The vulnerability of the JetBrains YouTrack project management and task management software, related to deficiencies in the authentication mechanism, allows attackers to escalate their privileges and execute arbitrary commands.

The vulnerability of the JetBrains YouTrack project management and task management software is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to gain elevated privileges and execute arbitrary commands...

The vulnerability of the Ceph storage system, related to deficiencies in authentication procedures, allows attackers to gain access to confidential data and compromise its integrity.

The vulnerability of the Ceph storage system is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to confidential data and compromise its integrity...

GHSA-58VJ-CV5W-V4V6 Navidrome has Multiple SQL Injections and ORM Leak

Security Advisory: Multiple Vulnerabilities in Navidrome Summary Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like password=... in the URL ORM Leak. Furthermore, the names of the parameters are not properly...

The vulnerability of the Forklift Controller component of the Red Hat Migration Toolkit for Virtualization allows a attacker to exploit the protected information.

The vulnerability of the Forklift Controller component in the Red Hat Migration Toolkit for Virtualization stems from deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to compromise protected information...

PT-2024-6257 · Microsoft · Windows +2

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified DHCP Server Service affected versions not specified Remote Desktop Licensing Service affected versions not specified Description: The issue is related to a denial-of-service vulnerability that can be...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from deficiencies in the authentication process, which allows unauthorized users to gain unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2024-8158 User impersonation for lib9p based 9p fileservers

A bug in the 9p authentication implementation within lib9p allows an attacker with an existing valid user within the configured auth server to impersonate any other valid filesystem user. This is due to lib9p not properly verifying that the uname given in the Tauth and Tattach 9p messages matches...

CVE-2022-33162

IBM Security Directory Integrator 7.2.0 and Security Verify Directory Integrator 10.0.0 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources, at the privilege level of a standard unprivileged user. IBM X-Force I...

The vulnerability of the CI/CD system’s continuous integration and delivery capabilities in JetBrains TeamCity, related to deficiencies in the authentication process due to time differences, allows attackers to compromise the confidentiality of the protected information.

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of JetBrains TeamCity is related to deficiencies in the authentication process due to time differences when comparing tokens. Exploiting this vulnerability could allow a malicious actor to compromise...

The vulnerability of the Access Token Handler component in the software integration control panel for IBM App Connect Enterprise allows a malicious actor to obtain confidential calendar information using an access token with an expired validity period.

The vulnerability of the Access Token Handler component in the software integration control panel for IBM App Connect Enterprise is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to obtain confidential calendar information using ...

Crooks Bypassed Google’s Email Verification to Create Workspace Accounts, Access 3rd-Party Services

Google says it recently fixed an authentication weakness that allowed crooks to circumvent the email verification required to create a Google Workspace account, and leverage that to impersonate a domain holder at third-party services that allow logins through Googles "Sign in with Google" feature...

The vulnerability of the “SMART/WEB Service Management” software suite, related to deficiencies in the authentication process, allows a perpetrator to gain access to protected information without going through the authentication process.

The vulnerability of the “SMART/WEB Service Management” software suite is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to gain access to protected information without going through the authentication process...

PT-2024-4762 · Microsoft · Windows Remote Desktop Licensing Service +1

Name of the Vulnerable Software and Affected Versions: Windows Remote Desktop Licensing Service affected versions not specified Description: The issue is related to weaknesses in the authentication procedure of the Windows Remote Desktop Licensing Service. It allows a remote attacker to cause a...

The vulnerability of the student lifecycle management system in higher education institutions, SAP Student Life Cycle Management (SLcM), is related to deficiencies in the authentication process, which allow unauthorized users to elevate their privileges.

The vulnerability of the student lifecycle management system in higher education institutions, SAP Student Life Cycle Management SLcM, is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

Elektraweb Trust Management Issues Vulnerability

Elektraweb is a cloud-hosted web-based hotel program from Elektraweb, Turkey. A trust management issue vulnerability exists in Elektraweb versions prior to v17.0.68, which stems from a security issue where the system suffers from improper access control, lack of authorization, incorrect...

The vulnerability of the SFTP software module for processing and transmitting confidential data in Progress MOVEit Transfer allows a perpetrator to enhance their privileges.

The vulnerability of the SFTP software module for processing and transmitting confidential data in Progress MOVEit Transfer is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers, operating remotely, to increase their privileges...

The vulnerability of the Acrobat Mobile Sign software in handling electronic signatures and document management is related to deficiencies in the authentication process. This allows unauthorized users to circumvent existing security restrictions and gain unauthorized access to protected information.

The vulnerability of the Acrobat Mobile Sign software for working with electronic signatures and document management is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions and gain unauthorized acces...

CVE-2024-36789

An issue in Netgear WNR614 JNR1010V2/N300-V1.1.0.541.0.1 allows attackers to create passwords that do not conform to defined security standards...

PT-2024-4146 · NetGear · Netgear Wnr614

Name of the Vulnerable Software and Affected Versions: Netgear WNR614 version 1.1.0.54 1.0.1 Description: The issue is related to weaknesses in the authentication procedure of the Netgear WNR614 N300 Wi-Fi router. This allows attackers to bypass authentication and access the administrative...

The vulnerability of the postx_presets_callback() function in the PostX plugin of the WordPres content management system allows a hacker to escalate their privileges and gain access to read, modify, or delete data.

The vulnerability of the postxpresetscallback function in the PostX plugin of the WordPress content management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to increase their privileges and gain access to read, modify,...