Improper Authentication

snipe/snipe-it is vulnerable to improper authentication. A remote authenticated attacker is able to access unauthorized files through the viewKeys function as long as they have the View permission, which exposes confidential information required to create the API keys without the corresponding...

Snipe-IT vulnerable to Improper Authentication

Snipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the View and Modify License Files permission may access files uploaded to licenses as long as they have the View permission for licenses...

GHSA-FHVV-P968-6VVJ Snipe-IT vulnerable to Improper Authentication

Snipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the View and Modify License Files permission may access files uploaded to licenses as long as they have the View permission for licenses...

Security Bulletin: Vulnerabilities in libcurl may affect IBM Spectrum Protect Plus (CVE-2021-22946, CVE-2022-27782, CVE-2022-27774, CVE-2022-22576, CVE-2021-22947, CVE-2022-27776)

Summary Vulnerabilities in libcurl such as bypassing security restrictions, obtaining sensitive information, and man-in-the-middle attacks may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID:CVE-2021-22946 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive...

CVE-2022-3173

Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...

CVE-2022-3173

Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...

CVE-2022-3173

CVE-2022-3173 affects Snipe-IT prior to 6.0.10. The issue is improper authentication/authorization, allowing a user with only limited license-view permissions to access files uploaded to licenses and, per sources, to create API keys despite lacking permission. Documents indicate a remote authenti...

CVE-2022-3173 Improper Authentication in snipe/snipe-it

Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...

CVE-2022-3173: Improper Authentication

Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...

PT-2022-20898

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 6.0.10 Description The issue concerns improper authentication in the Snipe-IT repository. A user without the View and Modify License Files permission may still access files uploaded to licenses if they have the View...

CVE-2022-39009: Improper Authentication

The WLAN module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause third-party apps to affect WLAN functions...

CVE-2021-42949: Improper Authentication

The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks...

CVE-2022-25652: Improper Authentication

Cryptographic issues in BSP due to improper hash verification in Snapdragon Wired Infrastructure and Networking...

Dell Client BIOS Multiple Vulnerabilities (DSA-2022-224)

The Dell BIOS on the remote device is missing a security patch and is, there, is affected by multiple vulnerabilities. - Dell BIOS versions contain a stack-based buffer overflow vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI to bypass security...

The vulnerability of the Bluetooth technology stack for Linux BlueZ, related to improper authentication, allows a malicious actor to gain access to confidential data.

The vulnerability of the Bluetooth technology stack for Linux BlueZ is related to the improper saving of the Discoverable status of adapters when a device is disabled. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

Kingspan TMS300 CS

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Kingspan Equipment : TMS300 CS Vulnerability: Improper Authentication 2. RISK EVALUATION The TMS300 CS system does not properly restrict access to endpoints, and successful exploitation of this...

CVE-2022-36106: Improper Authentication

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even ...

CVE-2022-39801: Improper Authentication

SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only within the firewall. On successful exploitation the attacker can gain access to admin session and...

CVE-2022-39205: Improper Authentication

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev instance if there is no properly configured reverse proxy. The /git-prereceive-callback endpoint is used by the pre-receive git hook on the...

IBM WebSphere Application Server 注入漏洞

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. An injection vulnerability exists in IBM WebSphere...