CVE-2024-41793

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager All versions. The web interface of affected devices provides an endpoint that allows to enable the ssh service without authentication. This could allow an unauthenticated remote attacker to enable remote access to the device...

CVE-2025-3268

A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical. This vulnerability affects unknown code of the file http/httpconn.cpp. The manipulation of the argument murlreal leads to improper authentication. The attack can be initiated remotely. The exploit has...

HCL Launch和HCL DevOps Deploy 访问控制错误漏洞

HCL Launch and HCL DevOps Deploy are both products of HCL India.HCL Launch is a multi-functional, enterprise-grade continuous delivery automation software. Used to handle the most complex deployment processes in DevOps.HCL DevOps Deploy is an application. Can be mapped to your organizational...

Authentication Bypass

Mattermost is vulnerable to Authentication Bypass. The vulnerability is due to improper enforcement of multi-factor authentication MFA due to a flaw that allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes...

The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE arises from deficiencies in the authentication mechanism, allowing unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the SCF file processing mechanism in Windows operating systems allows attackers to exploit the NTLM hash.

The vulnerability of the SCF-file processing mechanism in Windows operating systems is related to the lack of authentication for the critical function. Exploiting this vulnerability allows a remote attacker to reveal the NTLM hash when a user opens a folder containing a specially crafted SCF-file...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to deficiencies in the authentication process, allows attackers to increase their privileges.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to increase their privileges...

Xiaomi Mi Connect Service APP 安全漏洞

Xiaomi Mi Connect Service APP is an application from China's Xiaomi Xiaomi that is used to enable connectivity and interaction between Xiaomi devices, which helps users to quickly connect and manage a variety of Xiaomi smart devices to enable data transfer and collaborative work between devices. ...

The vulnerability of the Tutor LMS plugin for the WordPress content management system lies in its authentication procedures’ flaws, which allow attackers to escalate their privileges.

The vulnerability of the Tutor LMS plugin for WordPress content management systems is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

B&R Industrial Automation B&R APROL 安全漏洞

B&R Industrial Automation B&R APROL is a process control system from B&R Industrial Automation, Austria. A security vulnerability in B&R Industrial Automation B&R APROL prior to version 4.4-00P5, which stems from a misimplementation of the authentication algorithm in session handling, could allow...

CVE-2025-0256

HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function...

Shearwater SecurEnvoy SecurAccess Enrol 安全漏洞

Shearwater SecurEnvoy SecurAccess Enrol is a zero-trust security solution from Shearwater SecurEnvoy. A security vulnerability exists in Shearwater SecurEnvoy SecurAccess Enrol versions prior to 9.4.515, which stems from authentication by only a six-digit TOTP code...

CVE-2025-30142

An issue was discovered on G-Net Dashcam BB GONX devices. Bypassing of Device Pairing can occur. It uses MAC address verification as the sole mechanism for recognizing paired devices, allowing attackers to bypass authentication. By capturing the MAC address of an already-paired device through ARP...

D-Link DIR-823G 安全漏洞

The D-Link DIR-823G is a wireless router from China's AUO D-Link. The D-Link DIR-823G suffers from an authorization issue vulnerability that stems from improper authorization and can be exploited by an attacker to cause access control to sensitive content...

CVE-2025-27138

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which may cause the risk of unauthorized access. The vulnerability has been fixed in v2.10.6. No known...

SUSE CVE-2025-27112

Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...

WordPress plugin WP JobHunt 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin WP JobHunt...

CVE-2025-27138

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which may cause the risk of unauthorized access. The vulnerability has been fixed in v2.10.6. No known...

CVE-2025-27138 DataEase has an improper authentication vulnerability

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which may cause the risk of unauthorized access. The vulnerability has been fixed in v2.10.6. No known...

CVE-2025-27138

DataEase (open source BI/dashboard) before version 2.10.6 contains an authentication flaw in the io.dataease.auth.filter.TokenFilter class that may allow unauthorized access. The issue is confirmed across multiple sources and is resolved in v2.10.6. The vulnerability description does not provide ...