Total
2926 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-0356 | 2 Debian, Ikiwiki | 2 Debian Linux, Ikiwiki | 2018-05-18 | 7.5 HIGH | 9.8 CRITICAL |
| A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters. | |||||
| CVE-2014-3999 | 1 Horde | 1 Horde Ldap | 2018-05-18 | 6.8 MEDIUM | 8.1 HIGH |
| The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user DN. | |||||
| CVE-2017-15531 | 1 Symantec | 1 Reporter | 2018-05-03 | 5.0 MEDIUM | 9.8 CRITICAL |
| Symantec Reporter 9.5 prior to 9.5.4.1 and 10.1 prior to 10.1.5.5 does not restrict excessive authentication attempts for management interface users. A remote attacker can use brute force search to guess a user password and gain access to Reporter. | |||||
| CVE-2016-10434 | 1 Qualcomm | 4 Sd 820, Sd 820 Firmware, Sd 820a and 1 more | 2018-05-01 | 5.0 MEDIUM | 7.5 HIGH |
| In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 820 and SD 820A, the input to RPMB write response function is a buffer from HLOS that needs to be authenticated (using HMAC) and then processed. However, some of the processing occurs before the buffer is authenticated. The function will return various types of errors depending on the values of the `response` and `result` fields of the buffer before verifying the HMAC tag. | |||||
| CVE-2017-14911 | 1 Qualcomm | 28 Apq8096au, Apq8096au Firmware, Mdm9206 and 25 more | 2018-04-27 | 10.0 HIGH | 9.8 CRITICAL |
| In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile, Snapdragon Automobile APQ8096AU, MDM9206, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 625, SD 650/52, SD 820, SD 835, it is possible for the XBL loader to skip the authentication of device config. | |||||
| CVE-2018-1237 | 1 Dell | 1 Emc Scaleio | 2018-04-24 | 5.0 MEDIUM | 9.8 CRITICAL |
| Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent (LIA). This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having network access to LIA, could potentially exploit this vulnerability to launch brute force guessing of user names and passwords of user accounts on the LIA. | |||||
| CVE-2015-4987 | 1 Ibm | 1 Tealeaf Customer Experience | 2018-04-23 | 6.4 MEDIUM | 6.5 MEDIUM |
| The search and replay servers in IBM Tealeaf Customer Experience 8.0 through 9.0.2 allow remote attackers to bypass authentication via unspecified vectors. IBM X-Force ID: 105896. | |||||
| CVE-2017-17743 | 1 Ucopia | 2 Wireless Appliance, Wireless Appliance Firmware | 2018-04-18 | 6.5 MEDIUM | 6.7 MEDIUM |
| Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices before 4.4.20, 5.0.x before 5.0.19, and 5.1.x before 5.1.11 allows authenticated remote attackers to escape the shell and escalate their privileges by uploading a .bashrc file containing the /bin/sh string. In some situations, authentication can be achieved via the bhu85tgb default password for the admin account. | |||||
| CVE-2016-9880 | 1 Pivotal Software | 1 Gemfire For Pivotal Cloud Foundry | 2018-04-10 | 7.5 HIGH | 9.8 CRITICAL |
| The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker. | |||||
| CVE-2018-6299 | 1 Hanwha-security | 4 Snh-v6410pn, Snh-v6410pn Firmware, Snh-v6410pnw and 1 more | 2018-04-09 | 7.5 HIGH | 9.8 CRITICAL |
| Authentication bypass in Hanwha Techwin Smartcams | |||||
| CVE-2018-6294 | 1 Hanwha-security | 4 Snh-v6410pn, Snh-v6410pn Firmware, Snh-v6410pnw and 1 more | 2018-04-09 | 7.5 HIGH | 9.8 CRITICAL |
| Unsecured way of firmware update in Hanwha Techwin Smartcams | |||||
| CVE-2017-18223 | 1 Bmc | 1 Remedy Action Request System | 2018-04-09 | 6.8 MEDIUM | 8.1 HIGH |
| BMC Remedy AR System before 9.1 SP3, when Remedy AR Authentication is enabled, allows attackers to obtain administrative access. | |||||
| CVE-2018-1343 | 1 Netiq | 1 Privileged Account Manager | 2018-03-29 | 7.5 HIGH | 9.8 CRITICAL |
| PAM exposure enabling unauthenticated access to remote host | |||||
| CVE-2017-7638 | 1 Qnap | 2 Media Streaming Add-on, Qts | 2018-03-27 | 6.4 MEDIUM | 6.5 MEDIUM |
| QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS. | |||||
| CVE-2013-7239 | 1 Memcached | 1 Memcached | 2018-03-24 | 4.8 MEDIUM | N/A |
| memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials. | |||||
| CVE-2016-7114 | 1 Siemens | 2 En100 Ethernet Module, En100 Ethernet Module Firmware | 2018-03-22 | 9.0 HIGH | 8.8 HIGH |
| A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02; SIPROTEC 7SJ686 : All versions < V 4.87; SIPROTEC 7UT686 : All versions < V 4.02; SIPROTEC 7SD686 : All versions < V 4.05; SIPROTEC 7SJ66 : All versions < V 4.30. Attackers with network access to the device's web interface (port 80/tcp) could possibly circumvent authentication and perform certain administrative operations. A legitimate user must be logged into the web interface for the attack to be successful. | |||||
| CVE-2016-7112 | 1 Siemens | 2 En100 Ethernet Module, En100 Ethernet Module Firmware | 2018-03-22 | 10.0 HIGH | 9.8 CRITICAL |
| A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Attackers with network access to the device's web interface (port 80/tcp) could possibly circumvent authentication and perform certain administrative operations. | |||||
| CVE-2013-6171 | 1 Dovecot | 1 Dovecot | 2018-03-15 | 5.8 MEDIUM | N/A |
| checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the response to the dovecot-auth server. | |||||
| CVE-2011-4973 | 1 Mod Nss Project | 1 Mod Nss | 2018-03-15 | 7.5 HIGH | 9.8 CRITICAL |
| Authentication bypass vulnerability in mod_nss 1.0.8 allows remote attackers to assume the identity of a valid user by using their certificate and entering 'password' as the password. | |||||
| CVE-2017-6199 | 1 Sandstorm | 1 Sandstorm | 2018-03-13 | 7.5 HIGH | 9.8 CRITICAL |
| A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field. | |||||