CVE-2025-48814

Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an unauthorized attacker to bypass a security feature over a network...

CVE-2024-52965

A missing critical step in authentication vulnerability CWE-304 in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user...

CVE-2024-52965

A missing critical step in authentication vulnerability CWE-304 in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user...

CVE-2024-52965

A missing critical step in authentication vulnerability CWE-304 in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user...

CVE-2024-52965

CVE-2024-52965 describes a missing authentication step in Fortinet FortiOS and FortiProxy that lets an API-user login with an invalid certificate when using api-key + PKI cert authentication. Affected products and versions include FortiOS 7.0.0–7.0.15, 7.2.0–7.2.10, 7.4.0–7.4.5, 7.6.0–7.6.1 and F...

CVE-2025-42974

Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This could enable access to information normally restricted, resulting in low impact on confidentiality. There is no impact on integrity or availability...

CVE-2025-42963

The CVE-2025-42963 entry describes a critical issue in SAP NetWeaver Application Server for Java Log Viewer: authenticated administrators can exploit unsafe Java object deserialization to achieve full OS compromise, affecting confidentiality, integrity, and availability. The vulnerability is clas...

CVE-2025-42952 Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis

SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to add fields to arbitrary SAP database tables and/or structures, potentially rendering the system unusable. On successful exploitation, an attacker can render the system unusable by triggering short dumps on login. Thi...

PT-2025-28285 · Sap · Sap Netweaver Xml Data Archiving Service

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver XML Data Archiving Service affected versions not specified Description: The issue allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially...

Fortinet Fortigate PKI via API: Authentication granted with an invalid certificate (FG-IR-24-511)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-511 advisory. - A missing critical step in authentication vulnerability CWE-304 in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0...

GHSA-J5PR-VRJJ-9V4H Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function

The parisneo/lollms repository is affected by a timing attack vulnerability in the authenticateuser function within the lollmsauthentication.py file. This vulnerability allows attackers to enumerate valid usernames and guess passwords incrementally by analyzing response time differences. The...

CVE-2025-6386

The parisneo/lollms repository is affected by a timing attack vulnerability in the authenticateuser function within the lollmsauthentication.py file. This vulnerability allows attackers to enumerate valid usernames and guess passwords incrementally by analyzing response time differences. The...

CVE-2025-6386 Timing Attack Vulnerability in parisneo/lollms

The parisneo/lollms repository is affected by a timing attack vulnerability in the authenticateuser function within the lollmsauthentication.py file. This vulnerability allows attackers to enumerate valid usernames and guess passwords incrementally by analyzing response time differences. The...

CVE-2025-53167

Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-53167

Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-53167

Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-53167

Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-53167

CVE-2025-53167 affects Huawei HarmonyOS through an authentication vulnerability in the Distributed Collaboration Framework module. Huawei CNVD/CNNVD entries describe vulnerability in HarmonyOS versions 5.0.1 and 5.1.0, allowing potential service confidentiality compromise. Root cause is authentic...

CRM User Management Framework Unauthorized Access

The vulnerability of the CRM User Management Framework component in the Oracle Common Applications of the Oracle E-Business Suite relates to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

CVE-2025-6926

Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2...