8733 matches found
Schneider Electric C-Bus多款产品 授权问题漏洞
Schneider Electric C-Bus Home Automation is a series of bus-based home automation systems from French company Schneider Electric. An authorization issue vulnerability exists in various Schneider Electric C-Bus products, which stems from an improper authentication mechanism that allows an attacker...
PT-2023-19810
Name of the Vulnerable Software and Affected Versions Apache IoTDB versions 0.13.0 through 0.13.2 Description The issue is related to an Improper Authentication vulnerability in the Apache Software Foundation Apache IoTDB, specifically affecting the iotdb-web-workbench component. This vulnerabili...
CVE-2022-32514: Improper Authentication
A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Products: C-Bus Network Automation Controller - LSS5500NAC Versions prior to V1.10.0, Wiser for C-Bus Automation Controller - LSS5500SHAC...
CVE-2023-24830: Improper Authentication
Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3...
Improper Authentication
thorsten/phpmyfaq is vulnerable to Improper Authentication. The vulnerability is due to Captcha.php checking the captcha length incorrectly which allows an attacker to bypass captcha checks...
CVE-2022-43978
Pandora FMS vulnerability CVE-2022-43978 affects Pandora FMS version 7.64 (v764). The issue is an improper authentication bypass: the application verifies a valid session when a user is not attempting to log in, due to a static secret in the generatePublicHash function. An attacker who knows a va...
PT-2023-14420 · Unknown · Pandora Fms
Name of the Vulnerable Software and Affected Versions: Pandora FMS version 7.64 Description: The issue is related to improper authentication. The application checks for a valid session when a user is not attempting to log in. A static secret in the generatePublicHash function allows an attacker...
CVE-2022-43978
There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order t...
CVE-2022-43978: Improper Authentication
There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order t...
Phoenix Contact ILC PLCs Improper Authentication (CVE-2016-8380)
The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...
Phoenix Contact ILC PLCs Improper Authentication (CVE-2016-8371)
The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...
Siemens Desigo PXC Improper Authentication (CVE-2018-4834)
A remote attacker with network access to the device could potentially upload a new firmware image to the devices without prior authentication. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...
CVE-2023-23612: Improper Authentication
OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider IdP when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are processed from the JWTs where the leading and...
CVE-2023-22334: Improper Authentication
Use of password hash instead of password for authentication vulnerability in CONPROSYS HMI System CHS Ver.3.4.5 and earlier allows a remote authenticated attacker to obtain user credentials information via a man-in-the-middle attack...
CVE-2022-45922: Improper Authentication
An issue was discovered in OpenText Content Suite Platform 22.1 16.2.19.1803. The request handler for ll.KeepAliveSession sets a valid AdminPwd cookie even when the Web Admin password was not entered. This allows access to endpoints, which require a valid AdminPwd cookie, without knowing the...
CVE-2023-21841: Improper Authentication
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle...
CVE-2023-0311 Improper Authentication in thorsten/phpmyfaq
Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10...
CVE-2023-0311
CVE-2023-0311 affects phpMyFAQ (thorsten/phpmyfaq) prior to version 3.1.10 due to an improper authentication/authorization issue. The vulnerability is documented with a CVSSv3.1 base score of 9.8 (Network attack, no user interaction, high impact on confidentiality, integrity, and availability). T...
