CWE:

	Topic	Date	Author
Med.	Barco wePresent Authentication Bypass	21.11.2020	Jim Becher
Med.	ABUS Secvest Hybrid Module FUMO50110 Authentication Bypass	01.08.2020	Matthias Deeg
High	Seagate GoFlex Satellite Remote Telnet Default Password	19.12.2015	Matt Bergin
High	Linksys EA6100 Wireless Router Authentication Bypass	05.12.2015	Matt Bergin
Med.	Password Safe And Repository Enterprise 7.4.4 Build 2247 SQL Injection	13.10.2015	Matthias Deeg
High	BullGuard Internet Security 15.0.297 Authentication Bypass	08.05.2015	Matthias Deeg
High	BullGuard Antivirus 15.0.297 Authentication Bypass	07.05.2015	Matthias Deeg
High	BullGuard Premium Protection 15.0.297 Authentication Bypass	07.05.2015	Matthias Deeg
High	InFocus IN3128HD Projector Missing Authentication	28.04.2015	CORE
High	Panda Internet Security 2015 15.0.1 Authentication Bypass	15.04.2015	Matthias Deeg
High	Panda Gold Protection 2015 15.1.0 Authentication Bypass	15.04.2015	Matthias Deeg
High	Panda Global Protection 2015 15.1.0 Authentication Bypass	15.04.2015	Matthias Deeg
High	Panda Antivirus Pro 2015 15.1.0 Authentication Bypass	15.04.2015	Matthias Deeg
Med.	Linksys Access Bypass	17.08.2013	K Lovett & M Claunch

---

CVEMAP Search Results

CVE

Details

Description

2024-10-10

CVE-2024-9522

Updating...

The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to incorrect authentication and capability checking in the 'ajax_masq_login' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator.

2024-10-08

	CVE-2024-46887	Updating...	The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum communication load.
	CVE-2024-8943	Updating...	The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insufficient verification on the user being supplied during the booking customer step. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. Note that logging in as a WordPress user is only possible if the "Use WordPress users as customers" setting is enabled, which is disabled by default. The vulnerability is partially patched in version 5.0.12 and fully patched in version 5.0.13.

2024-10-01

	CVE-2024-9106	Updating...	The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verification on the user being supplied during the social login. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. This is only exploitable if the app secret is not set, so it has a default empty value.
	CVE-2024-9289	Updating...	The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is due to the rtwwwap_login_request_callback() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's email.

2024-09-26

CVE-2024-7781

Updating...

The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5. This is due to improper authentication via the Social Login widget. This makes it possible for unauthenticated attackers to log in as the first user to have logged in with a social media account, including administrator accounts. Attackers can exploit the vulnerability even if the Social Login element has been disabled, as long as it was previously enabled and used. The vulnerability was partially patched in version 4.7.5, and fully patched in version 4.7.8.

2024-09-25

CVE-2024-43692

Updating...

An attacker can directly request the ProGauge MAGLINK LX CONSOLE resource sub page with full privileges by requesting the URL directly.

2024-09-11

CVE-2024-8277

Updating...

The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating what user transient is being used in the login() function and not properly verifying the user's identity. This makes it possible for unauthenticated attackers to log in as user that has dismissed an admin notice in the past 30 days, which is often an administrator. Alternatively, a user can log in as any user with any transient that has a valid user_id as the value, though it would be more difficult to exploit this successfully.

2024-08-22

CVE-2024-35151

Updating...

IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs.

2024-08-13

CVE-2024-35124

Updating...

A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674.

 

---

Copyright 2024, cxsecurity.com