PT-2024-33296

Name of the Vulnerable Software and Affected Versions Logpoint versions prior to 7.5.0 Description An issue was discovered in Logpoint where unvalidated input during the EventHub Collector setup by an authenticated user leads to Remote Code execution. The issue is related to improper authenticati...

Zendesk Customer Service Authorization Disclosure

The vulnerability of Zendesk’s customer service and sales software is related to improper authentication. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

CVE-2024-10963: Improper Authentication

A flaw was found in pamaccess, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this...

CVE-2024-49405

Improper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows physical attackers to access sensitive information in a specific scenario...

CVE-2024-49405

Improper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows physical attackers to access sensitive information in a specific scenario...

CVE-2024-50341: Improper Authentication

symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom userchecker defined on a firewall is not called when Login Programmaticaly with the Security::login method, leading to...

Samsung Mobile Devices security vulnerabilities

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability previously existed in SAMSUNG Mobile devices version 4.4.04.7, which stemmed from the Samsung Pas app's Private Info containi...

CVE-2024-49405: Undefined Security Weakness

Improper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows physical attackers to access sensitive information in a specific scenario...

CVE-2023-29117: Improper Authentication

Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system...

PT-2024-33516 · Samsung · Samsung Pass

Name of the Vulnerable Software and Affected Versions: Samsung Pass versions prior to 4.4.04.7 Description: The issue is related to improper authentication in the Private Info feature of Samsung Pass, allowing physical attackers to access sensitive information in a specific scenario...

CVE-2024-10620

The CVE-2024-10620 entry concerns knightliao Disconf 2.6.36. The affected component is the Configuration Center, specifically the /api/config/list path. The root cause is improper authentication on this endpoint, enabling remote initiation of an attack. Public disclosures exist, indicating exploi...

CVE-2024-10620 knightliao Disconf Configuration Center list improper authentication

A vulnerability was found in knightliao Disconf 2.6.36. It has been classified as critical. This affects an unknown part of the file /api/config/list of the component Configuration Center. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The explo...

Disconf security vulnerabilities

Disconf is a distributed configuration management platform by the individual developer Qiqi Liao. A security vulnerability exists in Disconf version 2.6.36, which stems from improper authentication...

CVE-2024-10620: Improper Authentication

A vulnerability was found in knightliao Disconf 2.6.36. It has been classified as critical. This affects an unknown part of the file /api/config/list of the component Configuration Center. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The explo...

Security Bulletin: IBM Storage Protect Server is susceptible to multiple vulnerabilities due to key-value store "etcd". (CVE-2018-1098, CVE-2018-1099, CVE-2022-34038, CVE-2021-2823).

Summary The distributed key-value store, etcd, used by IBM Storage Protect Server is vulnerable to cross-site scripting, denial of service, or unauthorized access to the host system. This bulletin outlines the steps to address these vulnerabilities. Vulnerability Details CVEID:CVE-2018-1098...

PT-2024-16332 · Apc · Powerchute Serial Shutdown

Name of the Vulnerable Software and Affected Versions: PowerChute Serial Shutdown affected versions not specified Description: The issue is related to an improper authentication vulnerability that could cause denial of access to the web interface when someone on the local network repeatedly...

CVE-2024-10474: Improper Authentication

Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL safety checks This vulnerability affects Focus for iOS 132...

CVE-2024-49755: Improper Authentication

Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local api endpoints even...

Exploit for Improper Authentication in Microsoft

Detailed-Analysis-and-Mitigation-Strategies-for-CVE-2024-38124...

Security Bulletin: IBM Sterling Connect:Direct Web Services is uses xmltooling-1.4.4.jar, which contains a vulnerability

Summary IBM Sterling Connect:Direct Web Services uses Shibboleth Identity Provider, which could allow a remote attacker to bypass security restrictions. It's caused by an error in the PKIX trust component. Vulnerability Details CVEID:CVE-2015-1796 DESCRIPTION: Shibboleth Identity Provider could...