CVE-2018-10641: Improper Authentication

D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext...

CVE-2017-3775: Improper Authentication

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code...

CVE-2018-10544: Improper Authentication

Meross MSS110 devices through 1.1.24 contain an unauthenticated admin.htm administrative interface...

CVE-2018-9232: Improper Authentication

Due to the lack of firmware authentication in the upgrade process of T&W WIFI Repeater BE126 devices, an attacker can craft a malicious firmware and use it as an update...

CVE-2018-10576: Improper Authentication

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentication handling by the native Access Point web UI allows authentication using a local system account instead of the dedicated web-only user...

CVE-2018-1418: Improper Authentication

IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM X-Force ID: 138824...

CVE-2018-10362: Improper Authentication

An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1. Due to loose comparison with '==' instead of '===' in classes/Authorization.php for the user-provided login password, it is possible to login with a simpler password if the password has the form of a power in scientific notation like...

CVE-2018-1112: Improper Authentication

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression...

CVE-2017-12712: Improper Authentication

The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be compromised or bypassed, which may allow a nearby attacker to issue unauthorized commands to the pacemaker via RF communications. CVSS v3...

CVE-2018-0238

A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...

CVE-2018-0238: Improper Authentication

A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...

CVE-2017-12196: Improper Authentication

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the...

CVE-2016-10434: Improper Authentication

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 820 and SD 820A, the input to RPMB write response function is a buffer from HLOS that needs to be authenticated using HMAC and then processed. However, some of the processing...

AMD Driver Installer and Gaming Evolved Product plays.tv Service Code Execution Vulnerability

AMD driver-installation packages and Gaming Evolved products are both products of AMD, Inc. AMD driver-installation packages are a set of driver installation packages for AMD graphics cards. Gaming Evolved products are game optimization products. plays.tv is one of the game recording and sharing...

CVE-2017-2871: Improper Authentication

Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is in the same subnetwork of the camera or has remote administrator access can fully compromise the device by performing a firmware recovery...

AMD Driver Installer and Gaming Evolved Product plays.tv Service Write File Vulnerability

AMD driver-installation packages and Gaming Evolved products are both products of AMD, Inc. AMD driver-installation packages are a set of driver installation packages for AMD graphics cards. Gaming Evolved products are game optimization products. plays.tv is one of the game recording and sharing...

CVE-2018-6547: Improper Authentication

playsservice.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, contains an HTTP message parsing function that takes a user-defined path and writes non-user controlled data as SYSTEM to the file when the extractfiles...

CVE-2016-9646: Improper Authentication

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder-field method similar to the CGI-param API that led to Bugzilla's CVE-2014-1572, which can be abused to lead to commit metadata forgery...

CVE-2018-6546: Improper Authentication

playsservice.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, executes code at a user-defined local or SMB path as SYSTEM when the executeinstaller parameter is used in an HTTP message. This occurs without properly...

CVE-2017-14911: Improper Authentication

In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile, Snapdragon Automobile APQ8096AU, MDM9206, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 625, SD 650/52, SD 820, SD 835, it is possible for the XBL loader to skip the authentication of device config...