Overview 367 matches · 3 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 44 EPSS ≥ 0.5
Protected by Waratek
1
0.3%
Rule in development
0
0.0%
Mitigation candidate
2
0.5%
No exploit published
0
0.0%
Outside Waratek scope
6
1.6%
Not applicable
358
97.5%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.3%
partly blocked
0
0.0%
not blocked
366
99.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
367
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 108 / year
20021
Not applicable1
High1
not blocked1
Working exploit published1
20032
Not applicable2
High2
not blocked2
Working exploit published2
20042
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20050
20063
Not applicable3
High2
Medium1
not blocked3
Working exploit published3
20079
Not applicable9
High5
Medium4
not blocked9
Working exploit published9
200861
Not applicable61
High48
Medium13
not blocked61
Working exploit published61
2009108
Mitigation candidate1
Not applicable107
Critical3
High84
Medium21
not blocked108
Working exploit published108
201018
Not applicable18
High16
Medium2
not blocked18
Working exploit published18
20116
Not applicable6
High6
not blocked6
Working exploit published6
201213
Outside Waratek scope1
Not applicable12
High6
Medium7
not blocked13
Working exploit published13
20139
Outside Waratek scope2
Not applicable7
High6
Medium3
not blocked9
Working exploit published9
201410
Not applicable10
Critical1
High7
Medium2
not blocked10
Working exploit published10
20153
Not applicable3
High3
not blocked3
Working exploit published3
20162
Not applicable2
Critical1
High1
not blocked2
Working exploit published2
201718
Not applicable18
Critical11
High7
not blocked18
Working exploit published18
201826
Outside Waratek scope1
Not applicable25
Critical13
High12
Medium1
not blocked26
Working exploit published26
201910
Outside Waratek scope1
Not applicable9
Critical5
High3
Medium2
not blocked10
Working exploit published10
202021
Not applicable21
Critical12
High5
Medium4
not blocked21
Working exploit published21
20214
Mitigation candidate1
Not applicable3
Critical2
High1
Medium1
not blocked4
Working exploit published4
202210
Outside Waratek scope1
Not applicable9
Critical6
High3
Medium1
not blocked10
Working exploit published10
20239
Protected by Waratek1
Not applicable8
Critical5
High3
Medium1
blocked by ARMR today1
not blocked8
Working exploit published9
20246
Not applicable6
Critical3
High3
not blocked6
Working exploit published6
20256
Not applicable6
Critical5
High1
not blocked6
Working exploit published6
202610
Not applicable10
Critical5
High2
Medium3
not blocked10
Working exploit published10
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-62850 | Medium | 2026-11-06 | Not applicable | Working exploit published | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php maintenance endpoint is reachable without an appropriate authentication or access-control boundary. Response differences for attacker-controlled path values disclose whether arbitrary directories and files exist on the server. The same endpoint validates application-key and database-password candidates without rate limiting, per-session throttling, or a CAPTCHA, allowing unrestricted guessing attempts against application secrets. This issue is fixed in version 1.8.225. |
| CVE-2026-116006 | Medium | 2026-10-25 | Not applicable | Working exploit published | A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-85595 | Critical | 2026-09-04 | Not applicable | Working exploit published | Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password. |
| CVE-2026-11387 | Critical | 2026-07-01 | Not applicable | Working exploit published | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full access to those accounts. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. This is only vulnerable on sites with OTP verification for password resets enabled, and where the administrator (or other user) has set a phone number for OTP verification. |
| CVE-2026-44551 | Critical | 2026-05-15 | Not applicable | Working exploit published | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accepts password: str with no minimum length constraint, so an empty string passes validation. The subsequent Connection.bind() call succeeds on vulnerable LDAP servers, and the application issues a full session token for the target user. This vulnerability is fixed in 0.9.0. |
| CVE-2026-0558 | Critical | 2026-03-29 | Not applicable | Working exploit published | A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the `Depends(get_current_active_user)` dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's documented security policies. |
| CVE-2026-24898 | Critical | 2026-03-03 | Not applicable | Working exploit published | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx callback endpoint allows any unauthenticated visitor to obtain the practice's MedEx API tokens, leading to complete third-party service compromise, PHI exfiltration, unauthorized actions on the MedEx platform, and HIPAA violations. The vulnerability exists because the endpoint bypasses authentication ($ignoreAuth = true) and performs a MedEx login whenever $_POST['callback_key'] is provided, returning the full JSON response including sensitive API tokens. This vulnerability is fixed in 8.0.0. |
| CVE-2026-26077 | Medium | 2026-02-26 | Not applicable | Working exploit published | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) in the `WebhooksController` accepted requests without a valid authentication token when no token was configured. This allowed unauthenticated attackers to forge webhook payloads and artificially inflate user bounce scores, potentially causing legitimate user emails to be disabled. The Mailpace endpoint had no token validation at all. Starting in versions 2025.12.2, 2026.1.1, and 2026.2.0, all webhook endpoints reject requests with a 406 response when no authentication token is configured. As a workaround, ensure that webhook authentication tokens are configured for all email provider integrations in site settings (e.g., `sendgrid_verification_key`, `mailjet_webhook_token`, `postmark_webhook_token`, `sparkpost_webhook_token`). There's no current workaround for mailpace before getting this fix. |
| CVE-2026-1368 | High | 2026-02-18 | Not applicable | Working exploit published | The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key. |
| CVE-2026-22594 | High | 2026-01-10 | Not applicable | Working exploit published | Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0. |
| CVE-2025-68926 | Critical | 2025-12-30 | Not applicable | Working exploit published | RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue. |
| CVE-2025-66039 | Critical | 2025-12-09 | Not applicable | Working exploit published | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23. |
| CVE-2025-55169 | Critical | 2025-08-12 | Not applicable | Working exploit published | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8. |
| CVE-2025-49001 | High | 2025-06-03 | Not applicable | Working exploit published | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully, so a user can use any secret to forge a JWT token. The vulnerability has been fixed in v2.10.10. No known workarounds are available. |
| CVE-2024-57045 | Critical | 2025-02-18 | Not applicable | Working exploit published | A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page. |
| CVE-2024-48445 | Critical | 2025-02-04 | Not applicable | Working exploit published | An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters. |
| CVE-2024-47533 | Critical | 2024-11-18 | Not applicable | Working exploit published | Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue. |
| CVE-2024-49757 | High | 2024-10-25 | Not applicable | Working exploit published | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available. |
| CVE-2024-37152 | High | 2024-06-06 | Not applicable | Working exploit published | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17. |
| CVE-2023-38096 | Critical | 2024-05-03 | Not applicable | Working exploit published | NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of NETGEAR ProSAFE Network Management System. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MyHandlerInterceptor class. The issue results from improper implementation of the authentication mechanism. An attacker can leverage this vulnerability to bypass authentication on the system. . Was ZDI-CAN-19718. |
| CVE-2024-26331 | High | 2024-04-30 | Not applicable | Working exploit published | ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. Attackers can easily modify the cookie value, within a browser or by implementing client-side code outside of a browser. Attackers can bypass the authentication mechanism by modifying the cookie to contain an expected value. |
| CVE-2024-24496 | Critical | 2024-02-08 | Not applicable | Working exploit published | An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php components. |
| CVE-2022-34267 | Critical | 2023-12-25 | Not applicable | Working exploit published | An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint. |
| CVE-2022-41678 | High | 2023-11-28 | Protected by Waratek | Working exploit published | Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0. |
| CVE-2023-4568 | Medium | 2023-09-13 | Not applicable | Working exploit published | PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch. |
| CVE-2023-4415 | High | 2023-08-18 | Not applicable | Working exploit published | A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/sys/login. The manipulation leads to improper authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-237518 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2023-37266 | Critical | 2023-07-17 | Not applicable | Working exploit published | CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly. |
| CVE-2023-27823 | Critical | 2023-05-12 | Not applicable | Working exploit published | An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials. |
| CVE-2023-28503 | Critical | 2023-03-29 | Not applicable | Working exploit published | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication checks and execute OS commands as the root user. |
| CVE-2023-0905 | High | 2023-02-18 | Not applicable | Working exploit published | A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file changePasswordForEmployee.php. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221454 is the identifier assigned to this vulnerability. |
| CVE-2022-47003 | Critical | 2023-02-01 | Not applicable | Working exploit published | A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request. |
| CVE-2022-42233 | Critical | 2022-10-20 | Not applicable | Working exploit published | Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability. |
| CVE-2022-3218 | Critical | 2022-09-19 | Not applicable | Working exploit published | Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution. |
| CVE-2022-32429 | Critical | 2022-08-10 | Not applicable | Working exploit published | An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unauthenticated attackers to arbitrarily configure settings within the application, leading to remote code execution. |
| CVE-2022-31125 | Critical | 2022-07-06 | Not applicable | Working exploit published | Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to bypass authentication and access admin functionality by sending a specially crafted HTTP request. This affects Roxywi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue. |
| CVE-2021-43116 | High | 2022-07-05 | Outside Waratek scope | Working exploit published | An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login. |
| CVE-2022-29775 | Critical | 2022-06-21 | Not applicable | Working exploit published | iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL. |
| CVE-2022-28955 | High | 2022-05-18 | Not applicable | Working exploit published | An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php. |
| CVE-2021-45841 | High | 2022-04-25 | Not applicable | Working exploit published | In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest. |
| CVE-2021-26598 | Medium | 2022-03-28 | Not applicable | Working exploit published | ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token). |
| CVE-2022-22831 | Critical | 2022-02-06 | Not applicable | Working exploit published | An issue was discovered in Servisnet Tessa 0.0.2. An attacker can add a new sysadmin user via a manipulation of the Authorization HTTP header. |
| CVE-2021-39165 | High | 2021-08-26 | Not applicable | Working exploit published | Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected. |
| CVE-2021-31251 | Critical | 2021-06-04 | Not applicable | Working exploit published | An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileged connection with the target device by supplying a specially malformed request and an attacker may force the remote telnet server to believe that the user has already authenticated. |
| CVE-2021-27651 | Critical | 2021-04-29 | Not applicable | Working exploit published | In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks. |
| CVE-2020-27838 | Medium | 2021-03-08 | Mitigation candidate | Working exploit published | A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality. |
| CVE-2020-24579 | High | 2020-12-22 | Not applicable | Working exploit published | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality. |
| CVE-2020-26214 | Critical | 2020-11-06 | Not applicable | Working exploit published | In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients. |
| CVE-2020-25592 | Critical | 2020-11-06 | Not applicable | Working exploit published | In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. |
| CVE-2019-15993 | Medium | 2020-09-23 | Not applicable | Working exploit published | A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of an affected device. A successful exploit could allow the attacker to access sensitive device information, which includes configuration files. |
| CVE-2020-5777 | Critical | 2020-09-01 | Not applicable | Working exploit published | MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections (default 151) is lower than Apache (or another web server) setting MaxRequestWorkers (formerly MaxClients) (default 256). This can be done by sending at least 151 simultaneous requests to the Magento website to trigger a "Too many connections" error, then use default magmi:magmi basic authentication to remotely bypass authentication. |
| CVE-2020-15921 | Critical | 2020-07-24 | Not applicable | Working exploit published | Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execution. |
| CVE-2020-8606 | Critical | 2020-05-27 | Not applicable | Working exploit published | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance. |
| CVE-2015-6922 | Critical | 2020-02-17 | Not applicable | Working exploit published | Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an administrative account via crafted request to LocalAuth/setAccount.aspx or (2) write to and execute arbitrary files via a full pathname in the PathData parameter to ConfigTab/uploader.aspx. |
| CVE-2014-8347 | High | 2020-02-11 | Not applicable | Working exploit published | An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 and Filemaker Pro Advanced 12.04, which could let a malicious user obtain elevated privileges. |
| CVE-2013-5582 | High | 2020-02-11 | Not applicable | Working exploit published | Ammyy Admin 3.2 and earlier stores the client ID at a fixed memory location, which might make it easier for user-assisted remote attackers to bypass authentication by running a local program that extracts a field from the AA_v3.2.exe file. |
| CVE-2013-1360 | Critical | 2020-02-11 | Not applicable | Working exploit published | An Authentication Bypass vulnerability exists in DELL SonicWALL Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0, Analyzer 7.0, Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, and 6.0 via a crafted request to the SGMS interface, which could let a remote malicious user obtain administrative access. |
| CVE-2013-1359 | Critical | 2020-02-11 | Not applicable | Working exploit published | An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, 5.1, and 6.0 via the skipSessionCheck parameter to the UMA interface (/appliance/), which could let a remote malicious user obtain access to the root account. |
| CVE-2020-8771 | Critical | 2020-02-06 | Not applicable | Working exploit published | The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts. |
| CVE-2013-2681 | Critical | 2020-02-05 | Not applicable | Working exploit published | Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized access. |
| CVE-2013-7051 | High | 2020-02-04 | Not applicable | Working exploit published | D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters |
| CVE-2013-3215 | Critical | 2020-01-29 | Not applicable | Working exploit published | vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function. |
| CVE-2013-2569 | High | 2020-01-29 | Not applicable | Working exploit published | A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, which could let a malicious user obtain unauthorized access to the live video stream. |
| CVE-2013-1600 | Medium | 2020-01-28 | Not applicable | Working exploit published | An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-2121 1.06_FR, 1.06, and 1.05_RU, DCS-2102 1.06_FR. 1.06, and 1.05_RU, which could let a malicious user obtain sensitive information. |
| CVE-2013-1596 | Medium | 2020-01-24 | Not applicable | Working exploit published | An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554. |
| CVE-2014-5081 | Critical | 2020-01-10 | Not applicable | Working exploit published | sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass |
| CVE-2012-1258 | Medium | 2020-01-09 | Not applicable | Working exploit published | cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate user permissions, which allow remote attackers to add user accounts with administrator privileges via the newuser, pwd, and selectedUserGroup parameters. |
| CVE-2013-4982 | Critical | 2019-12-27 | Not applicable | Working exploit published | AVTECH AVN801 DVR has a security bypass via the administration login captcha |
| CVE-2013-4976 | Critical | 2019-12-27 | Not applicable | Working exploit published | Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials |
| CVE-2013-5123 | Medium | 2019-11-05 | Not applicable | Working exploit published | The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks. |
| CVE-2013-1391 | High | 2019-10-30 | Not applicable | Working exploit published | Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration. |
| CVE-2019-1937 | Critical | 2019-08-21 | Outside Waratek scope | Working exploit published | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to use the acquired session token to gain full administrator access to the affected device. |
| CVE-2019-13294 | Critical | 2019-07-04 | Not applicable | Working exploit published | AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. Therefore an unauthenticated user can execute a command on the system. |
| CVE-2019-7666 | High | 2019-07-01 | Not applicable | Working exploit published | Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash value of the password, which may allow an attacker with access to the database to login as admin without decrypting the password. |
| CVE-2019-10273 | Medium | 2019-04-04 | Not applicable | Working exploit published | Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account. |
| CVE-2019-6441 | Critical | 2019-03-21 | Not applicable | Working exploit published | An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices. The password reset functionality of the router doesn't have backend validation for the current password and doesn't require any type of authentication. By making a POST request to the apply.cgi file of the router, the attacker can change the admin username and password of the router. |
| CVE-2018-20735 | High | 2019-01-17 | Not applicable | Working exploit published | An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if the password provided for the given username is correct; it does not verify the permissions of the user on the network. This means if you have PATROL Agent installed on a high value target (domain controller), you can use a low privileged domain user to authenticate with PatrolCli and then connect to the domain controller and run commands as SYSTEM. This means any user on a domain can escalate to domain admin through PATROL Agent. NOTE: the vendor disputes this because they believe it is adequate to prevent this escalation by means of a custom, non-default configuration |
| CVE-2018-19616 | High | 2018-12-26 | Not applicable | Working exploit published | An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element. |
| CVE-2018-19458 | High | 2018-11-22 | Not applicable | Working exploit published | In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246. |
| CVE-2018-7358 | High | 2018-11-14 | Not applicable | Working exploit published | ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may allow an unauthorized user to perform unauthorized operations. |
| CVE-2018-10933 | Critical | 2018-10-17 | Outside Waratek scope | Working exploit published | A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access. |
| CVE-2018-12455 | High | 2018-10-10 | Not applicable | Working exploit published | Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using "admin:" as the name of a cookie. |
| CVE-2012-6710 | Critical | 2018-10-07 | Not applicable | Working exploit published | ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to index.php. |
| CVE-2018-17153 | Critical | 2018-09-18 | Not applicable | Working exploit published | It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the device. (Whenever an admin logs into My Cloud, a server-side session is created that is bound to the user's IP address. After the session is created, it is possible to call authenticated CGI modules by sending the cookie username=admin in the HTTP request. The invoked CGI will check if a valid session is present and bound to the user's IP address.) It was found that it is possible for an unauthenticated attacker to create a valid session without a login. The network_mgr.cgi CGI module contains a command called "cgi_get_ipv6" that starts an admin session -- tied to the IP address of the user making the request -- if the additional parameter "flag" with the value "1" is provided. Subsequent invocation of commands that would normally require admin privileges now succeed if an attacker sets the username=admin cookie. |
| CVE-2018-16668 | Medium | 2018-09-18 | Not applicable | Working exploit published | An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/repository. |
| CVE-2018-15152 | Critical | 2018-08-15 | Not applicable | Working exploit published | Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (1) portal/add_edit_event_user.php, (2) portal/find_appt_popup_user.php, (3) portal/get_allergies.php, (4) portal/get_amendments.php, (5) portal/get_lab_results.php, (6) portal/get_medications.php, (7) portal/get_patient_documents.php, (8) portal/get_problems.php, (9) portal/get_profile.php, (10) portal/portal_payment.php, (11) portal/messaging/messages.php, (12) portal/messaging/secure_chat.php, (13) portal/report/pat_ledger.php, (14) portal/report/portal_custom_report.php, or (15) portal/report/portal_patient_report.php without authenticating as a patient. |
| CVE-2018-8898 | Critical | 2018-05-23 | Not applicable | Working exploit published | A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT_77616E6771696F6E67") allows unauthenticated attackers to perform arbitrary modification (read, write) to passwords and configurations meanwhile an administrator is logged into the web panel. |
| CVE-2018-10576 | High | 2018-04-30 | Not applicable | Working exploit published | An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentication handling by the native Access Point web UI allows authentication using a local system account (instead of the dedicated web-only user). |
| CVE-2018-1418 | High | 2018-04-26 | Not applicable | Working exploit published | IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM X-Force ID: 138824. |
| CVE-2018-6546 | Critical | 2018-04-13 | Not applicable | Working exploit published | plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, executes code at a user-defined (local or SMB) path as SYSTEM when the execute_installer parameter is used in an HTTP message. This occurs without properly authenticating the user. |
| CVE-2016-8380 | High | 2018-04-05 | Not applicable | Working exploit published | The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication. |
| CVE-2016-8371 | High | 2018-04-05 | Not applicable | Working exploit published | The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled. |
| CVE-2018-9248 | Critical | 2018-04-04 | Not applicable | Working exploit published | FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header. |
| CVE-2018-9032 | Critical | 2018-03-27 | Not applicable | Working exploit published | An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmware Version : 1.02-2.06) devices potentially allows attackers to bypass SharePort Web Access Portal by directly visiting /category_view.php or /folder_view.php. |
| CVE-2018-8715 | High | 2018-03-15 | Not applicable | Working exploit published | The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types. |
| CVE-2018-8096 | Critical | 2018-03-14 | Not applicable | Working exploit published | Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticationenabled","Value":false' in an api/settings/setting-isauthenticationenabled PUT request. |
| CVE-2018-6328 | Critical | 2018-03-14 | Not applicable | Working exploit published | It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes. |
| CVE-2018-0886 | High | 2018-03-14 | Not applicable | Working exploit published | The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709 Windows Server 2016 and Windows Server, version 1709 allows a remote code execution vulnerability due to how CredSSP validates request during the authentication process, aka "CredSSP Remote Code Execution Vulnerability". |
| CVE-2018-7750 | Critical | 2018-03-13 | Not applicable | Working exploit published | transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step. |
| CVE-2018-7745 | High | 2018-03-07 | Not applicable | Working exploit published | An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/install/installation/createuserinfo requests, resulting in account creation. |
| CVE-2018-6180 | Critical | 2018-02-08 | Not applicable | Working exploit published | A flaw in the profile section of Online Voting System 1.0 allows an unauthenticated user to set an arbitrary password for other accounts. |