ipmitest

ipmitest Shell-Skript zum Testen der IPMI Cipher Type Zero Authentifizierungsumgehungsschwachstelle CVE-2013-4784 IPMI ist eine standardisierte Computersystemschnittstelle, die von Systemadministratoren für das Out-of-Band-Management von Computersystemen und die Überwachung ihres Betriebs verwend...

Vmware-ESXI

CVE-2024-37085 upload di shell non autenticato fino a diventare amministratore completo su hypervisor esxi appartenenti a un dominio. Scarica ESXIVORTEX Dettagli: un bypass dell'autenticazione che porta all'upload di una shell nel contesto di vpxuser, consentendo di ottenere pieni permessi...

CVE-2024-9106

CVE-2024-9106 Wechat Social login = 1.3.0 - Bypass dell'autenticazione Descrizione: Il plugin Wechat Social login per WordPress è vulnerabile al bypass dell'autenticazione nelle versioni fino alla 1.3.0 inclusa. Ciò è dovuto a una verifica insufficiente dell'utente fornito durante il login social...

PT-2026-81257

Name of the Vulnerable Software and Affected Versions LACT versions prior to 0.10.1 Description An authentication bypass exists in LACT on Linux due to the way Polkit authentication is handled based on UnixProcessSubject and Peer PID. This allows an attacker to circumvent the required...

PT-2026-81884

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.30 through 7.0.109...

PT-2026-81202

Name of the Vulnerable Software and Affected Versions ash authentication versions 3.10.5 through 4.14.1 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.12 Description Improper authentication allows purpose-limited JSON Web Tokens JWTs to be replayed as full bearer API credentials when a...

PT-2026-81888

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109...

PT-2026-81296

Name of the Vulnerable Software and Affected Versions miniOrange SAML SSO versions prior to 11.0.2 SAML SP Single Sign On – Login with ADFS versions prior to 6.4 SAML SP Single Sign On – SAML SSO login with Google Apps versions prior to 6.4 Description An authentication bypass exists due to the m...

PT-2026-81909

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...

PT-2026-81863

Name of the Vulnerable Software and Affected Versions Punk::Plugin::TOTP versions prior to 0.05 Description The software incorrectly validates recovery codes during the two-factor authentication challenge. The totp use recovery function searches the recovery model for a submitted code's digest...

DEBIAN-CVE-2026-77337

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses...

CVE-2026-77337

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses...

CVE-2026-77337 CakePHP: Potential Authentication bypass with CookieAuthenticator

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses...

CVE-2026-77337 CakePHP: Potential Authentication bypass with CookieAuthenticator

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses...

CVE-2026-77337

CakePHP Authentication (a plugin for CakePHP and PSR-7 based applications) is affected by a critical vulnerability (CVSS 4.0: 9.1 ) in the CookieAuthenticator component. When legacy tokens are used, they are unencrypted and forgeable , enabling authentication bypass and potential CPU or memory ex...

CVE-2026-77337

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses...

CVE-2026-77567

CVE-2026-77567 affects Filament , a full-stack component library for Laravel development. Prior to versions 4.12.0 and 5.7.0 , incorrect challenge-form required-field handling allows app-based multi-factor authentication (MFA) to be bypassed when recovery codes are enabled. Email-based MFA is not...

CVE-2025-34077

CVE-2025-34077 Dirottamento di sessione admin non autenticato - Plugin Pie Register ≤ 3.7.1.4 📌 Descrizione Questo exploit sfrutta una vulnerabilità nel plugin Pie Register per WordPress versioni ≤ 3.7.1.4, consentendo il dirottamento di sessione non autenticato di account admin. 🛡️ Questo...

CVE-2026-78553

RansomLook stored its Flask session-signing key in a secret_key file with default file permissions (e.g., 0644 under a common 022 umask) rather than explicitly restricting access. Any local user able to read the RansomLook home directory could obtain this cryptographic secret, which is used to si...

CVE-2026-78553 Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...