CWE-287

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0

Improper authentication in locked memory region can lead to unprivilged access to the memory in Snapdragon Auto, Snapdra

The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local

Debug policy with invalid signature can be loaded when the debug policy functionality is disabled by using the parallel

IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect nod

NVIDIA Shield TV Experience prior to v8.0, NVIDIA Tegra bootloader contains a vulnerability in nvtboot where the Trusted

PCManager 9.1.3.1 has an improper authentication vulnerability. The certain driver interface of the software does not pe

Authentication bypass in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentia

In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is

An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser cu

suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code execution

A lock handling issue was addressed with improved lock handling. This issue is fixed in macOS Mojave 10.14.4. A Mac may

OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs

Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in su

OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization

The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens

The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identi

Abine Blur 7.8.2431 allows remote attackers to conduct "Second-Factor Auth Bypass" attacks by using the "Perform a right

Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially c

An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps

Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerabi

A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than ver

An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. An ability exists for an unauthenticated user to bro

An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles

cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104).

The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expire

Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over

includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes

A vulnerability in the Dialer interface feature for ISDN connections in Cisco IOS XE Software for Cisco 4000 Series Inte

Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to val

Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Wel

Fastweb FASTGate 1.0.1b devices allow partial authentication bypass by changing a certain check_pwd return value from 0

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.

wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication.

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expressi

RubyGem omniauth-facebook has an access token security vulnerability

A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker

A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker

A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker

A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker

The ToOwner() function of a smart contract implementation for Cryptbond Network (CBN), an tradable Ethereum ERC20 token,

The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable Ethereum ERC20 token, a

The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to cha

The quaker function of a smart contract implementation for BOMBBA (BOMB), an tradable Ethereum ERC20 token, allows attac

Exploitation of Authentication vulnerability in MVision Endpoint in McAfee MVision Endpoint Prior to 1811 Update 1 (18.1

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using Plaintex

Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link.

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).