CVE-2019-10946: Missing Authentication for Critical Function

An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of comusers lacks access checks, allowing calls from unauthenticated users...

HP Color LaserJet CP4525 Printers 6.7.0.x Authentication Bypass

Exploit Title : HP Color LaserJet CP4525 Printers 6.7.0.x Bypass Missing Authentication Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 31/03/2019 Vendor Homepage : hp.com Software Information Link :...

HP LaserJet P3015 Printers 6.7.0.x Authentication Bypass

Exploit Title : HP LaserJet P3015 Printers 6.7.0.x Bypass Missing Authentication Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 31/03/2019 Vendor Homepage : hp.com Software Information Link :...

Unspecified Vulnerability Vulnerability in IBM Security Privileged Identity Manager

IBM Security Privileged Identity Manager ISPIM is an identity management product within the IBM Identity Governance and Management solution from IBM in the United States. The product is designed to protect, automate and audit the use of privileged identities to help defend against insider threats...

CVE-2019-5514: Missing Authentication for Critical Function

VMware VMware Fusion 11.x before 11.0.3 contains a security vulnerability due to certain unauthenticated APIs accessible through a web socket. An attacker may exploit this issue by tricking the host user to execute a JavaScript to perform unauthorized functions on the guest machine where VMware...

ENTTEC Lighting Controllers

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ENTTEC Equipment: Datagate MK2, Storm 24, Pixelator Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could reboot this...

ENTTEC Lighting Controllers

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ENTTEC Equipment: Datagate MK2, Storm 24, Pixelator Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could reboot this...

CVE-2019-7642: Missing Authentication for Critical Function

D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and login logs. Vulnerable targets include but are not limited to the latest firmware versions of DIR-817LW A1-1.04, DIR-816L B1-2.06, DIR-81...

CVE-2019-10042: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/LoadDefaultSettings to reset the router without authentication...

CVE-2019-10041: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/form2userconfig.cgi to edit the system account without authentication...

CVE-2019-10039: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/setSysAdm to edit the web or system account without authentication...

CVE-2018-20220

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated,...

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

WeblogicWsatRCE POC for CVE-2017-10271. Since java.lang.Proc...

CVE-2018-20220: Missing Authentication for Critical Function

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated,...

PT-2019-10021

Name of the Vulnerable Software and Affected Versions: Teracue ENC-400 devices with firmware 2.56 and below Description: An issue was discovered where a large portion of the HTTP endpoints are missing authentication, allowing an attacker to view these pages before being authenticated. Some of the...

CVE-2019-3917: Missing Authentication for Critical Function

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on the router via a crafted HTTP request...

CVE-2018-19636: Missing Authentication for Critical Function

Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges...

CVE-2019-9484: Missing Authentication for Critical Function

The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb configuration tool allows remote attackers to obtain access via an HTTP session on port 10000, as demonstrated by reading the modem password which is 1234, or reconfiguring "party mode" or "vacation mode."...

CVE-2019-9201: Missing Authentication for Critical Function

Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to traverse all directories...

Teracue ENC-400 - Command Injection Missing Authentication

Teracue ENC-400 - Command Injection Missing Authentication Introduction ============ Multiple vulnerabilities were identified within the Teracue ENC-400, including pre-authenticated remote code authentication. While the vendor has released updated firmware after these issues were identified, they...