Improper Authentication

An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by

VMware Tools Authentication Bypass Vulnerability

Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

Dahua IP Camera Authentication Bypass Vulnerability

Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

ConnectWise ScreenConnect Improper Authentication Vulnerability

Dahua IP Camera Authentication Bypass Vulnerability

Microsoft Exchange Server Privilege Escalation Vulnerability

PaperCut NG/MF Improper Authentication Vulnerability

Grafana Authentication Bypass Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

ProjectSend Improper Authentication Vulnerability

Microsoft Windows Privilege Escalation Vulnerability

Veritas Backup Exec Agent File Access Vulnerability

Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

Ivanti Pulse Connect Secure Use-After-Free Vulnerability

D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability

SKYSEA Client View Improper Authentication Vulnerability

Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

Veritas Backup Exec Agent Command Execution Vulnerability

Microsoft Exchange Server Privilege Escalation Vulnerability

Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

Microsoft SharePoint Improper Authentication Vulnerability

PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

Check Point Security Gateway Improper Authentication Vulnerability

October CMS Improper Authentication

Microsoft Exchange Server Information Disclosure

Veritas Backup Exec Agent Improper Authentication Vulnerability

Linux Kernel Improper Authentication Vulnerability

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Juniper ScreenOS Improper Authentication Vulnerability

Unraid Authentication Bypass Vulnerability

Dasan GPON Routers Authentication Bypass Vulnerability

Microsoft Windows Task Scheduler Privilege Escalation Vulnerability

Hikvision Multiple Products Improper Authentication Vulnerability

Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

ASUS Routers Improper Authentication Vulnerability

Sangoma FreePBX Improper Authentication Vulnerability

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.

A person with access to a Mac may be able to bypass Login Window. A consistency issue was addressed with improved state handling. This issue is fixed in macOS Monterey 12.4.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in

Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges locally.

X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or cre

IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not ha

russh server userauth state is not reset when authentication principal changes

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publicat

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonat

An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.