8631 matches found
Exploit for Improper Authentication in Ivanti Connect_Secure
CVE-2021-22893 THIS IS NOT A REAL EXPLOIT IT IS A HONEYPOC ht...
Exploit for Improper Authentication in Ivanti Connect_Secure
CVE-2021-22893 THIS IS NOT A REAL EXPLOIT IT IS A HONEYPOC ht...
CVE-2020-28973: Improper Authentication
The ABUS Secvest wireless alarm system FUAA50000 v3.01.17 fails to properly authenticate some requests to its built-in HTTPS interface. Someone can use this vulnerability to obtain sensitive information from the system, such as usernames and passwords. This information can then be used to...
PT-2021-11616
Name of the Vulnerable Software and Affected Versions: ABUS Secvest wireless alarm system version 3.01.17 Description: The issue allows unauthorized access to sensitive information, including usernames and passwords, due to improper authentication of requests to the built-in HTTPS interface. This...
CVE-2020-7856: Improper Authentication
A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient authentication validation...
CVE-2021-20288: Improper Authentication
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHXGETAUTHSESSIONKEY requests, it doesn't sanitize otherkeys, allowing key reuse. An attacker who can request a globalid can exploit the ability of any user to request a globalid previously associated...
GO-2020-0038 Improper authentication in github.com/pion/dtls
Due to improper verification of packets, unencrypted packets containing application data are accepted after the initial handshake. This allows an attacker to inject arbitrary data which the client/server believes was encrypted, despite not knowing the session key...
Improper Authentication in react-adal
This affects versions of react-adal 0.5.1. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is caused by h...
GHSA-7MPX-VG3C-CMR4 Improper Authentication in react-adal
This affects versions of react-adal 0.5.1. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is caused by h...
PT-2021-7826
Name of the Vulnerable Software and Affected Versions C-Bus Toolkit versions 1.15.9 and prior C-Gate Server versions 2.11.7 and prior Description A vulnerability exists that could allow remote code execution when a malicious file is uploaded, due to improper authentication. This issue is related ...
Siemens and PKE Control Center Server
1. EXECUTIVE SUMMARY CVSS v3 9.9 ATTENTION: Exploitable remotely/low attack complexity Vendors: Siemens/PKE Equipment: Control Center Server CCS Vulnerabilities: Cleartext Storage of Sensitive Information in GUI, Improper Authentication, Relative Path Traversal, Use of a Broken or Risky...
CVE-2021-25377: Improper Authentication
Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P9.0 below, and 12.2.0.5 in Android Q10.0 above allows attacker to execute privileged action...
Security Bulletin: Infosphere BigInsights is affected by vulnerabilities in Apache HBase and Hive that could allow a remote attacker to gain unauthorized access to the system or authenticate with improper credentials (CVE-2015-1772, CVE-2015-1836).
Summary Infosphere BigInsights is affected by vulnerabilities in Apache HBase and Hive that could allow a remote attacker to gain unauthorized access to the system or authenticate with improper credentials CVE-2015-1772 , CVE-2015-1836. Vulnerability Details CVEID: CVE-2015-1772 DESCRIPTION: Apac...
CVE-2021-30158: Improper Authentication
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has security relevance because a blocked user might have accidentally shared a token, or might know that a token has been compromised, and yet is...
CVE-2021-29012: Improper Authentication
DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the admin is logged in, but is invalid temporarily during times when the admin is logged out. In other words, the cookie is functionally equivalent to a static password, and thus...
CVE-2019-20464: Improper Authentication
An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. By default, a mobile application is used to stream over UDP. However, the device offers many more services that also enable streaming. Although the service used by the mobile application requires a...
The vulnerability of the configuration management system and remote execution capabilities of SaltStack Salt lies in the improper implementation of authentication algorithms, allowing attackers to execute arbitrary code.
The vulnerability of the Configuration Management system and the remote execution of operations in SaltStack Salt is related to the improper implementation of the authentication algorithm. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
CVE-2019-5317: Improper Authentication
A local authentication bypass vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x: 6.5.4.15 and below; Aruba Instant 8.3.x: 8.3.0.11 and below; Aruba Instant 8.4.x: 8.4.0.5 and below; Aruba...
CVE-2021-3153: Improper Authentication
HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...