Total
156 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-52534 | 1 Dell | 1 Elastic Cloud Storage | 2025-01-21 | N/A | 5.4 MEDIUM |
| Dell ECS, version(s) prior to ECS 3.8.1.3, contain(s) an Authentication Bypass by Capture-replay vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Session theft. | |||||
| CVE-2023-31762 | 1 Mydigoo | 2 Dg-hamb, Dg-hamb Firmware | 2025-01-17 | N/A | 7.5 HIGH |
| Weak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access to the system via a code replay attack. | |||||
| CVE-2023-31761 | 1 Blitzwolf | 2 Bw-is22, Bw-is22 Firmware | 2025-01-17 | N/A | 7.5 HIGH |
| Weak security in the transmitter of Blitzwolf BW-IS22 Smart Home Security Alarm v1.0 allows attackers to gain full access to the system via a code replay attack. | |||||
| CVE-2023-31759 | 1 Keruistore | 2 Kerui W18, Kerui W18 Firmware | 2025-01-17 | N/A | 7.5 HIGH |
| Weak Security in the 433MHz keyfob of Kerui W18 Alarm System v1.0 allows attackers to gain full access via a code replay attack. | |||||
| CVE-2023-31763 | 1 Agshome Smart Alarm Project | 2 Agshome Smart Alarm, Agshome Smart Alarm Firmware | 2025-01-17 | N/A | 7.5 HIGH |
| Weak security in the transmitter of AGShome Smart Alarm v1.0 allows attackers to gain full access to the system via a code replay attack. | |||||
| CVE-2024-12839 | 2024-12-31 | N/A | 8.8 HIGH | ||
| The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device. | |||||
| CVE-2018-9477 | 1 Google | 1 Android | 2024-12-18 | N/A | 7.8 HIGH |
| In the development options section of the Settings app, there is a possible authentication bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | |||||
| CVE-2024-5249 | 1 Perforce | 1 Akana Api | 2024-11-21 | N/A | 5.4 MEDIUM |
| In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed. | |||||
| CVE-2024-38438 | 1 Dlink | 2 Dsl-225, Dsl-225 Firmware | 2024-11-21 | N/A | 9.8 CRITICAL |
| D-Link - CWE-294: Authentication Bypass by Capture-replay | |||||
| CVE-2024-38284 | 2024-11-21 | N/A | N/A | ||
| Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicate calls. | |||||
| CVE-2024-38272 | 1 Google | 1 Nearby | 2024-11-21 | N/A | 4.3 MEDIUM |
| There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quick Share or above | |||||
| CVE-2024-37016 | 2024-11-21 | N/A | 6.8 MEDIUM | ||
| Mengshen Wireless Door Alarm M70 2024-05-24 allows Authentication Bypass via a Capture-Replay approach. | |||||
| CVE-2024-34065 | 1 Strapi | 1 Strapi | 2024-11-21 | N/A | 7.1 HIGH |
| Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click). Unauthenticated attackers can leverage two vulnerabilities to obtain an 3rd party token and the bypass authentication of Strapi apps. Users should upgrade @strapi/plugin-users-permissions to version 4.24.2 to receive a patch. | |||||
| CVE-2024-29851 | 2024-11-21 | N/A | 7.2 HIGH | ||
| Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account. | |||||
| CVE-2024-29850 | 2024-11-21 | N/A | 8.8 HIGH | ||
| Veeam Backup Enterprise Manager allows account takeover via NTLM relay. | |||||
| CVE-2023-6374 | 1 Mitsubishielectric | 2 Melsec Ws0-geth00200, Melsec Ws0-geth00200 Firmware | 2024-11-21 | N/A | 5.9 MEDIUM |
| Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the affected module. As a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and parameters in the modules. | |||||
| CVE-2023-50128 | 1 Hozard | 1 Alarm System | 2024-11-21 | N/A | 5.3 MEDIUM |
| The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which results in an attacker being able to conduct replay attacks to bring the alarm system to a disarmed state. | |||||
| CVE-2023-49231 | 2024-11-21 | N/A | 9.8 CRITICAL | ||
| An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token. | |||||
| CVE-2023-47435 | 2024-11-21 | N/A | 9.8 CRITICAL | ||
| An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected pages. | |||||
| CVE-2023-46892 | 1 Meross | 2 Msh30q, Msh30q Firmware | 2024-11-21 | N/A | 8.8 HIGH |
| The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record and replay previously captured communication to execute unauthorized commands or actions (e.g., thermostat's temperature). | |||||