57 matches found
CVE-2026-44965
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...
EUVD-2026-54568
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...
EUVD-2026-54571
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...
CVE-2026-47363
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...
CVE-2026-44965
Datadog’s Android app is affected by CVE-2026-44965, involving six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity) that are exported with no permission g...
CVE-2026-64797 Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension
Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts...
CVE-2026-9103
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/autologin endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTOLOGIN configuration is enabl...
CVE-2026-12585
The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is...
CVE-2026-12585 Abandoned Cart Lite for WooCommerce < 6.8.2 - Unauthenticated Account Takeover via Malleable Recovery-Link Token
The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is...
CVE-2026-12585
The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is...
CVE-2009-4357
CQWeb aka the web interface in IBM Rational ClearQuest before 7.1.1 does not properly handle use of legacy URLs for automatic login, which might allow attackers to discover the passwords for user accounts via unspecified vectors...
CVE-1999-0549
Windows NT automatically logs in an administrator upon rebooting...
EUVD-2019-2161
Malware in sbrugna...
EUVD-2017-15403
Malware in sbrugna...
EUVD-2019-2162
Malware in sbrugna...
EUVD-2009-4325
Malware in sbrugna...
EUVD-2025-19867
Malicious code in bioql PyPI...
EUVD-2023-34238
Malicious code in bioql PyPI...
Unspecified Vulnerability in Endress+Hauser MEAC300-FNADE4 (CNVD-2025-16343)
The Endress+Hauser MEAC300-FNADE4 is a cost-effective emissions data management computer from Endress+Hauser Vietnam. A security vulnerability exists in the Endress+Hauser MEAC300-FNADE4 that originates from automatically logging in an EPC2 Windows user at startup without entering a password. An...