CVE-2023-6483 Improper Authentication Vulnerability in ADiTaaS

The vulnerability exists in ADiTaaS Allied Digital Integrated Tool-as-a-Service version 5.1 due to an improper authentication vulnerability in the ADiTaaS backend API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable...

CVE-2023-46096

A vulnerability has been identified in SIMATIC PCS neo All versions V4.1. The PUD Manager of affected products does not properly authenticate users in the PUD Manager web service. This could allow an unauthenticated adjacent attacker to generate a privileged token and upload additional documents...

PT-2023-23094 · Palantir · Palantir Tiles1

Name of the Vulnerable Software and Affected Versions: Palantir Tiles1 affected versions not specified Description: The Palantir Tiles1 service was found to be vulnerable to an API-wide issue where the service was not performing authentication/authorization on all the endpoints. Recommendations: ...

Electrolink FM/DAB/TV Transmitter Remote Authentication Removal Exploit

Electrolink FM/DAB/TV Transmitter suffers from an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the admin panel. It is also vulnerable to account takeover and arbitrary password change. !/usr/bin/env python Electrolink FM/DAB/T...

PT-2023-28895 · Sing-Box · Sing-Box

Name of the Vulnerable Software and Affected Versions: Sing-box versions prior to 1.4.4 Sing-box versions prior to 1.5.0-rc.4 Description: The issue affects all SOCKS5 inbounds with user authentication in Sing-box, allowing an attacker to bypass authentication when specially crafted requests are...

PT-2023-31023 · Unknown · Anything-Llm

Name of the Vulnerable Software and Affected Versions: anything-llm version prior to 0.0.1 Description: The issue is related to an Authentication Bypass by Primary Weakness in the GitHub repository mintplex-labs/anything-llm. Recommendations: For versions prior to 0.0.1, update to version 0.0.1 o...

Intelbras SG 2404 MR 安全漏洞

The Intelbras SG 2404 MR is a switch with network management capabilities from Intelbras of Brazil. A security vulnerability exists in the Intelbras SG 2404 MR version 1.00.54, which stems from an authentication bypass that allows an unauthenticated attacker to download a backup file of the devic...

PT-2023-24861 · Percona · Percona Monitoring/Management

Name of the Vulnerable Software and Affected Versions: Percona Monitoring and Management PMM server versions 2.x through 2.37.0 Description: The issue arises from the authenticate function in auth server.go not properly formalizing and sanitizing URL paths, which fails to reject path traversal...

CVE-2023-27388

Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to login to the product as a registered user. Affected products and versions are as follows: T&D Corporation data logger products TR-71W/72W all firmware...

PT-2023-23855 · Trend Micro · Trend Micro Mobile Security

Name of the Vulnerable Software and Affected Versions: Trend Micro Mobile Security Enterprise version 9.8 SP5 Description: The issue allows a remote user to bypass authentication, potentially chaining with other vulnerabilities. An attacker must first obtain the ability to execute low-privileged...

PT-2023-9679 · Grub · Grub

Name of the Vulnerable Software and Affected Versions: GRUB affected versions not specified Description: The issue is related to a bypass of authentication mechanisms through spoofing, allowing an attacker to circumvent the authentication process and potentially elevate their privileges within th...

CVE-2022-43623

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43625

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2023-21027

In multiple functions of PasspointXmlUtils.java, there is a possible authentication misconfiguration due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Trend Micro TXOne StellarOne Improper Access Control Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of Trend Micro TXOne StellarOne. Authentication is required to exploit this vulnerability. The specific flaw exists within the Account endpoint. The issue results from the lack of proper access control. An...

CVE-2023-25573 Improper access control to download file in metersphere

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

PT-2023-16321 · Forgerock · Forgerock Access Management Java Policy Agent

Name of the Vulnerable Software and Affected Versions: ForgeRock Access Management Java Policy Agent versions up to 5.10.1 Description: The issue is related to a Relative Path Traversal vulnerability that allows Authentication Bypass in the ForgeRock Access Management Java Policy Agent...

CVE-2023-24810 Cross site scripting (XSS) vulnerability using authentication callback in Misskey

Misskey is an open source, decentralized social media platform. Due to insufficient validation of the redirect URL during miauth authentication in Misskey, arbitrary JavaScript can be executed when a user allows the link. All versions below 13.3.1 including 12.x are affected. This has been fixed ...

CVE-2022-40720

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Dreambox plugin for the xupnpd service, which listens on...

CVE-2022-40718

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the anweb service, which listens on TCP ports 80 and 443 by default. The issue...