3104 matches found
CVE-2025-27458 CVE-2025-27458
The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption. The challenge is sent from the server to the client, is encrypted by the client and sent back. The server does the same encryption locally and if the responses...
CVE-2025-27456 CVE-2025-27456
The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks...
CVE-2025-27449 CVE-2025-27449
The MEAC300-FNADE4 does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks...
CVE-2025-1710
CVE-2025-1710 affects the maxView Storage Manager. The root cause is insufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks. Public technical details in connected sources confirm the issue and describe the i...
BIT-ASPNET-CORE-2025-24070 ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network...
CVE-2025-34079 NSClient++ Authenticated Remote Code Execution via ExternalScripts API
An authenticated remote code execution vulnerability exists in NSClient++ version 0.5.2.35 when the web interface and ExternalScripts module are enabled. A remote attacker with the administrator password can authenticate to the web interface default port 8443, inject arbitrary commands as externa...
CVE-2025-34058
Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. After authenticating with these credentials, an attacker can exploit an arbitrary file read vulnerability in the /systemLog/downFile.php...
CVE-2025-41656 Pilz: Missing Authentication in Node-RED integration
An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the NodeRED server is not configured by default...
ROS-20250630-02
The vulnerability of HashiCorp Vault and Vault Enterprise enterprise data archiving platforms is related to the fact that the validprincipals and defaultuser fields of the SSH secrets mechanism configuration are not are not set. Exploitation of the vulnerability could allow an attacker acting...
CVE-2025-52997
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a...
CVE-2025-52997 File Browser Insecurely Handles Passwords
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a...
GHSA-CM2R-RG7R-P7GG File Browser vulnerable to insecure password handling
Summary All user accounts authenticate towards a File Browser instance with a password. A missing password policy and brute-force protection makes it impossible for administrators to properly secure the authentication process. Impact Attackers can mount a brute-force attack against the passwords ...
Dell OpenManage Network Integration 安全漏洞
Dell OpenManage Network Integration is a set of system management tools provided by Dell for integrating third-party management platforms such as PowerEdge servers, VMware vCenter, and others. An authentication vulnerability exists in Dell OpenManage Network Integration that originates from an...
CVE-2025-24292
A misconfigured query in UniFi Network v9.1.120 and earlier could allow users to authenticate to Enterprise WiFi or VPN Server l2tp and OpenVPN using a device’s MAC address from 802.1X or MAC Authentication, if both services are enabled and share the same RADIUS profile...
CVE-2025-24292
Summary: CVE-2025-24292 affects UniFi Network (v9.1.120 and earlier). A misconfigured query could allow a user to authenticate to Enterprise WiFi or VPN Server (L2TP/OpenVPN) using a device’s MAC address from 802.1X or MAC Authentication when both services are enabled and share the same RADIUS pr...
CVE-2025-5310 Dover Fueling Solutions ProGauge MagLink LX Consoles Missing Authentication for Critical Function
Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework TCF interface on a specific port. Files can be created, deleted, or modified, potentially leading to remote code execution...
CVE-2025-3699
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W all versions, G-50A all versions, GB-50 all versions, GB-50A all versions, GB-24A all versions, G-150AD all versions, AG-150A-A all versions, AG-150A-J all versions, GB-50AD all...
CVE-2025-49851
ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product...
CVE-2025-4383
Improper Restriction of Excessive Authentication Attempts vulnerability in Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti. Wi-Fi Cloud Hotspot allows Authentication Abuse, Authentication Bypass. This issue affects Wi-Fi Cloud Hotspot: before 30.05.2025...