CVE-2017-16776
HighSummary
An authentication bypass vulnerability was discovered in version 2.0.2 of the Conserus Workflow Intelligence application. An attacker can exploit this by sending a malicious HTTP GET request to gain access to higher privilege user accounts.
Risk Assessment
This vulnerability allows an attacker to bypass authentication mechanisms, potentially leading to privilege escalation and unauthorized access to user data.
Recommendation
It is recommended to update the application to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Related vulnerabilities
- CVE-2026-94053Critical
Authentication bypass via LDAP injection in the sshd-ldap component of Apache MINA SSHD. Lack of escaping LDAP filter metacharacters enables successful authentication with username "*" and password "*".
- CVE-2026-94052Critical
A missing check in LdapPasswordAuthenticator in the sshd-ldap component of Apache MINA SSHD allows bypassing authentication checks. The vulnerability only affects servers using LdapPasswordAuthenticator for password authentication.
- CVE-2026-77185Critical
Authentication bypass in sshd-core of Apache MINA SSHD. A flaw in the implementation of the "asynchronous authentication" mechanism could potentially lead to skipping signature checks in public-key or hostbased authentication, or returning a wrong result.
- CVE-2026-102458Critical
Missing Authentication vulnerability in EasyFlow .NET by Digiwin. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.
- CVE-2026-102455Critical
Insecure Deserialization vulnerability in EasyFlow .NET by Digiwin. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
- CVE-2026-102508Critical
The OPC UA driver in Apache PLC4X (PLC4J) improperly verifies cryptographic signatures and server certificates. An attacker in a network position between client and server can impersonate the OPC UA server and read, forge, or modify secure-channel traffic, including user credentials sent by the client. The issue affects versions 0.9.0 through 0.13.1 and is fixed in version 1.0.0.
- CVE-2026-97196Critical
Improper Validation of Unsafe Equivalence in Input vulnerability in GiveWP by Liquid Web / StellarWP allows Authentication Bypass. The issue affects GiveWP from n/a through 4.16.9.
- CVE-2026-103110Critical
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node.
- CVE-2026-102911Critical
A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to OS command injection. The attack can be executed remotely. The exploit has been published and may be used.
- CVE-2026-103056Critical
AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges.
Original NVD description (English source)
Security researchers discovered an authentication bypass vulnerability in version 2.0.2 of the Conserus Workflow Intelligence application by McKesson Medical Imaging Company, which is now a Change Healthcare company. The attacker must send a malicious HTTP GET request to exploit the vulnerability. The vulnerability allows an attacker to bypass authentication and escalate privileges of valid users. An unauthenticated attacker can exploit the vulnerability and be granted limited access to other accounts. An authenticated attacker can exploit the vulnerability and be granted access reserved for higher privilege users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS