Filtered by CWE-287
Filtered by vendor Subscriptions
Total 3889 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2016-6541 1 Thetrackr 2 Trackr Bravo, Trackr Bravo Firmware 2024-11-21 N/A
TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
CVE-2016-2359 1 Milesight 2 Ip Security Camera, Ip Security Camera Firmware 2024-11-21 9.8 Critical
Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a request for the unprotected vb.htm resource.
CVE-2016-2125 2 Redhat, Samba 10 Enterprise Linux, Enterprise Linux Desktop, Enterprise Linux Server and 7 more 2024-11-21 6.5 Medium
It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.
CVE-2016-2124 5 Canonical, Debian, Fedoraproject and 2 more 26 Ubuntu Linux, Debian Linux, Fedora and 23 more 2024-11-21 5.9 Medium
A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
CVE-2016-2032 1 Arubanetworks 3 Airwave, Aruba Instant, Arubaos 2024-11-21 7.5 High
A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an underlying system component called RabbitMQ, which could let a malicious user obtain sensitive information. This interface listens on TCP port 15672 and 55672
CVE-2016-11074 1 Mattermost 1 Mattermost Server 2024-11-21 9.8 Critical
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.
CVE-2016-11072 1 Mattermost 1 Mattermost Server 2024-11-21 6.5 Medium
An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.
CVE-2016-11057 1 Netgear 18 Jnr1010, Jnr1010 Firmware, Jwnr2000 and 15 more 2024-11-21 7.5 High
Certain NETGEAR devices are affected by mishandling of repeated URL calls. This affects JNR1010v2 before 2017-01-06, WNR614 before 2017-01-06, WNR618 before 2017-01-06, JWNR2000v5 before 2017-01-06, WNR2020 before 2017-01-06, JWNR2010v5 before 2017-01-06, WNR1000v4 before 2017-01-06, WNR2020v2 before 2017-01-06, R6220 before 2017-01-06, and WNDR3700v5 before 2017-01-06.
CVE-2016-11042 1 Google 1 Android 2024-11-21 7.5 High
An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. There is a SIM Lock bypass. The Samsung ID is SVE-2016-5381 (June 2016).
CVE-2016-11041 1 Google 1 Android 2024-11-21 4.6 Medium
An issue was discovered on Samsung mobile devices with KK(4.4) software. Attackers can bypass the lockscreen by sending an AT command over USB. The Samsung ID is SVE-2015-5301 (June 2016).
CVE-2016-10983 1 Ghost 1 Ghost 2024-11-21 6.5 Medium
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.
CVE-2016-10836 1 Cpanel 1 Cpanel 2024-11-21 N/A
cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108).
CVE-2016-10835 1 Cpanel 1 Cpanel 2024-11-21 N/A
cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107).
CVE-2016-10833 1 Cpanel 1 Cpanel 2024-11-21 N/A
cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104).
CVE-2016-10832 1 Cpanel 1 Cpanel 2024-11-21 N/A
cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).
CVE-2016-10831 1 Cpanel 1 Cpanel 2024-11-21 N/A
cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).
CVE-2016-10826 1 Cpanel 1 Cpanel 2024-11-21 N/A
cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).
CVE-2016-10732 1 Projectsend 1 Projectsend 2024-11-21 N/A
ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.
CVE-2016-10532 1 Console-io Project 1 Console-io 2024-11-21 N/A
console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running from root, the attacker would have full access to the system. This vulnerability exists because the console-io application does not configure socket.io to require authentication, which allows a malicious user to connect via a websocket to send commands and receive the response.
CVE-2016-10525 1 Dwyl 1 Hapi-auth-jwt2 2024-11-21 N/A
When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.