Filtered by CWE-306
Filtered by vendor Subscriptions
Total 1584 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-0919 1 Gitlab 1 Gitlab 2024-11-21 N/A
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized.
CVE-2016-9496 1 Hughes 8 Dw7000, Dw7000 Firmware, Hn7000s and 5 more 2024-11-21 N/A
Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication. An unauthenticated user may send an HTTP GET request to http://[ip]/com/gatewayreset or http://[ip]/cgi/reboot.bin to cause the modem to reboot.
CVE-2016-6549 1 Nutspace 1 Nut Mobile 2024-11-21 N/A
The Zizai Tech Nut device allows unauthenticated Bluetooth pairing, which enables unauthenticated connected applications to write data to the device name attribute.
CVE-2016-6544 1 Ieasytec 1 Itrack Easy 2024-11-21 N/A
getgps data in iTrack Easy can be modified without authentication by setting the data using the parametercmd:setothergps. This vulnerability can be exploited to alter the GPS data of a lost device.
CVE-2016-6541 1 Thetrackr 2 Trackr Bravo, Trackr Bravo Firmware 2024-11-21 N/A
TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
CVE-2016-6540 1 Thetrackr 2 Trackr Bravo, Trackr Bravo Firmware 2024-11-21 N/A
Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
CVE-2015-7559 2 Apache, Redhat 4 Activemq, Jboss A-mq, Jboss Amq and 1 more 2024-11-21 2.7 Low
It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
CVE-2015-5201 1 Redhat 3 Enterprise Linux, Enterprise Virtualization, Enterprise Virtualization Hypervisor 2024-11-21 7.5 High
VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows remote attackers to log in without authentication via unspecified vectors.
CVE-2014-7271 2 Fedoraproject, Sddm Project 2 Fedora, Sddm 2024-11-21 N/A
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication.
CVE-2014-3699 1 Redhat 2 Edeploy, Jboss Enterprise Web Server 2024-11-21 9.8 Critical
eDeploy has RCE via cPickle deserialization of untrusted data
CVE-2014-3449 1 Bss Continuity Cms Project 1 Bss Continuty Cms 2024-11-21 9.8 Critical
BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability
CVE-2013-1793 1 Redhat 2 Openstack, Openstack Essex 2024-11-21 7.5 High
openstack-utils openstack-db has insecure password creation
CVE-2012-2736 4 Canonical, Debian, Gnome and 1 more 4 Ubuntu Linux, Debian Linux, Networkmanager and 1 more 2024-11-21 4.4 Medium
In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network.
CVE-2011-4322 1 Websitebaker 1 Websitebaker 2024-11-21 7.5 High
websitebaker prior to and including 2.8.1 has an authentication error in backup module.
CVE-2011-4190 1 Suse 2 Suse Linux Enterprise Desktop, Suse Linux Enterprise Server 2024-11-21 N/A
The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files).
CVE-2011-2187 2 Debian, Xscreensaver Project 2 Debian Linux, Xscreensaver 2024-11-21 7.8 High
xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attackers to access resources without authentication.
CVE-2006-0062 1 Sillycycle 1 Xlockmore 2024-11-21 9.8 Critical
xlockmore 5.13 allows potential xlock bypass when FVWM switches to the same virtual desktop as a new Gaim window.
CVE-2006-0061 1 Sillycycle 1 Xlockmore 2024-11-21 9.8 Critical
xlockmore 5.13 and 5.22 segfaults when using libpam-opensc and returns the underlying xsession. This allows unauthorized users access to the X session.
CVE-2024-10924 1 Really-simple-plugins 1 Really Simple Security 2024-11-20 9.8 Critical
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
CVE-2023-52949 1 Synology 1 Active Backup For Business Agent 2024-11-15 5.5 Medium
Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors.