CVE-2021-36460: Improper Authentication

VeryFitPro com.veryfit2hr.second 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's...

CVE-2022-29534: Improper Authentication

An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header...

CVE-2021-3652: Improper Authentication

A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was...

CVE-2022-26034

Improper authentication vulnerability in the communication protocol provided by AD Automation Design server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions...

CVE-2022-26034

The CVE-2022-26034 issue affects Yokogawa CENTUM VP family and B/M9000 VP (notably CENTUM VP R6.01.10–R6.09.00; B/M9000 VP R8.01.01–R8.03.01; and ProSafe-RS up to R4.07.00 if RS4E5000 is installed). The root cause is improper authentication in the AD server’s communication protocol, enabling an a...

CVE-2022-26034

Improper authentication vulnerability in the communication protocol provided by AD Automation Design server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions...

CVE-2022-24857: Improper Authentication

django-mfa3 is a library that implements multi factor authentication for the django web framework. It achieves this by modifying the regular login view. Django however has a second login view for its admin area. This second login view was not modified, so the multi factor authentication can be...

CVE-2022-26034: Improper Authentication

Improper authentication vulnerability in the communication protocol provided by AD Automation Design server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions...

PT-2022-2415

Name of the Vulnerable Software and Affected Versions CENTUM VP versions R6.01.10 through R6.09.00 CENTUM VP Small versions R6.01.10 through R6.09.00 CENTUM VP Basic versions R6.01.10 through R6.09.00 B/M9000 VP versions R8.01.01 through R8.03.01 Description The issue is related to an improper...

Design/Logic Flaw

Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contain an improper restriction of excessive authentication attempts. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to compromised accounts...

CVE-2022-27839

Improper authentication vulnerability in SecretMode in Samsung Internet prior to version 16.2.1 allows attackers to access bookmark tab without proper credentials...

CVE-2022-27839

Improper authentication vulnerability in SecretMode in Samsung Internet prior to version 16.2.1 allows attackers to access bookmark tab without proper credentials...

CVE-2022-25832

Improper authentication vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to use locked Myfiles app without authentication...

CVE-2022-25832

Improper authentication vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to use locked Myfiles app without authentication...

CVE-2022-25833

Improper authentication in ImsService prior to SMR Apr-2022 Release 1 allows attackers to get IMSI without READPRIVILEGEDPHONESTATE permission...

CVE-2022-25833

Improper authentication in ImsService prior to SMR Apr-2022 Release 1 allows attackers to get IMSI without READPRIVILEGEDPHONESTATE permission...

CVE-2022-25832

Improper authentication vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to use locked Myfiles app without authentication...

Authentication flaw

Improper authentication vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to use locked Myfiles app without authentication...

CVE-2022-27839

Improper authentication vulnerability in SecretMode in Samsung Internet prior to version 16.2.1 allows attackers to access bookmark tab without proper credentials...

CVE-2022-25833

The CVE-2022-25833 entry concerns Samsung SMR prior to Apr-2022 Release 1, where improper authentication in ImsService could allow an attacker to obtain IMSI without the READ_PRIVILEGED_PHONE_STATE permission. The vulnerability involves authentication checks in ImsService, enabling local access t...