Filtered by CWE-288
Filtered by vendor Subscriptions
Total 534 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-4852 1 Siemens 4 Siclock Tc100, Siclock Tc100 Firmware, Siclock Tc400 and 1 more 2024-11-21 N/A
A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the device could potentially circumvent the authentication mechanism if he/she is able to obtain certain knowledge specific to the attacked device.
CVE-2018-19000 1 Lcds 1 Laquis Scada 2024-11-21 N/A
LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data.
CVE-2018-17918 1 Circontrol 2 Circarlife, Circarlife Firmware 2024-11-21 N/A
Circontrol CirCarLife all versions prior to 4.3.1, authentication to the device can be bypassed by entering the URL of a specific page.
CVE-2018-10841 3 Debian, Gluster, Redhat 4 Debian Linux, Glusterfs, Enterprise Linux and 1 more 2024-11-21 8.8 High
glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.
CVE-2016-9497 1 Hughes 8 Dw7000, Dw7000 Firmware, Hn7000s and 5 more 2024-11-21 N/A
Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication bypass using an alternate path or channel. By default, port 1953 is accessible via telnet and does not require authentication. An unauthenticated remote user can access many administrative commands via this interface, including rebooting the modem.
CVE-2024-10381 2 Matrix Comsec, Matrixcomsec 3 Matrix Door Controller Cosec Vega Faxq Firmware, Cosec Vega Faxq, Cosec Vega Faxq Firmware 2024-11-15 9.8 Critical
This vulnerability exists in Matrix Door Controller Cosec Vega FAXQ due to improper implementation of session management at the web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the vulnerable device. Successful exploitation of this vulnerability could allow remote attacker to gain unauthorized access and take complete control of the targeted device.
CVE-2024-50334 1 Erudika 1 Scoold 2024-11-08 5.3 Medium
Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT requests on the /api;/config endpoint while setting the Content-Type: application/hocon header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive information such as configuration files from the server, which can be leveraged for further exploitation. The vulnerability has been fixed in Scoold 1.64.0. A workaround would be to disable the Scoold API with scoold.api_enabled = false.
CVE-2024-47406 2 Sharp, Toshibatec 643 Bp-30c25, Bp-30c25 Firmware, Bp-30c25t and 640 more 2024-11-05 9.1 Critical
Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability.
CVE-2024-47010 1 Ivanti 1 Avalanche 2024-10-16 7.3 High
Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.
CVE-2024-47009 1 Ivanti 1 Avalanche 2024-10-16 7.3 High
Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.
CVE-2024-43692 1 Doverfuelingsolutions 6 Maglink Lx4 Console, Maglink Lx Console, Progauge Maglink Lx4 Console and 3 more 2024-10-01 9.8 Critical
An attacker can directly request the ProGauge MAGLINK LX CONSOLE resource sub page with full privileges by requesting the URL directly.
CVE-2024-41173 1 Beckhoff 2 Ipc Diagnostics Package, Twincat\/bsd 2024-09-12 7.8 High
The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local authentication bypass by a low privileged attacker.
CVE-2024-35151 1 Ibm 2 Openpages Grc Platform, Openpages With Watson 2024-08-23 6.5 Medium
IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs.
CVE-2024-35124 1 Ibm 1 Openbmc 2024-08-22 7.5 High
A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674.