The vulnerability of the Bluetooth technology stack for Linux BlueZ, related to improper authentication, allows a malicious actor to gain access to confidential data.

The vulnerability of the Bluetooth technology stack for Linux BlueZ is related to the improper saving of the Discoverable status of adapters when a device is disabled. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

CVE-2022-39205: Improper Authentication

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev instance if there is no properly configured reverse proxy. The /git-prereceive-callback endpoint is used by the pre-receive git hook on the...

CVE-2022-36106: Improper Authentication

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even ...

CVE-2022-39801: Improper Authentication

SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only within the firewall. On successful exploitation the attacker can gain access to admin session and...

Kingspan TMS300 CS

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Kingspan Equipment : TMS300 CS Vulnerability: Improper Authentication 2. RISK EVALUATION The TMS300 CS system does not properly restrict access to endpoints, and successful exploitation of this...

IBM WebSphere Application Server 注入漏洞

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. An injection vulnerability exists in IBM WebSphere...

CVE-2022-38399: Improper Authentication

Missing protection mechanism for alternate hardware interface in SmaCam CS-QR10 all versions and SmaCam Night Vision CS-QR20 all versions allows an attacker to execute an arbitrary OS command by having the product connect to the product's specific serial connection...

CVE-2022-36092: Improper Authentication

XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes...

PHPFusion < 9.10.30 Improper Authentication Vulnerability

PHPFusion is prone to an improper authentication vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free softwar...

CVE-2022-36073: Improper Authentication

RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable an attacker to save API keys for that...

CVE-2022-26858

Dell BIOS versions contain an Improper Authentication vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls...

CVE-2022-26858

Dell BIOS CVE-2022-26858 is an Improper Authentication vulnerability affecting Dell BIOS versions. A locally authenticated user can potentially bypass security controls by sending malicious input to an SMI. The issue is commonly discussed alongside related BIOS vulnerabilities (DSA-2022-224) and ...

CVE-2022-26858

Dell BIOS versions contain an Improper Authentication vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls...

CVE-2022-31020

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the "pool-upgrade" request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The "pool-upgrade"...

PT-2022-18107 · Dell · Dell Bios

Name of the Vulnerable Software and Affected Versions: Dell BIOS affected versions not specified Description: The issue is related to an Improper Authentication vulnerability. A locally authenticated malicious user could potentially exploit this by sending malicious input to a System Management...

CVE-2022-26858: Improper Authentication

Dell BIOS versions contain an Improper Authentication vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls...

CVE-2022-31020: Improper Authentication

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the pool-upgrade request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The pool-upgrade request...

Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-055)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-055 advisory. A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials s...

Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-065)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-065 advisory. A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials s...

CVE-2022-36071: Improper Authentication

SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP Time-based One Time Passwords as a secondary authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged,...