CVE-2013-3367: Improper Authentication

Undocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg24Mhw3...

CVE-2019-18848: Improper Authentication

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...

CVE-2019-5233: Improper Authentication

Huawei smartphones with versions earlier than Taurus-AL00B 10.0.0.41SP2C00E41R3P2 have an improper authentication vulnerability. Successful exploitation may cause the attacker to access specific components...

CVE-2019-1382: Undefined Security Weakness

An elevation of privilege vulnerability exists when ActiveX Installer service may allow access to files without proper authentication, aka 'Microsoft ActiveX Installer Service Elevation of Privilege Vulnerability'...

CVE-2019-5213: Improper Authentication

Honor play smartphones with versions earlier than Cornell-AL00A 9.1.0.321C00E320R1P1T8 have an insufficient authentication vulnerability. The system has a logic judge error under certain scenario. Successful exploit could allow the attacker to modify the alarm clock settings after a serious of...

CVE-2019-13531: Improper Authentication

In Medtronic Valleylab FT10 Energy Platform VLFT10GEN version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform VLLS10GEN—not available in the United States version 1.20.2 and lower, the RFID security mechanism used for authentication between the FT10/LS10 Energy...

Siemens En100 Improper Authentication

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

Siemens Apogee Improper Authentication

A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions V3.5. An attacker with network access to the integrated web server 80/tcp and 443/tcp could bypass the authentication and download sensitive information from the device. File data...

Schneider-electric Modicon Improper Authentication

Schneider Electric Modicon Quantum PLC does not perform authentication between the Unity software and PLC, which allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors. File data ot500033.nasl...

Rockwellautomation Controllogix Improper Authentication

The web-server password-authentication functionality in Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and...

Medtronic Valleylab FT10 and LS10

1. EXECUTIVE SUMMARY CVSS v3 4.8 ATTENTION: Low skill level to exploit Vendor: Medtronic Equipment: Valleylab FT10, Valleylab LS10 Vulnerabilities: Improper Authentication, Protection Mechanism Failure 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow an attacker to...

CVE-2019-1980: Improper Authentication

A vulnerability in the protocol detection component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to...

CVE-2013-5123: Improper Authentication

The mirroring support -M, --use-mirrors in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks...

CVE-2019-8108: Improper Authentication

Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate session validation setting for a storefront that leads to insecure authentication and session management...

CVE-2018-4064: Improper Authentication

An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the...

Improper Authentication in Auth0.AuthenticationApi

Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens...

GHSA-C9CG-Q8R2-XVJQ Improper Authentication in Auth0.AuthenticationApi

Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens...

CVE-2019-17627: Improper Authentication

The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy BLE traffic during one authorized unlock action, and then calculating the authentication key via simple computations on the hex digits of a valid authentication request. This...

CVE-2019-17372: Improper Authentication

Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNUaccessPasswordrecovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D,...

CVE-2019-16929: Improper Authentication

Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens...