CVE-2019-15987: Improper Authentication

A vulnerability in web interface of the Cisco Webex Event Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center could allow an unauthenticated, remote attacker to guess account usernames. The vulnerability is due to missing CAPTCHA protection in certain...

CVE-2019-16286: Improper Authentication

An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by changing browser preferences to launch a separate process that in turn can execute arbitrary commands...

CVE-2014-2904: Improper Authentication

wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication...

CVE-2019-19006: Improper Authentication

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control...

CVE-2019-15803: Improper Authentication

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fdssyspassDebugPasswdret. The...

Node.js third-party modules: [authmagic-timerange-stateless-core] Improper Authentication

I would like to report Improper Authentication in authmagic-timerange-stateless-core It allows to forge user's identity. Module module name: authmagic-timerange-stateless-core version: 0.0.9 npm page: https://www.npmjs.com/package/authmagic-timerange-stateless-core Module Description Stateless an...

CVE-2019-5233

Huawei smartphones with versions earlier than Taurus-AL00B 10.0.0.41SP2C00E41R3P2 have an improper authentication vulnerability. Successful exploitation may cause the attacker to access specific components...

CVE-2013-3367: Improper Authentication

Undocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg24Mhw3...

CVE-2019-18848: Improper Authentication

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...

CVE-2019-5213: Improper Authentication

Honor play smartphones with versions earlier than Cornell-AL00A 9.1.0.321C00E320R1P1T8 have an insufficient authentication vulnerability. The system has a logic judge error under certain scenario. Successful exploit could allow the attacker to modify the alarm clock settings after a serious of...

CVE-2019-5233: Improper Authentication

Huawei smartphones with versions earlier than Taurus-AL00B 10.0.0.41SP2C00E41R3P2 have an improper authentication vulnerability. Successful exploitation may cause the attacker to access specific components...

CVE-2019-1382: Undefined Security Weakness

An elevation of privilege vulnerability exists when ActiveX Installer service may allow access to files without proper authentication, aka 'Microsoft ActiveX Installer Service Elevation of Privilege Vulnerability'...

Siemens En100 Improper Authentication

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

CVE-2019-13531: Improper Authentication

In Medtronic Valleylab FT10 Energy Platform VLFT10GEN version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform VLLS10GEN—not available in the United States version 1.20.2 and lower, the RFID security mechanism used for authentication between the FT10/LS10 Energy...

Siemens Apogee Improper Authentication

A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions V3.5. An attacker with network access to the integrated web server 80/tcp and 443/tcp could bypass the authentication and download sensitive information from the device. File data...

Rockwellautomation Controllogix Improper Authentication

The web-server password-authentication functionality in Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and...

Schneider-electric Modicon Improper Authentication

Schneider Electric Modicon Quantum PLC does not perform authentication between the Unity software and PLC, which allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors. File data ot500033.nasl...

Medtronic Valleylab FT10 and LS10

1. EXECUTIVE SUMMARY CVSS v3 4.8 ATTENTION: Low skill level to exploit Vendor: Medtronic Equipment: Valleylab FT10, Valleylab LS10 Vulnerabilities: Improper Authentication, Protection Mechanism Failure 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow an attacker to...

CVE-2013-5123: Improper Authentication

The mirroring support -M, --use-mirrors in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks...

CVE-2019-1980: Improper Authentication

A vulnerability in the protocol detection component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to...