Search Vulnerabilities

Apache Tomcat: Digest authenticator will authenticate any unknown user

Gaia unauthenticated endpoints

A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the L...

A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid wi...

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures

An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7

It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse

Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 is remotely accessible via Port 2...

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4

An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password wi...

prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass

It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit acce...

A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4

openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disa...

The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allo...

Siemens SIMATIC Logon prior to V1.5 SP3 Update 2 could allow an attacker with knowledge of a valid user name, and physical or network access to the...