CWE:

	Topic	Date	Author
Low	SAP FRUN Simple Diagnostics Agent 1.0 Missing Authentication	22.06.2022	Yvan Genuer
Med.	SAP Netweaver JAVA 7.50 Missing Authorization	17.06.2021	Ignacio D. Favro
Med.	URVE Software Build 24.03.2020 Authentication Bypass / Remote Code Execution	30.12.2020	Erik Steltzner
Med.	IBM Cognos TM1 / IBM Planning Analytics Server Configuration Overwrite / Code Execution	29.03.2020	Pedro Ribeiro
Med.	Sophos UTM 9.410 loginuser confd Service Privilege Escalation	06.03.2018	KoreLogic
Med.	JD Edwards 9.1 EnterpriseOne Server Denial Of Service	28.08.2016	Fernando Russ and Mati...
Med.	JD Edwards 9.1 EnterpriseOne Server Create Users	28.08.2016	Fernando Russ and Mati...
High	SAP TREX 7.10 Revision 63 Remote Command Execution	22.08.2016	Multiple
Med.	Davolink DV-2051 Missing Access Control	06.08.2016	Eric Flokstra
High	InFocus IN3128HD Projector Missing Authentication	28.04.2015	CORE
High	Allied Telesis AT-RG634A ADSL router unauthenticated webshell	26.03.2014	Sebastian Muniz
High	INSTEON Hub 2242-222 Lack Of Authentication	02.08.2013	David Bryan

---

CVEMAP Search Results

CVE

Details

Description

2023-06-02

	CVE-2023-30604	Updating...	It is identified a vulnerability of insufficient authentication in the system configuration interface of Hitron Technologies CODA-5310. An unauthorized remote attacker can exploit this vulnerability to access system configuration interface, resulting in performing arbitrary system operation or disrupt service.
	CVE-2023-25780	Updating...	It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with normal user privilege can exploit this vulnerability to modify substitute agent to arbitrary users, resulting in serious consequence.

2023-05-18

CVE-2023-32680

Updating...

2023-05-09

	CVE-2023-31143	Updating...	mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.
	CVE-2023-30744	Updating...	In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use of an open naming and directory API to instantiate an object which has methods which can be called without further authorization and authentication.  A subsequent call to one of these methods can read or change the state of existing services without any effect on availability.

2023-04-27

CVE-2023-28697

Updating...

Moxa MiiNePort E1 has a vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to perform arbitrary system operation or disrupt service.

2023-04-21

CVE-2023-2231

Updating...

A vulnerability, which was classified as critical, was found in MAXTECH MAX-G866ac 0.4.1_TBRO_20160314. This affects an unknown part of the component Remote Management. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227001 was assigned to this vulnerability.

2023-04-19

CVE-2023-30612

Updating...

Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors in the Cloud Hypervisor process via sending malicious HTTP request through the HTTP API socket. As a result, the Cloud Hypervisor process can be easily crashed, causing Deny-of-Service (DoS). This can also be a potential Use-After-Free (UAF) vulnerability. Users require to have the write access to the API socket file to trigger this vulnerability. Impacted versions of Cloud Hypervisor include upstream main branch, v31.0, and v30.0. The vulnerability was initially detected by our `http_api_fuzzer` via oss-fuzz. This issue has been addressed in versions 30.1 and 31.1. Users unable to upgrade may mitigate this issue by ensuring the write access to the API socket file is granted to trusted users only.

2023-04-18

	CVE-2023-29413	Updating...	A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unauthenticated user on the Schneider UPS Monitor service.
	CVE-2023-29411	Updating...	A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading to potential remote code execution without requiring prior authentication on the Java RMI interface.

 

---

Copyright 2023, cxsecurity.com