CVE-2019-3948: Missing Authentication for Critical Function

The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX883X and DH-IPC-HX863X V2.622.0000000.7.R, Dahua DH-SD4XXXXX V2.623.0000000.7.R, Dahua DH-SD5XXXXX V2.623.0000000.1.R, Dahua DH-SD6XXXXX V2.640.0000000.2.R an...

CVE-2019-13983: Missing Authentication for Critical Function

Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...

CVE-2019-10915: Missing Authentication for Critical Function

A vulnerability has been identified in TIA Administrator All versions V1.0 SP1 Upd1. The integrated configuration web application TIA Administrator allows to execute certain application commands without proper authentication. The vulnerability could be exploited by an attacker with local access t...

CVE-2019-10121: Missing Authentication for Critical Function

eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via the user authentication dialogue, aka HMCCU-153. This leads to automatic login as admin...

CVE-2019-10119: Missing Authentication for Critical Function

eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via an invalid login attempt to the RemoteApi account, aka HMCCU-154. This leads to automatic login as admin...

CVE-2019-13338: Missing Authentication for Critical Function

In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field...

CVE-2019-11020: Missing Authentication for Critical Function

Lack of authentication in file-viewing components in DDRT Dashcom Live 2019-05-09 allows anyone to remotely access all claim details by visiting easily guessable dashboard/uploads/claimfiles/claimid URLs...

CVE-2019-11019: Missing Authentication for Critical Function

Lack of authentication in case-exporting components in DDRT Dashcom Live through 2019-05-08 allows anyone to remotely access all claim details by visiting easily guessable exportpdf/allclaimdetail.php?claimid= URLs...

CVE-2019-4337

IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412...

CVE-2019-4337: Missing Authentication for Critical Function

IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412...

PT-2019-17039 · Automation Anywhere +1 · Automation Anywhere +1

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation with Automation Anywhere version 11 Description: The issue is related to missing authentication in Ignite nodes, which could allow an attacker to obtain sensitive information. Recommendations: For IBM Robotic...

CVE-2019-12919: Missing Authentication for Critical Function

On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the local network has unauthenticated access to the internal SD card via the HTTP service on port 8000. The HTTP web server on the camera allows anyone to view or download the video archive recorded and saved o...

CVE-2019-1876: Missing Authentication for Critical Function

A vulnerability in the HTTPS proxy feature of Cisco Wide Area Application Services WAAS Software could allow an unauthenticated, remote attacker to use the Central Manager as an HTTPS proxy. The vulnerability is due to insufficient authentication of proxy connection requests. An attacker could...

CVE-2019-1631: Missing Authentication for Critical Function

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to access potentially sensitive system usage information. The vulnerability is due to a lack of proper data protection mechanisms. An attacker could...

CVE-2019-12890: Missing Authentication for Critical Function

RedwoodHQ 2.5.5 does not require any authentication for database operations, which allows remote attackers to create admin users via a con.automationframework users insertone call...

Siemens Siveillance VMS Authorization Issues Vulnerability

Siemens Siveillance VMS is a set of surveillance video management software from Siemens Germany. An authorization issue vulnerability exists in Siemens Siveillance VMS. The vulnerability stems from a lack of authentication measures or insufficient authentication strength in a networked system or...

CVE-2017-15123: Missing Authentication for Critical Function

A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines...

CVE-2019-0312: Missing Authentication for Critical Function

Several web pages provided SAP NetWeaver Process Integration versions: SAPXIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAPXITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50 are not password protected. An attacker could access landscape information like host names, ports or other technical data...

CVE-2019-9879: Missing Authentication for Critical Function

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation...

CVE-2019-9881: Missing Authentication for Critical Function

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled...