CVE-2023-28125

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to the server by registering to receive messages from the server and perform an authentication bypass.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287 CWE-362

Affected software

No affected versions have been published.

Timeline

Published: May 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-281265.9An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploitin CVE-2023-281277.5A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosu CVE-2023-281287.2An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker t CVE-2023-281297.8DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installatio CVE-2023-28136.1All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPr CVE-2023-281307.2Local user may lead to privilege escalation using Gaia Portal hostnames page.CVE-2023-281319.6A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that confi CVE-2023-281337.8Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration file CVE-2023-281347.8Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker mus CVE-2023-28146.1A vulnerability classified as problematic has been found in SourceCodester Class Scheduling System 1.0. Affected is an unknown function of t CVE-2023-281407.0An Executable Hijacking condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers may load a mal CVE-2023-281416.3An NTFS Junction condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.8.0.31. Attackers may write files to a