3177 matches found
Growatt Cloud Applications 安全漏洞
Growatt Cloud Applications is a monitoring platform from Growatt, a Chinese company. A security vulnerability exists in Growatt Cloud Applications version 3.6.0 and earlier, which originates from an unauthenticated attacker who can delete the rooms of any user by knowing the user and room ID...
CVE-2024-49825
IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...
BIT-GITLAB-2025-25292 Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
ruby-saml provides security assertion markup language SAML single sign-on SSO for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely...
CVE-2025-3556 ScriptAndTools eCommerce-website-in-PHP login.php excessive authentication
A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be...
Adobe ColdFusion Improper Authentication Vulnerability
Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion suffers from an improper authentication vulnerability that could be exploited by an...
PT-2025-16209 · Unknown · Scriptandtools Ecommerce-Website-In-Php
Name of the Vulnerable Software and Affected Versions: ScriptAndTools eCommerce-website-in-PHP version 3.0 Description: A problematic vulnerability exists due to improper restriction of excessive authentication attempts. This issue affects an unknown functionality within the /admin/login.php file...
Siemens License Server Privilege Escalation
The vulnerability of the Siemens License Server SLS software management tool is related to errors in the certificate authenticity verification process. Exploiting this vulnerability can allow attackers to increase their privileges...
OESA-2025-1414 cobbler security update
Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors,...
CVE-2025-27934
Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may obtain the product authentication information...
CVE-2025-27740
Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network...
CVE-2025-30015
Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker with high privileges could execute certain forms of SQL queries leading to manipulation of content in the output variable. This vulnerability has a low impact...
CVE-2025-3102 SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation
The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secretkey' value in the 'autheticateuser' function in all versions up to, and including, 1.0.78. Th...
CVE-2025-30647 Junos OS: MX Series: Subscriber login/logout activity will lead to a memory leak
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine PFE of Juniper Networks Junos OS on MX Series allows an unauthenticated adjacent attacker to cause a Denial-of-Service DoS. In a subscriber management scenario, login/logout activity triggers a memo...
GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user can also...
CVE-2025-27934
Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may obtain the product authentication information...
CVE-2025-29870
Affected product: Wi-Fi AP UNIT AC-WPS-11ac series from Inaba Denki Sangyo. CVE-2025-29870 describes a Missing authentication for critical function vulnerability that could allow a remote unauthenticated attacker to obtain the device configuration information, including authentication details. Th...
CVE-2025-27934
Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may obtain the product authentication information...
ColdFusion Authentication Bypass RCE
The vulnerability of the ColdFusion software platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to execute arbitrary code...
(Pwn2Own) Synology BeeStation BST150-4T Improper Authentication Vulnerability
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Synology BeeStation BST150-4T devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the syncd authentication handler. The issue results from...