1741 matches found
CVE-2026-97874
When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to...
CVE-2026-97880
The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...
EUVD-2026-121156
When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to...
CVE-2026-97880
The embedded OpenEJB HTTP server in Apache TomEE is vulnerable to an authentication bypass affecting REST endpoints configured with HTTP Basic authentication . The root cause is that the server dispatches certain requests to these endpoints without verifying credentials. A remote unauthenticated ...
EUVD-2026-121261
The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...
CVE-2026-97880 Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authentication
The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...
Swego
Swego Swiss army knife Webserver in Golang. Keep simple like the python SimpleHTTPServer but with many features Usage Run the binary If you don't want to build it, binaries are availables on https://github.com/nodauf/Swego/releases Otherwise, build-essential should be installed and GOPATH...
evil-ssdp
Overview This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable phishing page. This page can load a...
CVE-2026-107241
The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default...
cansina
Cansina Cansina is a Web Content Discovery Application. It is well known Web applications don't publish all their resources or public links, so the only way to discover these resources is requesting for them and check the response. Cansina duty is to help you making requests and filtering and...
phishery
phishery Phishery is a Simple SSL Enabled HTTP server with the primary purpose of phishing credentials via Basic Authentication. Phishery also provides the ability easily to inject the URL into a .docx Word document. The power of phishery is best demonstrated by setting a Word document's template...
CVE-2026-107241
The Node.js web service on Versa VOS (formerly Versa FlexVNF) is vulnerable to unauthorized access due to the use of default credentials and HTTP Basic Authentication during initial Zero Touch Provisioning (ZTP) . An attacker with network access who possesses these credentials can authenticate to...
EUVD-2026-120627
The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default...
CVE-2026-107241
The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default...
PT-2026-141790
The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...
PT-2026-141236
The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default...
CVE-2026-97880: Apache Software Foundation Apache TomEE: The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication…
The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...
CVE-2026-107241: Versa VOS: The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the…
The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default...
MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...
TOTOLINK/Realtek Routers - CAPTCHA Bypass
On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...