Traversal 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-20-224-01...

Tridium Niagara Improper Authentication

An attacker can log into the local Niagara platform Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system. File data ot500381.nasl...

Tridium Niagara Improper Authentication

A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 JACE 3e, JACE 6e, JACE 7, JACE-8000, Niagara 4.4u3 JACE 3e, JACE 6e, JACE 7, JACE-8000, and Niagara 4.7u1 JACE-8000, Edge 10. File data ot500383.nasl...

Tridium Niagra Improper Authentication

Tridium Niagara AX Framework through 3.6 uses predictable values for 1 session IDs and 2 keys, which might allow remote attackers to bypass authentication via a brute-force attack. File data ot500377.nasl...

Security Advisory - Improper Authentication Vulnerability in Several Smartphones

There is an improper authentication vulnerability in several smartphones. The system does not properly sign certain encrypted file, the attacker should gain the key used to encrypt the file, successful exploit could cause certain file be forged. Vulnerability ID: HWPSIRT-2019-10020 This...

CVE-2020-8108 Insufficient client validation in Bitdefender Endpoint Security for Mac (VA-8759)

Improper Authentication vulnerability in Bitdefender Endpoint Security for Mac allows an unprivileged process to restart the main service and potentially inject third-party code into a trusted process. This issue affects: Bitdefender Endpoint Security for Mac versions prior to 4.12.80...

CVE-2020-8206

An improper authentication vulnerability exists in Pulse Connect Secure 9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP...

CVE-2020-8206

CVE-2020-8206 affects Pulse Connect Secure and Pulse Policy Secure versions prior to 9.1RB, enabling an attacker who has a user’s primary credentials to bypass Google TOTP authentication. Multiple connected sources confirm the same core issue: improper authentication that directly bypasses TOTP. ...

CVE-2020-8206

An improper authentication vulnerability exists in Pulse Connect Secure 9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP...

CVE-2020-12812

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication FortiToken if they changed the case of their username...

CVE-2020-12812

CVE-2020-12812 is an improper authentication flaw in Fortinet FortiOS SSL VPN that allows a user to log in without FortiToken MFA if the username’s case is changed. Affected FortiOS versions include 6.4.0, 6.2.0–6.2.3, 6.0.9 and earlier. Fortinet advisories FG-IR-19-283 and related Nessus entries...

CVE-2020-12812

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication FortiToken if they changed the case of their username...

CVE-2020-9259

Huawei Honor V30 smartphones with versions earlier than 10.1.0.212C00E210R5P1 have an improper authentication vulnerability. The system does not sufficiently validate certain parameter passed from the bottom level, the attacker should trick the user into installing a malicious application and...

CVE-2020-9259

CVE-2020-9259 affects Huawei Honor V30 smartphones with versions earlier than 10.1.0.212 (C00E210R5P1). The vulnerability stems from improper authentication due to insufficient validation of certain parameters passed from the bottom level, enabling an attacker who convinces a user to install a ma...

CVE-2020-14501

Advantech iView, versions 5.6 and prior, has an improper authentication for critical function CWE-306 issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text. An attacker may also...

CVE-2020-14501

CVE-2020-14501 affects Advantech iView (versions 5.6 and prior). The root cause is a missing authentication for a critical function (CWE-306), enabling an unauthenticated attacker to obtain the user table information (including administrator credentials in plain text) and potentially delete the a...