CWE:
 

Topic
Date
Author
Med.
Ember Enterprises E2in Improper Authentication
13.12.2020
KingSkrupellos
Med.
Sanishsoft Authentication Bypass
13.12.2020
KingSkrupellos
Med.
Sharptech Digital Marketing Agency Authentication Bypass
13.12.2020
KingSkrupellos
High
WebDehasi Hosting File Insert Authentication Bypass
09.11.2020
KingSkrupellos
Med.
HindSoft Technology Pvt Ltd India Insert File Authentication Bypass
08.11.2020
KingSkrupellos
Med.
HigsonMedia Improper Authentication
29.05.2020
KingSkrupellos
Med.
UinfoTechnology Pvt Ltd Gentelella Alela Colorlib Improper Authentication
29.05.2020
KingSkrupellos
Med.
Mildtrix Business Solutions Pvt Ltd 2.3.12 Improper Authentication
29.05.2020
KingSkrupellos
Med.
Solidale InfoTech Authentication Bypass
28.05.2020
KingSkrupellos
Med.
Bagwar Softwares Pvt Ltd Authentication Bypass
28.05.2020
KingSkrupellos
Med.
Saloni Info Tech Accocca Constructions Pvt Ltd Authentication Bypass
28.05.2020
KingSkrupellos
Med.
Ayan Advisory Private Limited Authentication Bypass
28.05.2020
KingSkrupellos
Med.
Teak Squash Design and Solutions Authentication Bypass
28.05.2020
KingSkrupellos
Med.
Gharuda Infotech Pvt Ltd Authentication Bypass
28.05.2020
KingSkrupellos
Med.
NextgenUSCorp Authentication Bypass
27.05.2020
KingSkrupellos
Med.
Upturn Smart Online Exam System Mayuri Authentication Bypass
27.05.2020
KingSkrupellos
High
WebIndiaServices Team Authentication Bypass
27.05.2020
KingSkrupellos
Med.
School Sports Promotion Foundation Sspf India Authentication Bypass
27.05.2020
KingSkrupellos
Med.
Gangotri Group Shubham Srivastava Authentication Bypass
27.05.2020
KingSkrupellos
Med.
3NetWorks Authentication Bypass
27.05.2020
KingSkrupellos
Med.
Chamilo © 2020 Campus v1 ElFinder Backdoor Access Shell Upload Vulnerability
27.05.2020
KingSkrupellos
Med.
ABCMedya Bilişim Software 2.0 Authentication Bypass
20.05.2020
KingSkrupellos
Med.
Sync Bilişim Software Arbitrary File Upload Authentication Bypass
20.05.2020
KingSkrupellos
Med.
Ja IT Solution JaisBD Bangladesh Software Authentication Bypass
18.05.2020
KingSkrupellos
Med.
Saudi Indian Football Forum Siffjeddah Authentication Bypass Shell Upload
11.05.2020
KingSkrupellos
Med.
Great Web Solutions Pvt Ltd Improper Authentication
09.05.2020
KingSkrupellos
Med.
LBMInfoTech Improper Authentication
09.05.2020
KingSkrupellos
Med.
Tiol Group WebSites Taxindiainternational Pvt Ltd Improper Authentication
09.05.2020
KingSkrupellos
Med.
Great Web Solutions Pvt Ltd Improper Authentication
09.05.2020
KingSkrupellos
Med.
Tiol Group WebSites Taxindiainternational Pvt Ltd Improper Authentication
09.05.2020
KingSkrupellos
Med.
LBMInfoTech Improper Authentication
09.05.2020
KingSkrupellos
High
ThietkeWebX Quatangtraitim VietNext Unauthorized File Upload Improper Authentication
06.05.2020
KingSkrupellos
Med.
Suvega Digital Media Pvt Ltd Improper Authentication
06.05.2020
KingSkrupellos
Med.
Du Hoc Ioc Vietnamese System Improper Authentication
06.05.2020
KingSkrupellos
Med.
Niladri Marketing Pvt. Ltd. Triimax_Ind Siimax Infotimes Improper Authentication
04.05.2020
KingSkrupellos
Med.
WebTechnologic SQL Injection Improper Authentication
04.05.2020
KingSkrupellos
Med.
ComangSoft Improper Authentication
03.05.2020
KingSkrupellos
Med.
Skynyx Technologies Private Limited Improper Authentication
03.05.2020
KingSkrupellos
Med.
GloriousWebTech Improper Authentication
03.05.2020
KingSkrupellos
Med.
Mystic Media Webinitiate Improper Authentication Backdoor Access
03.05.2020
KingSkrupellos
Med.
SkyWayInfoMedia Improper Authentication
03.05.2020
KingSkrupellos
Med.
TechDomain BD Improper Authentication
03.05.2020
KingSkrupellos
Med.
Pinnacle India Solution Admin Authentication Bypass
15.04.2020
KingSkrupellos
Med.
SSInfoTech Rohini WebDesign Company Authentication Bypass
18.09.2019
KingSkrupellos
Med.
Cisco UCS / IMC Supervisor Authentication Bypass / Command Injection
29.08.2019
Pedro Ribeiro
Med.
RecargatonerAntequera Improper Authentication Vulnerability
20.08.2019
KingSkrupellos
Med.
Sistema Mobiliario en Movimiento ComponentsMx Authentication Bypass Insert File Vulnerability
19.08.2019
KingSkrupellos
Med.
Sistema Suanca Industrias Authentication Bypass Insert File Vulnerability
19.08.2019
KingSkrupellos
Med.
Sistema CodiFarma San Jose de los Cedros Authentication Bypass Insert File Vulnerability
19.08.2019
KingSkrupellos
Med.
Bgrecuperacion Chihuahua Authentication Bypass Insert File Vulnerability
19.08.2019
KingSkrupellos
Med.
UfaCup88 Authentication Bypass Insert File Vulnerability
19.08.2019
KingSkrupellos
Med.
Keros ClaudioGarau Improper Authentication Insert File Vulnerability
19.08.2019
KingSkrupellos
Med.
AlemReklam Ajans Improper Authentication File Upload Vulnerability
17.08.2019
KingSkrupellos
Med.
Sistema Vitapromin Nuticion Inteligente Improper Authentication File Upload Vulnerability
11.08.2019
KingSkrupellos
Med.
Powered By Vlaevski Site Administration 1.0 Improper Authentication File Upload Vulnerability
11.08.2019
KingSkrupellos
Med.
Ellucian Banner Web Tailor / Banner Enterprise Identity Services Improper Authentication
14.05.2019
Joshua Mulliken
Med.
Desenvolvido por Agencia CDG Design Brasil Improper Authentication
09.04.2019
KingSkrupellos
Med.
Webmaster Atom Computer Software Counselling Improper Access Control Vulnerability
16.10.2018
KingSkrupellos
Low
WordPress Developed by Netsoft Limited Software Development Bangladesh Improper Authentication Vulnerability
05.09.2018
KingSkrupellos
Med.
Designed & Developed by Sacit.Lk SriLanka Improper Authentication Vulnerability
05.07.2018
KingSkrupellos
Med.
Powered by Yii Framework RBAC Manager for Yii 2 Improper Authentication Vulnerability
01.07.2018
KingSkrupellos
Med.
JanTek JTC-200 RS232-NET Connector CSRF / Missing Authentication
01.11.2017
Karn Ganeshen
Med.
Samsung Smart TV Wi-Fi Direction Improper Authentication
27.04.2017
Neseso Research Team
Med.
Aruba Networks AOS 6.3.1.19 Improper Authentication
08.11.2016
Klaus Tichman
High
DOKEOS ce30 Authentication Bypass
19.02.2016
High-Tech Bridge Secur...
Low
Pentaho 5.2.x BA Suite / PDI Information Disclosure
20.09.2015
Gregory DRAPERI
High
SAP HANA IU5 SDK Authentication Bypass
30.07.2014
Onapsis
High
Dahua DVR Authentication Bypass
19.07.2014
Zhejiang
High
ASUS RT Router Anonymous FTP Access
14.02.2014
Kyle Lovett
High
Router D-Link DIR-100 Multiple Vulnerabilities
04.02.2014
Felix Richter
High
Nisuta NS-WIR150NE, NS-WIR300N Authentication Bypass
11.01.2014
ampliasecurity
Med.
Burden 1.8 Privilege Escalation
09.01.2014
High-Tech Bridge Secur...
High
Vivotek IP Cameras RTSP Authentication Bypass
06.11.2013
CORE
High
Radio Thermostat Of America Inc Lack Of Authentication
02.08.2013
Daniel Crowley
High
D-Link IP Cameras Injection & Bypass
30.04.2013
CORE
Med.
Cisco Firewall Services Module Software Multiple Vulnerabilities
10.04.2013
Cisco
Med.
EMC Smarts Network Configuration Manager Improper Authentication Vulnerability
27.03.2013
EMC
Med.
Backupbuddy 2.2.4 Sensitive Data Exposure
25.03.2013
robarmstrong.te71
High
PBBoard 2.1.4 SQL Injection and Improper Authentication
09.08.2012
High-Tech Bridge Secur...
Med.
LifeSize Room Vulnerabilities
05.09.2011
securestate net
High
RealVNC Authentication Bypass
31.08.2011
Juha-Matti
High
RSA Adaptive Authentication (On-Premise) Security Issue
24.08.2011
EMC
Med.
FreeRADIUS 2.1.11 Multiple Vulns
06.08.2011
DCERT
High
IBM Lotus Domino Server Controller Authentication Bypass Remote Code Execution Vulnerability
30.03.2011
ZDI
Med.
Arthur de Jong \'nss-pam-ldapd\' Authentication Bypass Vulnerability
17.03.2011
Russell Sim
High
Pointter PHP Content Management System 1.0 Privilege Escalation
16.12.2010
Mark Stanislav
High
Pointter PHP Micro-Blogging Social Network 1.0 Privilege Escalation
16.12.2010
Mark Stanislav
High
OpenSSL J-PAKE Validation Error Lets Remote Users Validate Without Shared Secret Key
08.12.2010
Sebastian Martini
High
Pandora FMS <= 3.1 Authentication Bypass
05.12.2010
Juan Galiana Lara
High
Cisco Unified Videoconferencing multiple vulnerabilities
24.11.2010
Florent Daigniere
High
Camtron CMNC-200 IP Camera Authentication Bypass
18.11.2010
Trustwave's SpiderLabs
High
IBM OmniFind - several vulnerabilities
15.11.2010
Fatih Kilic
High
Likewise Open 5.4 & 6.0 Multiple Vulns
29.07.2010
Gerald Carter
Low
dootzky oblog Persistant XSS, CSRF, Admin Bruteforce
29.06.2010
null
Med.
SpringSource tc Server unauthenticated remote access to JMX interface
25.05.2010
s2-security
High
ToutVirtual VirtualIQ Multiple Vulnerabilities
21.05.2010
Claudio Criscione
High
CA XOsoft Multiple Vulns.
10.04.2010
Andrea Micalizzi aka r...
High
Varnish reverse proxy 2.0.6 Medium security hole
07.04.2010
Tim Brown
Med.
Sahana 0.6.2.2 authentication bypass
19.03.2010
nill
High
HP openview Performance Insight 5.4 Remote Execution of ArbitraryCommands
15.03.2010
HP


CVEMAP Search Results

CVE
Details
Description
2024-02-24
Waiting for details
CVE-2024-22395

Updating...
 

 
Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associate another user's MFA mobile application.

 
2024-02-23
Waiting for details
CVE-2024-1817

Updating...
 

 
A vulnerability has been found in Demososo DM Enterprise Website Building System up to 2022.8 and classified as critical. Affected by this vulnerability is the function dmlogin of the file indexDM_load.php of the component Cookie Handler. The manipulation of the argument is_admin with the input y leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254605 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

 
2024-02-17
Waiting for details
CVE-2022-41738

Updating...
 

 
IBM Storage Scale Container Native Storage Access 5.1.2.1 -through 5.1.7.0 could allow an attacker to initiate connections to containers from external networks. IBM X-Force ID: 237812.

 
2024-02-15
Waiting for details
CVE-2024-20738

Updating...
 

 
Adobe Framemaker versions 2022.1 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass authentication mechanisms and gain unauthorized access. Exploitation of this issue does not require user interaction.

 
2024-02-14
Waiting for details
CVE-2024-0568

Updating...
 

 
CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering of device configuration over NFC communication.

 
Waiting for details
CVE-2024-25618

Updating...
 

 
Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML, OIDC) to attach to existing local users with the same e-mail address. This results in a possible account takeover if the authentication provider allows changing the e-mail address or multiple authentication providers are configured. When a user logs in through an external authentication provider for the first time, Mastodon checks the e-mail address passed by the provider to find an existing account. However, using the e-mail address alone means that if the authentication provider allows changing the e-mail address of an account, the Mastodon account can immediately be hijacked. All users logging in through external authentication providers are affected. The severity is medium, as it also requires the external authentication provider to misbehave. However, some well-known OIDC providers (like Microsoft Azure) make it very easy to accidentally allow unverified e-mail changes. Moreover, OpenID Connect also allows dynamic client registration. This issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workarounds for this vulnerability.

 
2024-02-13
Waiting for details
CVE-2024-23813

Updating...
 

 
A vulnerability has been identified in Polarion ALM (All versions). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code.

 
2024-02-08
Waiting for details
CVE-2024-25106

Updating...
 

 
OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/{org_id}/users/{email_id}" endpoint. This vulnerability allows any authenticated user within an organization to remove any other user from that same organization, irrespective of their respective roles. This includes the ability to remove users with "Admin" and "Root" roles. By enabling any organizational member to unilaterally alter the user base, it opens the door to unauthorized access and can cause considerable disruptions in operations. The core of the vulnerability lies in the `remove_user_from_org` function in the user management system. This function is designed to allow organizational users to remove members from their organization. The function does not check if the user initiating the request has the appropriate administrative privileges to remove a user. Any user who is part of the organization, irrespective of their role, can remove any other user, including those with higher privileges. This vulnerability is categorized as an Authorization issue leading to Unauthorized User Removal. The impact is severe, as it compromises the integrity of user management within organizations. By exploiting this vulnerability, any user within an organization, without the need for administrative privileges, can remove critical users, including "Admins" and "Root" users. This could result in unauthorized system access, administrative lockout, or operational disruptions. Given that user accounts are typically created by "Admins" or "Root" users, this vulnerability can be exploited by any user who has been granted access to an organization, thereby posing a critical risk to the security and operational stability of the application. This issue has been addressed in release version 0.8.0. Users are advised to upgrade.

 
Waiting for details
CVE-2024-24830

Updating...
 

 
OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/{org_id}/users" endpoint. This vulnerability allows any authenticated regular user ('member') to add new users with elevated privileges, including the 'root' role, to an organization. This issue circumvents the intended security controls for role assignments. The vulnerability resides in the user creation process, where the payload does not validate the user roles. A regular user can manipulate the payload to assign root-level privileges. This vulnerability leads to Unauthorized Privilege Escalation and significantly compromises the application's role-based access control system. It allows unauthorized control over application resources and poses a risk to data security. All users, particularly those in administrative roles, are impacted. This issue has been addressed in release version 0.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

 
2024-02-07
Waiting for details
CVE-2023-39196

Updating...
 

 
Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication. The attacker is not allowed to do any modification within the Ozone Storage Container Manager service using this vulnerability. The accessible metadata does not contain sensitive information that can be used to exploit the system later on, and the accessible data does not make it possible to gain access to actual user data within Ozone. This issue affects Apache Ozone: 1.2.0 and subsequent releases up until 1.3.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

 

 


Copyright 2024, cxsecurity.com

 

Back to Top