28 matches found
CVE-2025-27847
CVE-2025-27847 affects ESPEC North America Web Controller 3 (prior to 3.3.8). The issue is that user session privileges are not revoked on logout via the /api/v4/auth/ endpoint, which can allow continued access after logout. CVSS v3.1 metrics indicate a Medium impact with Privileges Required: Non...
CVE-2023-52268
CVE-2023-52268 affects the FreeScout End-User Portal module pre-1.0.65. The root cause is improper session token handling at the /auth endpoint, enabling an attacker to authenticate as arbitrary users and impersonate them to access their tickets. Impact is high confidentiality/integrity loss with...
PT-2024-14501 · Unknown · Freescout End-User Portal
Name of the Vulnerable Software and Affected Versions: FreeScout End-User Portal module versions prior to 1.0.65 Description: The issue allows an attacker to authenticate as an arbitrary user because a session token can be sent to the "/auth" endpoint. Recommendations: For versions prior to 1.0.6...
PT-2024-5665 · Tenda · Tenda I22
Name of the Vulnerable Software and Affected Versions: Tenda i22 version 1.0.0.34687 Description: The issue is related to a buffer overflow in the formApPortalWebAuth function due to lack of input size validation. This can be exploited by a remote attacker to impact the confidentiality, integrity...
PT-2024-35711 · Unknown · Lunary-Ai/Lunary
Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary affected versions not specified Description: A Server-Side Request Forgery SSRF vulnerability exists in the lunary-ai/lunary application, specifically within the endpoint "/auth/saml/tto/download-idp-xml". The vulnerability...
PT-2023-26359 · Opennds +1 · Opennds +1
Name of the Vulnerable Software and Affected Versions: OpenNDS versions prior to 4.17.0.12 Description: The issue allows remote attackers to cause a denial of service through a GET request to "/opennds auth/" that lacks a custom query string parameter and client-token, resulting in a NULL pointer...
