Unauthenticated/Unauthorized Access - 15319 CVEs (Page 110/128)

About “Unauthenticated/Unauthorized Access”

A curated feed of “Unauthenticated/Unauthorized Access”-related CVEs appears below. We currently track 15319 CVEs for this tag (all time). In the last 365 days, 3827 were published. Average CVSS is 7.4 (all time; 7.4 over 365d), and 61% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-862 - Missing Authorization, CWE-306 - Missing Authentication for Critical Function, CWE-639 - Authorization Bypass Through User-Controlled Key.

In our taxonomy this topic maps to a HIGH impact class. Vendor advisories and release notes are key. Verify compatibility matrices, prefer supported long term versions, and stage rollouts with monitoring. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0

2018-04-20

High

CVE-2014-0927

The ActiveMQ admin user interface in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote attackers to bypass authentication by leveraging knowledge of the port…

CVSS: 8.1 CWE: CWE-287 - Improper Authentication View on NVD

2018-04-19

High

CVE-2018-1146

A remote unauthenticated user can enable telnet on the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to set.cgi. When enabled the telnet session requires no password an…

CVSS: 7.5 CWE: N/A View on NVD

Critical

CVE-2018-1145

A remote unauthenticated user can overflow a stack buffer in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to proxy.cgi.

CVSS: 9.8 CWE: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer View on NVD

Critical

CVE-2018-1144

A remote unauthenticated user can execute commands as root in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to proxy.cgi.

CVSS: 9.8 CWE: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') View on NVD

Critical

CVE-2018-1143

A remote unauthenticated user can execute commands as root in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to twonky_command.cgi.

CVSS: 9.8 CWE: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') View on NVD

Critical

CVE-2018-2879

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Supported versions that are affected are 11.1.2.3.0 and 12.2.1.3.0. Difficult t…

CVSS: 9.0 CWE: N/A View on NVD

Medium

CVE-2018-2878

Vulnerability in the PeopleSoft Enterprise HCM Shared Components component of Oracle PeopleSoft Products (subcomponent: Notepad). The supported version that is affected is 9.2. Easily exploitable vul…

CVSS: 6.1 CWE: N/A View on NVD

High

CVE-2018-2876

Vulnerability in the Oracle Retail Integration Bus component of Oracle Retail Applications (subcomponent: RIB Kernal(Apache Commons Collections)). The supported version that is affected is 13.2. Easi…

CVSS: 7.1 CWE: N/A View on NVD

Medium

CVE-2018-2874

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Logging). The supported version that is affected is 12.1.3. Easily exploitable vulnerability…

CVSS: 4.3 CWE: N/A View on NVD

Medium

CVE-2018-2873

Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Account Hierarchy Manager). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2018-2872

CVSS: 5.3 CWE: N/A View on NVD

Critical

CVE-2018-2871

Vulnerability in the Oracle Human Resources component of Oracle E-Business Suite (subcomponent: General Utilities). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12…

CVSS: 9.1 CWE: N/A View on NVD

Critical

CVE-2018-2870

CVSS: 9.1 CWE: N/A View on NVD

Medium

CVE-2018-2869

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2018-2868

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2018-2867

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Diagnostics). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2018-2866

Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Consolidation Hierarchy Viewer). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2018-2865

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2018-2864

CVSS: 5.3 CWE: N/A View on NVD

High

CVE-2018-2862

Vulnerability in the Oracle Retail Point-of-Service component of Oracle Retail Applications (subcomponent: User Interface). Supported versions that are affected are 13.3.8, 13.4.9, 14.0.4 and 14.1.3.…

CVSS: 7.1 CWE: N/A View on NVD

Medium

CVE-2018-2861

Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.4.9, 14.0.4 and 14.1.3. Easily exploitable…

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2018-2859

Vulnerability in the Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach component of Oracle Financial Services Applications (subcomponent: Portfolio, Attribution). The…

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2018-2858

Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: HTTP data path subsystems). The supported version that is affected is Prior to 8.…

CVSS: 5.3 CWE: N/A View on NVD

High

CVE-2018-2856

CVSS: 8.1 CWE: N/A View on NVD

High

CVE-2018-2855

Vulnerability in the Oracle Financial Services Basel Regulatory Capital Basic component of Oracle Financial Services Applications (subcomponent: Portfolio, Attribution). The supported version that is…

CVSS: 8.1 CWE: N/A View on NVD

Medium

CVE-2018-2854

CVSS: 6.1 CWE: N/A View on NVD

High

CVE-2018-2851

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications (subcomponent: Enterprise Management Console). Supported versions that are affected are 1.6…

CVSS: 8.1 CWE: N/A View on NVD

High

CVE-2018-2850

Vulnerability in the Oracle Hospitality Cruise Fleet Management System component of Oracle Hospitality Applications (subcomponent: Fleet Management System Suite). The supported version that is affect…

CVSS: 7.3 CWE: N/A View on NVD

High

CVE-2018-2849

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 1…

CVSS: 7.7 CWE: N/A View on NVD

High

CVE-2018-2848

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications (subcomponent: Client Application Loader). Supported versions that are affected are 1.6 and…

CVSS: 7.5 CWE: N/A View on NVD

Medium

CVE-2018-2847

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications (subcomponent: Operations). Supported versions that are affected are 1.6 and 1.7. Easily ex…

CVSS: 6.5 CWE: N/A View on NVD

High

CVE-2018-2840

Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Xstore Office). Supported versions that are affected are 6.5.11, 7.0.6, 7.1.6, 15.0.1…

CVSS: 7.6 CWE: N/A View on NVD

Medium

CVE-2018-2838

Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: EPPCM_HIER_TOP). The supported version that is affected is 9.1. Easily exploitab…

CVSS: 6.1 CWE: N/A View on NVD

High

CVE-2018-2834

Vulnerability in the Oracle Data Visualization Desktop component of Oracle Fusion Middleware (subcomponent: Security). The supported version that is affected is 12.2.4.1.1. Easily exploitable vulnera…

CVSS: 8.5 CWE: N/A View on NVD

High

CVE-2018-2833

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Enterprise Management Console). Supported versions that are affected are 2.7, 2.8, 2.9 and…

CVSS: 8.1 CWE: N/A View on NVD

High

CVE-2018-2832

Vulnerability in the Oracle GoldenGate component of Oracle GoldenGate. The supported version that is affected is 12.2.0.1. Easily exploitable vulnerability allows unauthenticated attacker with networ…

CVSS: 8.6 CWE: N/A View on NVD

High

CVE-2018-2829

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Enterprise Management Console). The supported version that is affected is 2.10. Easily exp…

CVSS: 8.6 CWE: N/A View on NVD

High

CVE-2018-2828

Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Supported versions that are affected are 11.1.1.9.0, 12.2.1.2.0 and 12.2.1.3.0. Eas…

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2018-2827

Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: Profile). The supported version that is affected is 8.x. Easily exploitable vulnerability al…

CVSS: 7.6 CWE: N/A View on NVD

High

CVE-2018-2826

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). The supported version that is affected is Java SE: 10. Difficult to exploit vulnerability allows unauthenticated at…

CVSS: 8.3 CWE: N/A View on NVD

High

CVE-2018-2825

CVSS: 8.3 CWE: N/A View on NVD

High

CVE-2018-2824

CVSS: 7.7 CWE: N/A View on NVD

Medium

CVE-2018-2822

Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: Cluster Geo). The supported version that is affected is 4.3. Easily exploitable vulnerability allows…

CVSS: 6.6 CWE: N/A View on NVD

Medium

CVE-2018-2821

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Rich Text Editor). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily e…

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2018-2815

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java S…

CVSS: 5.3 CWE: N/A View on NVD

High

CVE-2018-2814

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u1…

CVSS: 8.3 CWE: N/A View on NVD

High

CVE-2018-2811

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected are Java SE: 8u162 and 10. Difficult to exploit vulnerability allows unauthentic…

CVSS: 7.7 CWE: N/A View on NVD

Medium

CVE-2018-2809

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Homepage & Navigation). Supported versions that are affected are 8.54, 8.55 and 8.5…

CVSS: 4.3 CWE: N/A View on NVD

Medium

CVE-2018-2807

Vulnerability in the Oracle FLEXCUBE Core Banking component of Oracle Financial Services Applications (subcomponent: Securities). Supported versions that are affected are 11.5.0, 11.6.0 and 11.7.0. E…

CVSS: 6.1 CWE: N/A View on NVD

High

CVE-2018-2806

Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3. Easily exploitable vulnera…

CVSS: 7.1 CWE: N/A View on NVD

High

CVE-2018-2804

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: DB Privileges). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.…

CVSS: 7.4 CWE: N/A View on NVD

High

CVE-2018-2803

Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Report). The supported version that is affected is 9.0. Easily exploitable…

CVSS: 8.1 CWE: N/A View on NVD

High

CVE-2018-2801

Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Image Export SDK). The supported version that is affected is 8.5.3. Easily exploitabl…

CVSS: 7.1 CWE: N/A View on NVD

Medium

CVE-2018-2800

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u181, 7u171 and 8u162; JRockit: R28.3.17. Difficult to exploi…

CVSS: 4.2 CWE: N/A View on NVD

Medium

CVE-2018-2799

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u16…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2018-2798

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2018-2797

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2018-2796

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedde…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2018-2795

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Emb…

CVSS: 5.3 CWE: N/A View on NVD

High

CVE-2018-2794

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162, 10 and JRockit: R28.3.17. Difficult…

CVSS: 7.7 CWE: N/A View on NVD

Medium

CVE-2018-2793

Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: PsAdmin). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploit…

CVSS: 6.2 CWE: N/A View on NVD

High

CVE-2018-2791

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.2.0 and 12.2.1.3.0. Easily e…

CVSS: 8.2 CWE: N/A View on NVD

Low

CVE-2018-2790

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u…

CVSS: 3.1 CWE: N/A View on NVD

Medium

CVE-2018-2788

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Core). Supported versions that are affected are 8.55 and 8.56. Easily exploitable v…

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2018-2785

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Stylesheet). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploit…

CVSS: 4.7 CWE: N/A View on NVD

High

CVE-2018-2783

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u161 and 8u152; Java SE Embedde…

CVSS: 7.4 CWE: N/A View on NVD

High

CVE-2018-2774

Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: SQR). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable…

CVSS: 7.3 CWE: N/A View on NVD

High

CVE-2018-2770

Vulnerability in the Oracle Adaptive Access Manager component of Oracle Fusion Middleware (subcomponent: OAAM Admin). The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerab…

CVSS: 7.6 CWE: N/A View on NVD

High

CVE-2018-2768

CVSS: 7.1 CWE: N/A View on NVD

High

CVE-2018-2765

Vulnerability in the Oracle Security Service component of Oracle Fusion Middleware (subcomponent: Oracle SSL API). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0, 12.2.1.2.0 and 12.2…

CVSS: 7.5 CWE: N/A View on NVD

High

CVE-2018-2764

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11.3. Easily exploitable vulnerability allows unaut…

CVSS: 7.5 CWE: N/A View on NVD

Medium

CVE-2018-2761

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficul…

CVSS: 5.9 CWE: N/A View on NVD

Medium

CVE-2018-2760

Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: OSSL Module). Supported versions that are affected are 12.1.3 and 12.2.1.2. Difficult to exploit vulnerabi…

CVSS: 5.9 CWE: N/A View on NVD

Medium

CVE-2018-2756

Vulnerability in the Oracle Communications Order and Service Management component of Oracle Communications Applications (subcomponent: WebUI). Supported versions that are affected are 7.2.4.3.0, 7.3.…

CVSS: 6.3 CWE: N/A View on NVD

High

CVE-2018-2755

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Diff…

CVSS: 7.7 CWE: N/A View on NVD

High

CVE-2018-2754

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: ZVNET Driver). The supported version that is affected is 11.3. Easily exploitable vulnerability allows unaut…

CVSS: 7.7 CWE: N/A View on NVD

Medium

CVE-2018-2753

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Python modules). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows l…

CVSS: 6.0 CWE: N/A View on NVD

High

CVE-2018-2750

Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Products Suite (subcomponent: UI Framework). The supported version that is affected is 12.1.0.5. Easily ex…

CVSS: 7.1 CWE: N/A View on NVD

Medium

CVE-2018-2748

Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0…

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2018-2747

CVSS: 6.5 CWE: N/A View on NVD

High

CVE-2018-2746

CVSS: 7.1 CWE: N/A View on NVD

High

CVE-2018-2742

Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent: Framework). Supported versions that are affected are 12.2.2 and 12.3.3. Easily…

CVSS: 7.3 CWE: N/A View on NVD

Critical

CVE-2018-2739

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that are affected are 10.1.4.3.0, 11.1.2.3.0 and 12.2.1.3.0. Eas…

CVSS: 9.3 CWE: N/A View on NVD

Medium

CVE-2018-2738

Vulnerability in the Oracle Retail Central Office component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.4.9, 14.0.4 and 14.1.3. Easily exploita…

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2018-2737

Vulnerability in the Oracle Retail Returns Management component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 2.3.8, 2.4.9, 14.0.4 and 14.1.3. Easil…

CVSS: 6.5 CWE: N/A View on NVD

High

CVE-2018-2718

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: RPC). Supported versions that are affected are 10 and 11.3. Easily exploitable vulnerability allows unauthen…

CVSS: 7.5 CWE: N/A View on NVD

Critical

CVE-2018-2628

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1…

CVSS: 9.8 CWE: CWE-502 - Deserialization of Untrusted Data View on NVD

Medium

CVE-2018-2587

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2018-2572

Vulnerability in the Oracle Agile Product Lifecycle Management for Process component of Oracle Supply Chain Products Suite (subcomponent: Installation). Supported versions that are affected are 6.1.1…

CVSS: 6.1 CWE: N/A View on NVD

2018-04-18

Critical

CVE-2018-7760

An authorization bypass vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. Requests to CGI functions allow malicious users to bypass authoriz…

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

Critical

CVE-2018-7245

An improper authorization vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server (Port 80/443/TCP) of th…

CVSS: 9.1 CWE: CWE-863 - Incorrect Authorization View on NVD

Critical

CVE-2018-7243

An authorization bypass vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server (Port 80/443/TCP) of the…

CVSS: 9.8 CWE: N/A View on NVD

Critical

CVE-2016-10422

In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear FSM9055, IPQ4019, MDM9206, MDM9635M, MDM9640, MD…

CVSS: 9.8 CWE: CWE-284 - Improper Access Control View on NVD

Critical

CVE-2015-9187

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 43…

CVSS: 9.8 CWE: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer View on NVD

Critical

CVE-2018-8733

Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an authenti…

CVSS: 9.8 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

2018-04-13

Critical

CVE-2017-0356

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

High

CVE-2018-10066

An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of intercepting client traffic to act as a malici…

CVSS: 8.1 CWE: CWE-295 - Improper Certificate Validation View on NVD

2018-04-10

Critical

CVE-2018-9995

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104…

CVSS: 9.8 CWE: N/A View on NVD

High

CVE-2014-3999

The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user DN.

CVSS: 8.1 CWE: CWE-287 - Improper Authentication View on NVD

2018-04-09

Critical

CVE-2018-1217

Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerabili…

CVSS: 9.8 CWE: CWE-862 - Missing Authorization View on NVD

High

CVE-2018-0554

Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors.

CVSS: 8.8 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

2018-04-05

Critical

CVE-2017-14467

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted…

CVSS: 9.8 CWE: N/A View on NVD

High

CVE-2016-8380

The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication.

CVSS: 7.3 CWE: CWE-767 - Access to Critical Private Variable via Public Method View on NVD

2018-04-04

Critical

CVE-2018-1469

IBM API Connect Developer Portal 5.0.0.0 through 5.0.8.2 could allow an unauthenticated attacker to execute system commands using specially crafted HTTP requests. IBM X-Force ID: 140605.

CVSS: 9.8 CWE: N/A View on NVD

Critical

CVE-2018-9249

FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass by ignoring the parent.location='login.html' JavaScript code in the response to an unauthenticated request.

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

Critical

CVE-2018-9248

FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header.

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

2018-03-30

Critical

CVE-2018-9148

Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this…

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

2018-03-29

Medium

CVE-2018-9117

WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files beyond the application directory via a specially crafted XML request, aka Directory…

CVSS: 5.3 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') View on NVD

Critical

CVE-2018-9116

An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause a Denial of Service.

CVSS: 9.1 CWE: CWE-611 - Improper Restriction of XML External Entity Reference View on NVD

2018-03-28

Medium

CVE-2017-0936

Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed logged-in users to change the scope of app…

CVSS: 5.7 CWE: CWE-639 - Authorization Bypass Through User-Controlled Key View on NVD

2018-03-27

Medium

CVE-2015-4987

The search and replay servers in IBM Tealeaf Customer Experience 8.0 through 9.0.2 allow remote attackers to bypass authentication via unspecified vectors. IBM X-Force ID: 105896.

CVSS: 6.5 CWE: CWE-287 - Improper Authentication View on NVD

Critical

CVE-2018-9032

An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmware Version : 1.02-2.06) devices potentially allows attackers…

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

2018-03-26

Medium

CVE-2017-15534

The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the user to kill the app to prevent it from l…

CVSS: 6.7 CWE: CWE-287 - Improper Authentication View on NVD

Critical

CVE-2018-5472

Philips Intellispace Portal all versions 7.0.x and 8.0.x have an insecure windows permissions vulnerability that could allow an attacker to gain unauthorized access and in some cases escalate their l…

CVSS: 9.8 CWE: CWE-264 View on NVD

Critical

CVE-2018-5468

Philips Intellispace Portal all versions 7.0.x and 8.0.x have a remote desktop access vulnerability that could allow an attacker to gain unauthorized access and in some cases escalate their level of…

CVSS: 9.8 CWE: CWE-264 View on NVD

High

CVE-2018-5466

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a self-signed SSL certificate vulnerability this could allow an attacker to gain unauthorized access to resources and information.

CVSS: 7.5 CWE: CWE-310 View on NVD

High

CVE-2018-5464

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an untrusted SSL certificate vulnerability this could allow an attacker to gain unauthorized access to resources and information.

CVSS: 7.5 CWE: CWE-310 View on NVD

High

CVE-2018-5462

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an SSL incorrect hostname certificate vulnerability this could allow an attacker to gain unauthorized access to resources and informa…

CVSS: 7.5 CWE: CWE-310 View on NVD

High

CVE-2018-5458

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability using SSL legacy encryption that could allow an attacker to gain unauthorized access to resources and information.

CVSS: 7.5 CWE: CWE-310 View on NVD

2018-03-23

Critical

CVE-2018-1000141

I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users gaining unauthorized access (read, write and delete) to proj…

CVSS: 9.1 CWE: CWE-269 - Improper Privilege Management View on NVD