Red Hat Keycloak 安全漏洞

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that stems from a token type not being properly enforced when verifying signatures locally...

CVE-2023-32074 Nextcloud user_oidc app is missing brute force protection

useroidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in useroidc app. It is recommended that the Nextcloud useroidc app is upgraded to 1.3.2...

PT-2023-17518

Name of the Vulnerable Software and Affected Versions Armoli Technology Cargo Tracking System versions before 3558f28 Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability, allowing authentication abuse and bypass. This vulnerability enables potenti...

CVE-2023-32347

Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user perspective for device claiming and from the device perspective for authentication. If an attacker obtained the serial number and MAC address of a device, th...

The authentication vulnerability of the 389 Directory Server server, which arises from information disclosure due to inconsistencies, allows attackers to gain access to confidential data.

The vulnerability of the 389 Directory Server’s authentication service relates to the disclosure of information during the verification of the existence of a record in the database. Exploiting this vulnerability allows an attacker, operating remotely, to gain access to confidential data...

CVE-2023-30509 Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface

Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulnerabilities result in the ability to read arbitrary files on the underlying operating system, including sensitive system files...

CVE-2023-23444

Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597 allows an unauthenticated remote attacker to...

GHSA-V9RM-7RV9-R3FW Apache OpenMeetings Improper Authentication vulnerability

An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0...

PT-2023-18630 · Tips Tricks Hq · Category Specific Rss Feed Subscription

Name of the Vulnerable Software and Affected Versions: Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin versions = v2.2 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin privileg...

CVE-2023-0768 Avirato hotels online booking engine <= 5.0.5 - Subscriber+ SQLi

The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks...

CVE-2023-30869

CVE-2023-30869 : Affected software is the WordPress plugin Easy Digital Downloads (EDD). The vulnerability is described as an Improper Authentication flaw that allows unauthenticated privilege escalation. The issue affects EDD versions 3.1 through 3.1.1.4.1. The underlying impact is that unauthen...

CVE-2023-1477

Improper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.This issue affects HYPR Keycloak Authenticator Extension: before 7.10.2, before 8.0.3...

CVE-2022-40482

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...

Laravel 安全漏洞

Laravel is a web application framework from the Laravel community. A security vulnerability exists in Laravel versions 8.x through 9.x through versions prior to 9.32.0, which stems from the authentication method being found vulnerable to attack...

CVE-2023-27524 Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset...

Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A security vulnerability exists in Apache Superset version 2.0.1 and prior versions. An attacker exploited the vulnerability to authenticate and access unauthorized resources...

CVE-2023-22913

A post-authentication command injection vulnerability in the “accountoperator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify device configuration data,...

Fortinet FortiPresence Authentication Error Vulnerability

Fortinet FortiPresence is a comprehensive data analytics solution from Fortinet, Inc. Fortinet FortiPresence suffers from an authentication error vulnerability that stems from a lack of authentication for critical functions, which can be exploited by an attacker to gain access to Redis and MongoD...

Authentication flaw

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3. Attackers could login without authorization. This is fixed in 0.13.4...

CVE-2023-23761 Improper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gists

An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by authenticating through an SSH certificate authority. To do so, a user had to know the secret gist's URL. This vulnerability affected all...