CVE-2016-3176: Improper Authentication

Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient...

GLSA-201701-70 : Firewalld: Improper authentication methods

The remote host is affected by the vulnerability described in GLSA-201701-70 Firewalld: Improper authentication methods A flaw in Firewalld allows any locally logged in user to tamper with or change firewall settings. This is due to how Firewalld handles authentication via polkit which is not...

CVE-2017-3795: Improper Authentication

A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct arbitrary password changes against any non-administrative user. More Information: CSCuz03345. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.12...

CVE-2017-5554: Improper Authentication

An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can iss...

CVE-2016-4484: Improper Authentication

The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password...

CVE-2016-7144: Improper Authentication

The mauthenticate function in modules/msasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter...

CVE-2016-6659: Improper Authentication

Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release aka uaa-release before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UAA logs and subsequently running a specially craft...

CVE-2016-6474: Improper Authentication

A vulnerability in the implementation of X.509 Version 3 for SSH authentication functionality in Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication on an affected system. More Information: CSCuv89417. Known Affected Releases: 15.52.25T. Known...

CVE-2016-9796: Improper Authentication

Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication, and OmniVista invokes methods AddJobSet, AddJob, and ExecuteNow that can be used to run arbitrary commands on the...

CVE-2016-2944: Improper Authentication

IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach...

Kibana 5.0.2 released with a fix for improper authentication

With X-Pack installed, operations in the Advanced Settings panel of the Management tab and operations from the short URL service were performed as the "Kibana Server" user regardless of the user that is currently authenticated. As a result, a user that was defined as read-only could make changes ...

Aruba Networks AOS 6.3.1.19 Improper Authentication Vulnerability

Arube Networks AOS version 6.3.1.19 has a special key combination that escalates privileges. Product: AOS Manufacturer: Aruba Networks Affected Versions: 6.3.1.19 Tested Versions: 6.3.1.19 on an RAP-3 router Vulnerability Type: Improper Authentication Risk Level: High Solution Status: Open...

Aruba Networks AOS 6.3.1.19 Improper Authentication

Advisory ID: SYSS-2016-085 Product: AOS Manufacturer: Aruba Networks Affected Versions: 6.3.1.19 Tested Versions: 6.3.1.19 on an RAP-3 router Vulnerability Type: Improper Authentication Risk Level: High Solution Status: Open Manufacturer Notification: 2016-09-06 Solution Date: -- Public Disclosur...

CVE-2016-6397: Improper Authentication

A vulnerability in the interdevice communications interface of the Cisco IP Interoperability and Collaboration System IPICS Universal Media Services UMS could allow an unauthenticated, remote attacker to modify configuration parameters of the UMS and cause the system to become unavailable. Affect...

CVE-2016-7141: Improper Authentication

curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has...

CVE-2016-7191: Improper Authentication

The Microsoft Azure Active Directory Passport aka Passport-Azure-AD library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token...

CVE-2016-4966: Improper Authentication

The diagnosiscontrol.php page in Fortinet FortiWan formerly AscernLink before 4.2.5 allows remote authenticated users to download PCAP files via vectors related to the UserName GET parameter...

CVE-2016-4860: Improper Authentication

Yokogawa STARDOM FCN/FCJ controller R1.01 through R4.01 does not require authentication for Logic Designer connections, which allows remote attackers to reconfigure the device or cause a denial of service via a 1 stop application program, 2 change value, or 3 modify application command...

CVE-2016-0883: Improper Authentication

Pivotal Cloud Foundry PCF Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass session authentication by leveraging knowledge of this key from another installation...

CVE-2016-7112: Improper Authentication

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...