OpenMetadata - Authentication Bypass

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The JwtFilter handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request...

X-force

IBM X-Force Exchange 라이브러리 | IBM Security X-FORCE Exchange 라이브러리 Python 3. 검색: threatactivities, threatgroups, malwareanalysis, collector 및 industries. 다른 애플리케이션용. 참조 ---|--- 설치 root@kitploit: pip3 install XForce 사용 APIKEY를 사용하여 기본 인증을 수행합니다. 참조. 그런 다음 base64 코드를 만듭니다 → Key + : + Password:...

CVE-2025-492030

CVE-2025-492030 セキュリティ勧告: CVE-2025-492030 概要 SecureVPN アプリケーションに重大な脆弱性が確認されました。この脆弱性により、脆弱なAPIエンドポイントを介して アカウント乗っ取り が可能になります。この欠陥により、攻撃者はユーザーアカウントへの不正アクセスを取得し、機密データの漏洩やユーザープライバシーの侵害につながる可能性があります。 脆弱性の詳細 CVE ID : CVE-2025-492030 深刻度 : 重大 影響 : アカウント乗っ取り 影響を受けるコンポーネント : SecureVPN API エンドポイント 攻撃経路 :...

CVE-2026-17038

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading an...

EUVD-2026-75403

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading an...

CVE-2026-17038 Use of Hard-coded Credentials in drEryk Gabinet

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading an...

CVE-2026-17038

DrEryk Gabinet versions prior to 11.5.0 embed hard-coded API credentials within its ticket reporting component. An attacker who discovers these credentials can authenticate directly to the ticket system API, bypassing the application's normal access controls and performing privileged operations s...

CVE-2021-36460

CVE-2021-36460 NVD CVE-2021-36460: https://nvd.nist.gov/vuln/detail/CVE-2021-36460 MITRE CVE-2021-36460: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-36460 CWE-836: 認証にパスワードの代わりにパスワードハッシュを使用 VeryFitProアプリ（Android:...

PT-2026-89363

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading an...

[SECURITY] Fedora 44 Update: perl-Net-OAuth-0.33-1.fc44

Perl implementation of OAuth, an open protocol to allow secure API authentication in a simple and standard method from desktop and web applications. In practical terms, a mechanism for a Consumer to request protected resources from a Service Provider on behalf of a user...

[SECURITY] Fedora 43 Update: perl-Net-OAuth-0.33-1.fc43

Perl implementation of OAuth, an open protocol to allow secure API authentication in a simple and standard method from desktop and web applications. In practical terms, a mechanism for a Consumer to request protected resources from a Service Provider on behalf of a user...

CVE-2026-61614 SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser...

CVE-2026-82269

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

EUVD-2026-67800

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

PT-2026-82338

Name of the Vulnerable Software and Affected Versions disconf version 2.6.36 Description Incorrect Access Control allows anonymous attackers to read all configuration items and files managed by the config center. This occurs because the LoginInterceptor explicitly whitelists specific...

CVE-2026-44252

Wazuh Manager (versions 4.0.0 through 4.14.5) contains an RBAC bypass that enables privilege escalation from a low-privilege read-only API user to full administrative control. The root cause is twofold: the cluster Fernet key is exposed via GET /manager/configuration?raw=true to any user with man...

CVE-2026-52793

Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API key and secret for an administrator or customer account without checking type2fa, validating a TOTP code, or invoking...

CVE-2026-52793 Froxlor: API Authentication bypasses 2FA Authentication

Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API key and secret for an administrator or customer account without checking type2fa, validating a TOTP code, or invoking...

CVE-2026-52793 Froxlor: API Authentication bypasses 2FA Authentication

Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API key and secret for an administrator or customer account without checking type2fa, validating a TOTP code, or invoking...

CVE-2026-52793

Froxlor (open source server administration software) versions prior to 2.3.7 have a flaw in FroxlorRPC::validateAuth() (lib/Froxlor/Api/FroxlorRPC.php): it validates only API key/secret without checking type_2fa or invoking FloxlorTwoFactorAuth, so a 2FA-enabled account's API key grants full acce...