CVE & Exploit Intelligence Database

Updated 59m ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

338,223 CVEs tracked 53,281 with exploits 4,731 exploited in wild 1,542 CISA KEV 3,929 Nuclei templates 37,826 vendors 42,573 researchers

4,085 results Clear all

CVE-2013-7093 EPSS 0.00

SAProuter 39.3 SP4 - Auth Bypass

SAP Network Interface Router (SAProuter) 39.3 SP4 allows remote attackers to bypass authentication and modify the configuration via unspecified vectors.

CWE-287 Dec 13, 2013

CVE-2013-6171 EPSS 0.00

Dovecot < 2.2.6 - Authentication Bypass

checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the response to the dovecot-auth server.

CWE-287 Dec 09, 2013

CVE-2013-6920 EPSS 0.01

Siemens Sinamics S/g Family Firmware < 4.6 - Authentication Bypass

Siemens SINAMICS S/G controllers with firmware before 4.6.11 do not require authentication for FTP and TELNET sessions, which allows remote attackers to bypass intended access restrictions via TCP traffic to port (1) 21 or (2) 23.

CWE-287 Dec 07, 2013

CVE-2013-6634 EPSS 0.01

Google Chrome < 31.0.1650.62 - Authentication Bypass

The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/one_click_signin_helper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper sync after a 302 (aka Found) HTTP status code.

CWE-287 Dec 07, 2013

CVE-2013-6859 EPSS 0.01

Sybase Adaptive Server Enterprise - Authentication Bypass

SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3. 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 does not properly perform authorization, which allows remote authenticated users to gain privileges via unspecified vectors.

CWE-287 Nov 23, 2013

CVE-2013-6828 EPSS 0.00

Pineapp Mail-secure - Authentication Bypass

admin/management.html in PineApp Mail-SeCure allows remote attackers to bypass authentication and perform a sys_usermng operation via the it parameter.

CWE-287 Nov 20, 2013

CVE-2013-4435 EPSS 0.00

Salt < 0.17.1 - Authentication Bypass

Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.

CWE-287 Nov 05, 2013

CVE-2013-6347 EPSS 0.02

Novell Zenworks Configuration Management - Authentication Bypass

Session fixation vulnerability in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack web sessions via unspecified vectors.

CWE-287 Nov 02, 2013

CVE-2013-6012 EPSS 0.00

Juniper Junos - Authentication Bypass

Juniper Junos 12.1X44 before 12.1.X44-D20 and 12.1X45 before 12.1X45-D15, when the no-validate option is enabled, does not properly handle configuration validation errors during the config commit phase of the boot-up sequence, which allows remote attackers to bypass authentication via unspecified vectors.

CWE-287 Oct 28, 2013

CVE-2013-2102 EPSS 0.00

Redhat Jboss Enterprise Portal Platform - Authentication Bypass

The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started, which allows remote attackers to obtain sensitive information (diagnostics) by accessing the service.

CWE-287 Oct 28, 2013

CVE-2013-4965 EPSS 0.01

Puppet Enterprise <3.1.0 - Auth Bypass

Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force attack.

CWE-287 Oct 25, 2013

CVE-2013-5531 EPSS 0.00

Cisco ISE <1.1.1 - Auth Bypass

Cisco Identity Services Engine (ISE) 1.x before 1.1.1 allows remote attackers to bypass authentication, and read support-bundle configuration and credentials data, via a crafted session on TCP port 443, aka Bug ID CSCty20405.

CWE-287 Oct 25, 2013

CVE-2013-5511 EPSS 0.02

Cisco ASA <9.1.2.6 - Auth Bypass

The Adaptive Security Device Management (ASDM) remote-management feature in Cisco Adaptive Security Appliance (ASA) Software 8.2.x before 8.2(5.46), 8.3.x before 8.3(2.39), 8.4.x before 8.4(6), 8.5.x before 8.5(1.18), 8.6.x before 8.6(1.12), 8.7.x before 8.7(1.7), 9.0.x before 9.0(3.1), and 9.1.x before 9.1(2.6) does not properly implement the authentication-certificate option, which allows remote attackers to bypass authentication via a TCP session to an ASDM interface, aka Bug ID CSCuh44815.

CWE-287 Oct 13, 2013

CVE-2013-5510 EPSS 0.00

Cisco ASA <9.1.2.5 - Auth Bypass

The remote-access VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 7.x before 7.2(5.12), 8.x before 8.2(5.46), 8.3.x before 8.3(2.39), 8.4.x before 8.4(6), 8.6.x before 8.6(1.12), 9.0.x before 9.0(3.1), and 9.1.x before 9.1(2.5), when an override-account-disable option is enabled, does not properly parse AAA LDAP responses, which allows remote attackers to bypass authentication via a VPN connection attempt, aka Bug ID CSCug83401.

CWE-287 Oct 13, 2013

CVE-2013-4824 1 PoC Analysis EPSS 0.78

HP iMC - Auth Bypass

Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote attackers to bypass authentication via unknown vectors, aka ZDI-CAN-1644.

CWE-287 Oct 13, 2013

CVE-2013-3610 EPSS 0.00

Asus Rt-n10e Firmware < 2.0.0.24 - Authentication Bypass

qis/QIS_finish.htm on the ASUS RT-N10E router with firmware before 2.0.0.25 does not require authentication, which allows remote attackers to discover the administrator password via a direct request.

CWE-287 Oct 05, 2013

CVE-2013-5163 EPSS 0.00

Apple Mac OS X <10.8.5 - Auth Bypass

Directory Services in Apple Mac OS X before 10.8.5 Supplemental Update allows local users to bypass password-based authentication and modify arbitrary Directory Services records via unspecified vectors.

CWE-287 Oct 04, 2013

CVE-2013-5944 EPSS 0.01

Siemens Scalance X-200 Series Firmware < 4.4 - Authentication Bypass

The integrated web server on Siemens SCALANCE X-200 switches with firmware before 4.5.0 and X-200IRT switches with firmware before 5.1.0 does not properly enforce authentication requirements, which allows remote attackers to perform administrative actions via requests to the management interface.

CWE-287 Oct 03, 2013

CVE-2013-3417 EPSS 0.00

Cisco Video Surveillance Operations Manager - Authentication Bypass

The administrative web interface in Cisco Video Surveillance Operations Manager does not properly perform authentication, which allows remote attackers to watch video feeds via a crafted URL, aka Bug ID CSCtg72262.

CWE-287 Sep 30, 2013

CVE-2013-5200 EPSS 0.01

Open-Xchange AppSuite <7.0.2-7.2.2 - Info Disclosure

The (1) REST and (2) memcache interfaces in the Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 do not require authentication, which allows remote attackers to obtain sensitive information or modify data via an API call.

CWE-287 Sep 25, 2013