CVE-2021-25315

CVE-2021-25315 — Summary : The vulnerability is an Incorrect Implementation of Authentication Algorithm in Salt for SUSE Linux Enterprise Server 15 SP3 and openSUSE Tumbleweed. It could allow local attackers to execute arbitrary code via salt without valid credentials. The issue affects salt vers...

CVE-2021-25315

Removed by vendor...

CVE-2021-25315: Improper Authentication

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior t...

CVE-2021-25315

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior t...

CVE-2021-3332: Improper Authentication

WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via postpassword...

CVE-2021-25281: Improper Authentication

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheelasync client. Thus, an attacker can remotely run any wheel modules on the master...

CVE-2020-26200: Improper Authentication

A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky Rescue Disk KRD and was trusted by the Authentication Agent of Full Disk Encryption in Kaspersky Endpoint Security KES...

CVE-2021-21308: Improper Authentication

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2...

CVE-2021-3339: Improper Authentication

ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the Search Screen and the Profile Screen...

CVE-2021-22858: Improper Authentication

Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions...

IBM Security Identity Governance and Intelligence 输入验证错误漏洞

IBM Security Identity Governance and Intelligence is an integrated identity management solution based on network devices. A denial of service vulnerability exists in IBM Security Identity Governance and Intelligence 5.2.6. The vulnerability arises from improper authentication of a supplied URL. A...

CVE-2021-21502: Improper Authentication

Dell PowerScale OneFS versions 8.1.0 – 9.1.0 contain a "use of SSH key past account expiration" vulnerability. A user on the network with the ISIPRIVAUTHSSH RBAC privilege that has an expired account may potentially exploit this vulnerability, giving them access to the same things they had before...

The vulnerability in the web interface of the Cisco Data Center Network Manager (DCNM) allows a attacker to modify the device’s configuration.

The vulnerability in the web interface of the Cisco Data Center Network Manager DCNM management interface is related to improper authentication. Exploiting this vulnerability allows a malicious actor to modify the device’s configuration remotely...

CVE-2021-26905: Improper Authentication

1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key...

The vulnerability in the web interface of the Cisco Data Center Network Manager (DCNM) allows a malicious actor to gain access to modify, add, or delete data, or to obtain unauthorized access to protected information.

The vulnerability in the web interface of the Cisco Data Center Network Manager DCNM management interface is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to modify, add, or delete data, or to obtain unauthorized access to protected...

CVE-2020-10539: Improper Authentication

An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort function that, upon user login, checks the submitted password against the user password's MD5 hash stored in the database. It is also compared to a second MD5 hash, which is the same for every user aka a...

Exploit for Improper Authentication in Apache Shiro

Analysis of Two Ways to Bypass Authentication with Apache Shir...

Qualcomm Wlan Firmware Security Vulnerability

Qualcomm Wlan Firmware is a Wlan support firmware from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Wlan Firmware that could result in a denial of service due to improper authentication when processing host WMI commands...

CVE-2021-3282: Improper Authentication

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2...

CVE-2020-15835: Improper Authentication

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function contains undocumented code that provides the ability to authenticate as root without knowing the actual root password. An adversary with the private key can remotely authenticate to the...