9998 matches found
CVE-2025-9151 LiuYuYang01 ThriveX-Blog web updateJsonValueByName improper authorization
A security flaw has been discovered in LiuYuYang01 ThriveX-Blog up to 3.1.7. Affected by this vulnerability is the function updateJsonValueByName of the file /webconfig/json/name/web. Performing manipulation results in improper authorization. It is possible to initiate the attack remotely. The...
CVE-2025-51506
In the smartLibrary component of the HRForecast Suite 0.4.3, a SQL injection vulnerability was discovered in the valueKey parameter. This flaw enables any authenticated user to execute arbitrary SQL queries, via crafted payloads to valueKey to the api/smartlibrary/v2/en/dictionaries/options/looku...
Trend Micro Apex One Multiple Vulnerabilities (KA-0020652)
According to its self-reported version, the Trend Micro application running on the remote Windows host is Apex One prior to SP1 Server Build 14081 and Agent Build 14081. It is, therefore, affected by multiple vulnerabilities, including the following: - A vulnerability in Trend Micro Apex One...
Low: nginx
Issue Overview: NGINX Open Source and NGINX Plus have a vulnerability in the ngxmailsmtpmodule that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server...
Linux Distros Unpatched Vulnerability : CVE-2017-10155
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Pluggable Auth. Supported versions that are affected are 5.6.37 and earlier an...
CVE-2025-54336: Incorrect Comparison
In Plesk Obsidian 18.0.70, isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 such as the 0e0 string. This occurs in admin/plib/LoginManager.php...
CVE-2025-33100
IBM Concert Software 1.0.0 through 1.1.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...
Linux Distros Unpatched Vulnerability : CVE-2021-41303
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to...
CVE-2025-8361 Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093
Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing. This issue affects Config Pages: from 0.0.0 before 2.18.0...
Linux Distros Unpatched Vulnerability : CVE-2025-38089
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVCGARBAGE during svc auth processing as auth error tianshuo han reported a...
UBUNTU-CVE-2025-53859
NGINX Open Source and NGINX Plus have a vulnerability in the ngxmailsmtpmodule that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happe...
PT-2025-33435 · Mtons · Mtons Mblog
Name of the Vulnerable Software and Affected Versions: mtons mblog versions prior to 3.5.1 Description: A vulnerability was found in mtons mblog up to version 3.5.0. This issue affects some unknown processing of the file /settings/password. The manipulation leads to improper restriction of...
Linux Distros Unpatched Vulnerability : CVE-2023-0122
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmetsetupauth, allows an attacker to perform a Pre-Auth Denial of Service D...
Malicious code in changelog-auth-norma-loopback (npm)
The package changelog-auth-norma-loopback was found to contain malicious code...
Malicious code in epic-auth (npm)
The package epic-auth was found to contain malicious code...
Malicious code in planmill-auth (npm)
The package planmill-auth was found to contain malicious code...
Malicious code in kaus-auth-hermes-parcel (npm)
The package kaus-auth-hermes-parcel was found to contain malicious code...
Malicious code in prompts-auth-oauth-markdown-pdf (npm)
The package prompts-auth-oauth-markdown-pdf was found to contain malicious code...