Unauthenticated/Unauthorized Access - 15320 CVEs (Page 99/128)

About “Unauthenticated/Unauthorized Access”

A curated feed of “Unauthenticated/Unauthorized Access”-related CVEs appears below. We currently track 15320 CVEs for this tag (all time). In the last 365 days, 3827 were published. Average CVSS is 7.4 (all time; 7.4 over 365d), and 61% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-862 - Missing Authorization, CWE-306 - Missing Authentication for Critical Function, CWE-639 - Authorization Bypass Through User-Controlled Key.

In our taxonomy this topic maps to a HIGH impact class. Vendor advisories and release notes are key. Verify compatibility matrices, prefer supported long term versions, and stage rollouts with monitoring. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0

2019-10-16

Critical

CVE-2019-17512

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to log_clear.php, which…

CVSS: 9.1 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

Critical

CVE-2019-15260

A vulnerability in Cisco Aironet Access Points (APs) Software could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device with elevated privileges. The vulnerabil…

CVSS: 9.8 CWE: CWE-284 - Improper Access Control View on NVD

Medium

CVE-2019-3031

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.34 and prior to 6.0.14. Easily exploitable vulnerab…

CVSS: 6.0 CWE: N/A View on NVD

Medium

CVE-2019-3027

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login Help). Supported versions that are affected are 12.2.5-12.2.9. Easily exploitable vulnerabi…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2019-3026

CVSS: 6.5 CWE: N/A View on NVD

Critical

CVE-2019-3025

Vulnerability in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications. The supported version that is affected is 5.7. Difficult to exploit vulnerability allows unauthent…

CVSS: 9.0 CWE: N/A View on NVD

Medium

CVE-2019-3024

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Supported versions that are affected are 12.2.3-12.2.9. Easily exploitable vulnera…

CVSS: 4.7 CWE: N/A View on NVD

Medium

CVE-2019-3023

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Stylesheet). Supported versions that are affected are 8.56 and 8.57. Easily exploitable vulnerability a…

CVSS: 4.7 CWE: N/A View on NVD

Medium

CVE-2019-3022

Vulnerability in the Oracle Content Manager product of Oracle E-Business Suite (component: Content). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulne…

CVSS: 5.8 CWE: N/A View on NVD

Critical

CVE-2019-3020

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 15.1.0-15.2.…

CVSS: 9.3 CWE: N/A View on NVD

Medium

CVE-2019-3014

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). Supported versions that are affected are 8.56 and 8.57. Easily exploitable vulner…

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2019-3012

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: BI Platform Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2019-3001

Vulnerability in the PeopleSoft Enterprise SCM eProcurement product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.2. Easily exploitable vulnerability all…

CVSS: 5.3 CWE: N/A View on NVD

High

CVE-2019-3000

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploi…

CVSS: 8.2 CWE: N/A View on NVD

Medium

CVE-2019-2999

Vulnerability in the Java SE product of Oracle Java SE (component: Javadoc). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13. Difficult to exploit vulnerability allows u…

CVSS: 4.7 CWE: N/A View on NVD

Medium

CVE-2019-2996

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u221; Java SE Embedded: 8u221. Difficult to explo…

CVSS: 4.2 CWE: N/A View on NVD

High

CVE-2019-2995

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2019-2994

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerabilit…

CVSS: 8.2 CWE: N/A View on NVD

Low

CVE-2019-2992

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Diffi…

CVSS: 3.7 CWE: N/A View on NVD

High

CVE-2019-2990

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Order Tracker). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerab…

CVSS: 8.2 CWE: N/A View on NVD

Medium

CVE-2019-2989

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u22…

CVSS: 6.8 CWE: N/A View on NVD

Low

CVE-2019-2988

CVSS: 3.7 CWE: N/A View on NVD

Low

CVE-2019-2987

Vulnerability in the Java SE product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated atta…

CVSS: 3.7 CWE: N/A View on NVD

Medium

CVE-2019-2985

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported versions that are affected are 8.56 and 8.57. Easily exploitable vulnerability a…

CVSS: 6.1 CWE: N/A View on NVD

Low

CVE-2019-2983

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8…

CVSS: 3.7 CWE: N/A View on NVD

Low

CVE-2019-2981

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Dif…

CVSS: 3.7 CWE: N/A View on NVD

Medium

CVE-2019-2980

Vulnerability in the Oracle FLEXCUBE Direct Banking product of Oracle Financial Services Applications (component: eMail). Supported versions that are affected are 12.0.2 and 12.0.3. Easily exploitabl…

CVSS: 6.5 CWE: N/A View on NVD

Low

CVE-2019-2978

CVSS: 3.7 CWE: N/A View on NVD

Medium

CVE-2019-2977

Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated…

CVSS: 4.8 CWE: N/A View on NVD

Medium

CVE-2019-2976

CVSS: 6.8 CWE: N/A View on NVD

Medium

CVE-2019-2975

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Diffi…

CVSS: 4.8 CWE: N/A View on NVD

Low

CVE-2019-2973

CVSS: 3.7 CWE: N/A View on NVD

High

CVE-2019-2972

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.4. Easily exploitable vulnerabilit…

CVSS: 7.3 CWE: N/A View on NVD

High

CVE-2019-2971

CVSS: 7.3 CWE: N/A View on NVD

High

CVE-2019-2970

CVSS: 7.3 CWE: N/A View on NVD

Medium

CVE-2019-2969

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploi…

CVSS: 6.2 CWE: N/A View on NVD

High

CVE-2019-2965

Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Install - Configuration). Supported versions that are affected are 19.8 and prior. Easily e…

CVSS: 7.5 CWE: N/A View on NVD

Low

CVE-2019-2964

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u2…

CVSS: 3.7 CWE: N/A View on NVD

Low

CVE-2019-2962

CVSS: 3.7 CWE: N/A View on NVD

Medium

CVE-2019-2958

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221…

CVSS: 5.9 CWE: N/A View on NVD

High

CVE-2019-2953

Vulnerability in the Oracle Hospitality Cruise Dining Room Management product of Oracle Hospitality Applications (component: Web Service). The supported version that is affected is 8.0.80. Easily exp…

CVSS: 7.1 CWE: N/A View on NVD

Medium

CVE-2019-2952

Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version that is affected is 9.1.0. Easily exploitable vulnerability a…

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2019-2949

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Kerberos). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.…

CVSS: 6.8 CWE: N/A View on NVD

High

CVE-2019-2947

CVSS: 7.1 CWE: N/A View on NVD

Low

CVE-2019-2945

CVSS: 3.1 CWE: N/A View on NVD

Medium

CVE-2019-2943

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Studio). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows low…

CVSS: 6.5 CWE: N/A View on NVD

High

CVE-2019-2942

Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.8. Easil…

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2019-2937

CVSS: 8.1 CWE: N/A View on NVD

Medium

CVE-2019-2936

Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version that is affected is 9.1.0. Difficult to exploit vulnerability…

CVSS: 6.8 CWE: N/A View on NVD

Medium

CVE-2019-2935

Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 19.8 and prior. Easily exploitable vulnerability allows unauthenticate…

CVSS: 5.3 CWE: N/A View on NVD

High

CVE-2019-2934

CVSS: 8.1 CWE: N/A View on NVD

Low

CVE-2019-2933

CVSS: 3.1 CWE: N/A View on NVD

High

CVE-2019-2932

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Tree Manager). Supported versions that are affected are 8.56 and 8.57. Easily exploitable vulnerability…

CVSS: 7.7 CWE: N/A View on NVD

Medium

CVE-2019-2931

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.56 and 8.57. Easily exploitable vulnerability allow…

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2019-2930

Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Wireless). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.8. Easily exploitable vulner…

CVSS: 4.7 CWE: N/A View on NVD

Medium

CVE-2019-2929

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2019-2925

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.8. Easily exploitable vulnerability allo…

CVSS: 4.3 CWE: N/A View on NVD

Medium

CVE-2019-2924

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 5.6.45 and prior and 5.7.27 and prior. Easily exploitable…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2019-2923

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2019-2922

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2019-2920

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported versions that are affected are 5.3.13 and prior and 8.0.17 and prior. Easily exploitable vulnerabi…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2019-2915

CVSS: 6.1 CWE: N/A View on NVD

Low

CVE-2019-2910

CVSS: 3.7 CWE: N/A View on NVD

Medium

CVE-2019-2909

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows unauthe…

CVSS: 6.8 CWE: N/A View on NVD

High

CVE-2019-2907

Vulnerability in the Oracle Web Services product of Oracle Fusion Middleware (component: SOAP with Attachments API for Java). The supported version that is affected is 12.2.1.3.0. Easily exploitable…

CVSS: 7.2 CWE: N/A View on NVD

High

CVE-2019-2906

Vulnerability in the BI Publisher (formerly XML Publisher) product of Oracle Fusion Middleware (component: Mobile Service). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.…

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2019-2905

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0.…

CVSS: 8.6 CWE: N/A View on NVD

Critical

CVE-2019-2904

Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily explo…

CVSS: 9.8 CWE: N/A View on NVD

High

CVE-2019-2903

CVSS: 7.3 CWE: N/A View on NVD

High

CVE-2019-2902

CVSS: 7.3 CWE: N/A View on NVD

High

CVE-2019-2901

CVSS: 7.3 CWE: N/A View on NVD

High

CVE-2019-2900

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Supported versions that are affected are 12.2.1.3.0 and 12.2.1…

CVSS: 7.5 CWE: N/A View on NVD

Medium

CVE-2019-2896

Vulnerability in the MICROS Relate CRM Software product of Oracle Retail Applications (component: Internal Operations). Supported versions that are affected are 7.1.0, 15.0.0, 16.0.0, 17.0.0, and 18.…

CVSS: 5.9 CWE: N/A View on NVD

Low

CVE-2019-2894

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221.…

CVSS: 3.7 CWE: N/A View on NVD

High

CVE-2019-2891

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Difficult to expl…

CVSS: 8.1 CWE: N/A View on NVD

Medium

CVE-2019-2889

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows…

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2019-2888

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: EJB Container). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily expl…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2019-2886

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Services). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthentica…

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2019-2884

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Segment). The supported version that is affected is 17.0. Difficul…

CVSS: 5.9 CWE: N/A View on NVD

2019-10-15

Critical

CVE-2019-17195

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authenti…

CVSS: 9.8 CWE: CWE-755 - Improper Handling of Exceptional Conditions View on NVD

2019-10-14

High

CVE-2019-17511

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can get the router's log file via log_get.php, which could be used to discover the i…

CVSS: 7.5 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

Critical

CVE-2019-17574

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or…

CVSS: 9.1 CWE: CWE-639 - Authorization Bypass Through User-Controlled Key View on NVD

2019-10-11

Critical

CVE-2019-17506

There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other informati…

CVSS: 9.8 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

High

CVE-2019-17505

D-Link DAP-1320 A2-V1.21 routers have some web interfaces without authentication requirements, as demonstrated by uplink_info.xml. An attacker can remotely obtain a user's Wi-Fi SSID and password, wh…

CVSS: 7.5 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

Medium

CVE-2019-17503

An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly: it contains sensitive informa…

CVSS: 5.3 CWE: CWE-425 - Direct Request ('Forced Browsing') View on NVD

2019-10-10

Critical

CVE-2019-9531

The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated, remote attacker to connect to this port…

CVSS: 9.8 CWE: CWE-284 - Improper Access Control View on NVD

High

CVE-2019-13921

A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). Affected versions of the software contain a vulnerability that could allow an unauthenticated attacker…

CVSS: 7.5 CWE: CWE-410 - Insufficient Resource Pool View on NVD

2019-10-09

Critical

CVE-2019-17373

Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL. This affects MBR1515, MBR1516, DGN2200,…

CVSS: 9.8 CWE: N/A View on NVD

Critical

CVE-2019-17354

wan.htm page on Zyxel NBG-418N v2 with firmware version V1.00(AARP.9)C0 can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be lev…

CVSS: 9.4 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

High

CVE-2019-17353

An issue discovered on D-Link DIR-615 devices with firmware version 20.05 and 20.07. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN…

CVSS: 8.2 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

2019-10-08

Medium

CVE-2019-10963

Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which may allow sensitive information disclosure. Log files must ha…

CVSS: 4.3 CWE: CWE-321 - Use of Hard-coded Cryptographic Key View on NVD

High

CVE-2018-21020

In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place.

CVSS: 7.5 CWE: CWE-20 - Improper Input Validation View on NVD

2019-10-07

Critical

CVE-2019-15751

An unrestricted file upload vulnerability in SITOS six Build v6.2.1 allows remote attackers to execute arbitrary code by uploading a SCORM file with an executable extension. This allows an unauthenti…

CVSS: 9.8 CWE: CWE-434 - Unrestricted Upload of File with Dangerous Type View on NVD

Critical

CVE-2019-15748

SITOS six Build v6.2.1 permits unauthorised users to upload and import a SCORM 2004 package by browsing directly to affected pages. An unauthenticated attacker could use the upload and import functio…

CVSS: 9.8 CWE: CWE-434 - Unrestricted Upload of File with Dangerous Type View on NVD

2019-10-04

High

CVE-2019-4227

IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixation attack due to clients not being discon…

CVSS: 7.3 CWE: CWE-384 - Session Fixation View on NVD

2019-10-03

Medium

CVE-2019-16931

A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via t…

CVSS: 6.1 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

2019-10-02

Medium

CVE-2019-15272

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote att…

CVSS: 6.5 CWE: CWE-264 View on NVD

2019-09-26

High

CVE-2019-6161

An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB (Storage Block) BMC in firmware versions prior to 1908.M. This vulnerability al…

CVSS: 7.5 CWE: CWE-384 - Session Fixation View on NVD

Medium

CVE-2019-13523

In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data in JSON format for IP cameras…

CVSS: 5.3 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2019-4262

IBM QRadar SIEM 7.2 and 7.3 is vulnerable to Server Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the QRadar system, potentially leading t…

CVSS: 5.3 CWE: CWE-918 - Server-Side Request Forgery (SSRF) View on NVD

High

CVE-2019-14844

A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". A remote unauthenticated use…

CVSS: 7.5 CWE: CWE-628 - Function Call with Incorrectly Specified Arguments View on NVD

2019-09-25

High

CVE-2019-12648

A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Guest Operating System (Guest OS) running on…

CVSS: 8.8 CWE: CWE-284 - Improper Access Control View on NVD

Critical

CVE-2019-15069

An unsafe authentication interface was discovered in Smart Battery A4, a multifunctional portable charger, firmware version ?<= r1.7.9 . An attacker can bypass authentication without modifying device…

CVSS: 9.8 CWE: N/A View on NVD

Critical

CVE-2019-15067

An authentication bypass vulnerability discovered in Smart Battery A2-25DE, a multifunctional portable charger, firmware version ?<= SECFS-2013-10-16-13:42:58-629c30ee-60c68be6. An attacker can bypas…

CVSS: 9.8 CWE: N/A View on NVD

2019-09-24

Critical

CVE-2019-16383

MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database.…

CVSS: 9.4 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

2019-09-23

High

CVE-2018-21019

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.

CVSS: 7.5 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

2019-09-18

Critical

CVE-2019-3758

RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts with insufficient credentials. Unauthentic…

CVSS: 9.8 CWE: CWE-288 - Authentication Bypass Using an Alternate Path or Channel View on NVD

Critical

CVE-2019-11210

The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically al…

CVSS: 10.0 CWE: N/A View on NVD

High

CVE-2019-11661

Allow changes to some table by non-SysAdmin in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. This vulnerability coul…

CVSS: 8.3 CWE: N/A View on NVD

Medium

CVE-2019-14253

An issue was discovered in servletcontroller in the secure portal in Publisure 2.1.2. One can bypass authentication and perform a query on PHP forms within the /AdminDir folder that should be restric…

CVSS: 6.5 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

2019-09-17

High

CVE-2019-11667

Unauthorized access to contact information in Micro Focus Service Manager, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow unauthorized access to priv…

CVSS: 7.5 CWE: N/A View on NVD

2019-09-13

High

CVE-2019-10937

A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions < V1.1.7). An attacker with network access to the device could cause a Denial-of-Service condition by sending a specially craft…

CVSS: 7.5 CWE: CWE-20 - Improper Input Validation View on NVD

2019-09-12

High

CVE-2019-11899

An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. With Bosch Access Professional Edition (APE) 3.8, client ins…

CVSS: 7.5 CWE: CWE-284 - Improper Access Control View on NVD

2019-09-11

High

CVE-2019-5055

An exploitable denial-of-service vulnerability exists in the Host Access Point Daemon (hostapd) on the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) wireless router. A SOAP request sent in…

CVSS: 7.5 CWE: CWE-476 - NULL Pointer Dereference View on NVD

High

CVE-2019-5054

An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) HTTP server. An HTTP request with an empty…

CVSS: 7.5 CWE: CWE-476 - NULL Pointer Dereference View on NVD

Medium

CVE-2019-3760

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a SQL Injection vulnerability in Workflow Architect. A remote authenticated…

CVSS: 6.4 CWE: CWE-20 - Improper Input Validation View on NVD

2019-09-10

Critical

CVE-2019-10256

An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.

CVSS: 9.8 CWE: N/A View on NVD

Critical

CVE-2019-11496

In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As part of 5.0, the behavior of all buckets in…

CVSS: 9.1 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

High

CVE-2019-12105

In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default b…

CVSS: 8.2 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

Critical

CVE-2019-3975

Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message.

CVSS: 9.8 CWE: CWE-787 - Out-of-bounds Write View on NVD