CVE-2021-30702: Improper Authentication

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A person with physical access to a Mac may be able to bypass Login Window...

CVE-2021-30605: Improper Authentication

Inappropriate implementation in the ChromeOS Readiness Tool installer on Windows prior to 1.0.2.0 loosens DCOM access rights on two objects allowing an attacker to potentially bypass discretionary access controls...

PT-2021-9272

Name of the Vulnerable Software and Affected Versions Snapdragon Auto affected versions not specified Snapdragon Compute affected versions not specified Snapdragon Connectivity affected versions not specified Snapdragon Consumer Electronics Connectivity affected versions not specified Snapdragon...

PT-2021-9309

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon affected versions not specified Description The issue is related to improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network, which can lead to information disclosure. This affects various...

CVE-2020-11301: Improper Authentication

Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon...

CVE-2021-39196: Improper Authentication

pcapture is an open source dumpcap web service interface . In affected versions this vulnerability allows an authenticated but unprivileged user to use the REST API to capture and download packets with no capture filter and without adequate permissions. This is important because the capture filte...

GHSA-FJQG-W8G6-HHQ8 Dolibarr vulnerable to Improper Authentication and Improper Access Control

In Dolibarr application, v3.3.beta120121221 to v13.0.2 have Modify access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user Login. This leads to complete account takeover of the victim user. This happens since the...

Dolibarr vulnerable to Improper Authentication and Improper Access Control

In Dolibarr application, v3.3.beta120121221 to v13.0.2 have Modify access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user Login. This leads to complete account takeover of the victim user. This happens since the...

CVE-2021-40350: Improper Authentication

webctrl.cgi.elf on Christie Digital DWU850-GS V06.46 devices allows attackers to perform any desired action via a crafted query containing an unspecified Cookie header. Authentication bypass can be achieved by including an administrative cookie that the device does not validate...

CVE-2021-22943: Improper Authentication

A vulnerability found in UniFi Protect application V1.18.1 and earlier permits a malicious actor who has already gained access to a network to subsequently control the Protect cameras assigned to said network. This vulnerability is fixed in UniFi Protect application V1.19.0 and later...

CVE-2021-34578: Improper Authentication

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07...

CVE-2021-22002: Improper Authentication

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in...

CVE-2021-36370: Improper Authentication

An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity...

CVE-2021-37417: Improper Authentication

Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation...

CVE-2021-32648: Improper Authentication

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5...

PT-2021-4044

Name of the Vulnerable Software and Affected Versions October CMS versions prior to Build 472 and v1.1.5 Description The issue is related to an improper authentication mechanism in the October CMS platform, which is based on the Laravel PHP Framework. An attacker can exploit this by requesting an...

CVE-2021-30867: Improper Authentication

The issue was addressed with improved authentication. This issue is fixed in iOS 15 and iPadOS 15. A malicious application may be able to access photo metadata without needing permission to access photos...

The vulnerability of the programming software for PLCs (programmable logic controllers), EcoStruxure Control Expert, allows a intruder to bypass the authentication process.

The vulnerability of the programming software for PLCs programmable logic controllers, EcoStruxure Control Expert, is related to improper authentication. Exploiting this vulnerability can allow an attacker to bypass authentication processes...

CVE-2021-37597: Improper Authentication

WP Cerber before 8.9.3 allows MFA bypass via wordpressloggedinhash manipulation...

The vulnerability of the TrustAccess network firewall lies in its improperly implemented user authentication mechanism, which allows attackers to carry out authentication procedures.

The vulnerability of the TrustAccess network firewall is related to an improperly implemented user authentication mechanism. Exploiting this vulnerability allows a perpetrator who has access to user credentials to perform authentication procedures without using the TrustAccess graphical interface...