OESA-2025-1170 etcd security update

%expand: Security Fixes: Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.CVE-2021-28235 Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.CVE-2022-3064 Etcd v3.5.4 allows remote...

CVE-2024-1379

The Website Article Monetization By MageNet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'abpauthkey' parameter in all versions up to, and including, 1.0.11 due to insufficient input sanitization and output escaping and a missing authorization check. This makes it...

POLR URL 2.3.0 - Shortener Admin Takeover

Exploit Title: POLR URL 2.3.0 - Shortener Admin Takeover Date: 2021-02-01 Exploit Author: p4kl0nc4t Vendor Homepage: - Software Link: https://github.com/cydrobolt/polr Version: 2.3.0 Tested on: Linux CVE : CVE-2021-21276 import json import requests payload = 'acctusername': 'admin', 'acctpassword...

CVE-2023-0328 WPCode < 2.0.7 - Contributor+ WPCode Library Auth Key Update/Deletion

The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication such as update and delete...

SUSE CVE-2014-9293

The configauth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack...

WPCode < 2.0.7 - Contributor+ WPCode Library Auth Key Update/Deletion

The plugin does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication such as update and delete the auth key. As a contributo...

Authentication flaw

NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameters...

CVE-2020-26102

In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM SEC-550...

PHPCMS v9.6.3 suffers from a file inclusion vulnerability

PHPCMS is a website management software. A file inclusion vulnerability exists in the latest version of phpcms V9.6.3 and below. The vulnerability arises from two main parts, one is the acquisition of authkey, which utilizes the insecurity of random numbers, and the other is based on the logical...

SQL Injection Vulnerability in phpcms 'random' Function

phpcms is a website management software. A SQL injection vulnerability exists in phpcms. Due to lax encryption control of the random function, the value of authkey can be obtained, leading to SQL injection and allowing attackers to exploit the vulnerability to obtain sensitive database informatio...

PHPCMS V9 Has Arbitrary File Read Vulnerability

PHPCMS V9 uses PHP5+MYSQL as the technical basis for development.V9 uses OOP Object Oriented Programming to build the basic operating framework. PHPCMS 9.6.1 version of the existence of arbitrary file reading vulnerability, an attacker can exploit the vulnerability to read any server file,...

kernel: net: slab corruption from use after free on INIT collisions

A use-after-free flaw was found in the way the Linux kernel's SCTP implementation handled authentication key reference counting during INIT collisions. A remote attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system...

kernel: net: slab corruption from use after free on INIT collisions

A use-after-free flaw was found in the way the Linux kernel's SCTP implementation handled authentication key reference counting during INIT collisions. A remote attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system...

Linux kernel sctp_setsockopt_auth_key() integer overflow

Integer overflow in the sctpsetsockoptauthkey function in net/sctp/socket.c in the Stream Control Transmission Protocol sctp implementation in the Linux kernel 2.6.24-rc1 through 2.6.26.3 allows remote attackers to cause a denial of service panic or possibly have unspecified other impact via a...

PT-2008-6908 · Opensuse +2 · Opensuse +4

Name of the Vulnerable Software and Affected Versions: linux-headers-2.6.24-etchnhalf.1-all-mips versions 2.6.24-etchnhalf.1 linux-headers-2.6.24-etchnhalf.1-r4k-ip22 versions 2.6.24-etchnhalf.1 linux-headers-2.6.24-etchnhalf.1-r5k-ip32 versions 2.6.24-etchnhalf.1...