Authentication flaw

An unauthorized attacker who has obtained an IBM Watson IoT Platform 1.0 security authentication token can use it to impersonate an authorized platform user. IBM X-Force ID: 261201...

Authentication flaw

Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost...

Authentication flaw

A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access...

Authentication flaw

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcodes due to a missing capability check on the gettexteditorcontent function in all versions up to, and including, 1.1.2. This makes it possible for authenticat...

Authentication flaw

Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM. This would require the attacker also be...

Authentication flaw

langchainexperimental aka LangChain Experimental in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the import, subclasses, builtins, globals, getattribute, bases, mro, or base attribute in Python code. These are not prohibited by...

PT-2024-18332 · Demososo · Demososo Dm Enterprise Website Building System

Name of the Vulnerable Software and Affected Versions: Demososo DM Enterprise Website Building System versions up to 2022.8 Description: A critical issue has been found, affecting the function dmlogin of the file indexDM load.php in the Cookie Handler component. The manipulation of the argument i...

Authentication flaw

wolfSSL prior to 5.6.6 did not check that messages in one DTLS record do not span key boundaries. As a result, it was possible to combine DTLS messages using different keys into one DTLS record. The most extreme edge case is that, in DTLS 1.3, it was possible that an unencrypted DTLS 1.3 record...

CVE-2023-31189

Improper authentication in some IntelR Server Product OpenBMC firmware before version egs-1.09 may allow an authenticated user to enable escalation of privilege via local access...

Authentication flaw

Improper authentication in some IntelR Server Product OpenBMC firmware before version egs-1.09 may allow an authenticated user to enable escalation of privilege via local access...

The vulnerability of the software interface of the XWiki Platform for creating collaborative web applications, related to authentication errors, allows a perpetrator to gain user privileges as XWiki.superadmin.

The vulnerability of the software interface of the XWiki Platform is related to authentication errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain the privileges of the XWiki.superadmin user...

Palo Alto Networks PAN-OS 安全漏洞

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks, USA. A security vulnerability exists in Palo Alto Networks PAN-OS that stems from incorrect authentication in the GlobalProtect gateway feature. An attacker could exploit the vulnerability to establish a VPN...

Authentication flaw

Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/index.php...

Authentication flaw

Authentication bypass when an OAuth2 Client is using clientsecretjwt as its authentication method on affected 11.3 versions via specially crafted requests...

Authentication flaw

Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files...

Authentication flaw

In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL...

Authentication flaw

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not expose...

Authentication flaw

Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 and later, FR Configurator2 all versions, GT Designer3 Version1GOT1000 all versions, GT Designer3 Version1GOT2000 all versions, GX Works2 versions 1.11M and later, GX Works3 all...

Wordpress plugin Cloudflare security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

The vulnerability of the save_management_settings() function in the InstaWP Connect plugin of the WordPress content management system allows a hacker to gain access to read, modify, or delete data.

The vulnerability of the savemanagementsettings function in the InstaWP Connect plugin of the WordPress content management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain read, edit, or delete access to data...