CWE-305 Archives - CVE Vulnerability

CVE-2020-15787

Sun, 26 Feb 2023 06:37:58 +0000

A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attempts as the information given can be truncated to match only a set number of characters versus the whole provided string. This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack.

The post CVE-2020-15787 appeared first on CVE Vulnerability.

CVE-2020-14359

Sun, 26 Feb 2023 06:37:17 +0000

A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.

The post CVE-2020-14359 appeared first on CVE Vulnerability.

CVE-2020-10923

Sun, 26 Feb 2023 06:36:00 +0000

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A crafted UPnP message can be used to bypass authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9642.

The post CVE-2020-10923 appeared first on CVE Vulnerability.

CVE-2019-14833

Sun, 26 Feb 2023 06:30:43 +0000

A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks.

The post CVE-2019-14833 appeared first on CVE Vulnerability.

CVE-2022-4722

godfreyd94 — Thu, 23 Feb 2023 05:21:42 +0000

Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.

The post CVE-2022-4722 appeared first on CVE Vulnerability.

CVE-2022-3100

godfreyd94 — Thu, 23 Feb 2023 05:18:46 +0000

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

The post CVE-2022-3100 appeared first on CVE Vulnerability.

CVE-2022-2651

godfreyd94 — Thu, 23 Feb 2023 05:17:52 +0000

Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.

The post CVE-2022-2651 appeared first on CVE Vulnerability.