The vulnerability of the Microsoft Dataverse data management platform, related to deficiencies in authentication procedures, allows attackers to escalate their privileges.

The vulnerability of the Microsoft Dataverse data management platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow attackers to increase their privileges remotely...

Pandora FMS 路径遍历漏洞

Pandora FMS is a monitoring system from Pandora FMS, USA. The system monitors networks, servers, virtual infrastructures, applications, etc. through visualization. A security vulnerability exists in Pandora FMS versions 700 through prior to 777.3 that stems from a post-authentication arbitrary fi...

PT-2024-15991

Name of the Vulnerable Software and Affected Versions PAM affected versions not specified Description A vulnerability was found in PAM, where secret information is stored in memory. An attacker can trigger the victim program to execute by sending characters to its standard input stdin, allowing...

PT-2024-39760 · Quay · Quay

Name of the Vulnerable Software and Affected Versions: Quay affected versions not specified Description: A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affects the authentication mechanism, reducing the overa...

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.

...

The vulnerability of the Netlogon service in Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the Netlogon service in Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

PT-2024-6937 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.6 through 17.2.9 GitLab CE/EE versions 17.3 through 17.3.5 GitLab CE/EE versions 17.4 through 17.4.2 Description: The issue is related to authentication errors in GitLab, allowing a remote attacker to trigger pipeline...

The vulnerability of the implementation of the Global Search technology in the software platform based on git for collaborative code development on GitLab allows a perpetrator to disclose protected information.

The vulnerability of the Git-based software platform’s implementation of the Global Search technology for collaborative code development on GitLab is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose...

The vulnerability of the PAM authentication mechanism for Authd in Ubuntu operating systems allows a hacker to gain access to another user’s account.

The vulnerability of the PAM authentication mechanism for Authd in Ubuntu operating systems is related to errors in privilege management. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to another user’s account by executing commands like “su”, “sudo”...

CVE-2024-7558

JUJUCONTEXTID is a predictable authentication secret. On a Juju machine non-Kubernetes or Juju charm container on Kubernetes, an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJUCONTEXTID value. This gives the unprivileged user access to t...

TeamViewer Missing Authentication Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of TeamViewer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the TeamViewer service,...

SUSE CVE-2024-9014

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data...

The vulnerability of the “volumes” plugin in the Ceph Manager storage system allows a attacker to gain access to confidential data and compromise its integrity.

The vulnerability of the “volumes” plugin in the Ceph Manager storage system is related to incorrect authentication. Exploiting this vulnerability allows an attacker who operates remotely to gain access to confidential data and compromise its integrity...

The vulnerability of the Authentication component of the Windows operating system, which allows a perpetrator to disclose protected information

The vulnerability of the Authentication component in the Windows operating system is related to the use of an uninitialized resource. Exploiting this vulnerability could allow a attacker to disclose sensitive information that is protected by security measures...

PT-2024-8661 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: The issue is related to a flaw in the authentication procedure when handling "magic hash" passwords. This flaw can allow a remote attacker to bypass the authentication process due to a loose...

CVE-2024-8480 Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sirvsavepreventedsizes' function in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with...

PT-2024-31689 · Unknown · Symphony Xts Mobile Trading +1

Name of the Vulnerable Software and Affected Versions: Symphony XTS Web Trading and Mobile Trading platforms version 2.0.0.1 P160 Description: This issue exists due to improper access controls on APIs in the Authentication module. An authenticated remote attacker could exploit this by manipulatin...

The vulnerability of Google Chrome’s Skia graphics library allows a hacker to escape from the isolated software environment.

The vulnerability of Google Chrome’s Skia graphics library is related to the improper implementation of the authentication algorithm. Exploiting this vulnerability allows a malicious actor to escape from a isolated software environment using a specially created HTML page...

CVE-2024-8158

A bug in the 9p authentication implementation within lib9p allows an attacker with an existing valid user within the configured auth server to impersonate any other valid filesystem user. This is due to lib9p not properly verifying that the uname given in the Tauth and Tattach 9p messages matches...

The vulnerability of the Ivanti Virtual Traffic Manager (vTM)’s traffic management and load balancing functionality lies in its flawed authentication algorithm implementation, which allows attackers to circumvent existing security restrictions.

The vulnerability of the Ivanti Virtual Traffic Manager vTM in terms of traffic management and load balancing is related to the improper implementation of the authentication algorithm. Exploiting this vulnerability can allow a malicious actor to circumvent existing security restrictions remotely...