GHSA-M5MF-3963-4X26 Authelia applies regulation separately to Username-based logins to Email-based logins

Summary If users are allowed to sign in via both username and email the regulation system treats these as separate login events. This leads to the regulation limitations being effectively doubled assuming an attacker using brute-force to find a user password. It's important to note that due to th...

Authelia applies regulation separately to Username-based logins to Email-based logins

Summary If users are allowed to sign in via both username and email the regulation system treats these as separate login events. This leads to the regulation limitations being effectively doubled assuming an attacker using brute-force to find a user password. It's important to note that due to th...

CVE-2022-39395

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default configurations for Vela allow exploitation and container breakouts. Users should upgrade to...

CVE-2024-9863

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for the 'defaultuserrole' option. This makes it possible for unauthenticated attackers to register an...

CVE-2023-37398

IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...

IBM Aspera Faspex 安全漏洞

IBM Aspera Faspex is an International Business Machines IBM solution for rapid global person-to-person file delivery and collaboration. A security vulnerability exists in IBM Aspera Faspex that stems from not requiring users to use strong passwords by default, which makes it easier for attackers ...

PT-2025-5649 · Go · Go

Name of the Vulnerable Software and Affected Versions: go affected versions not specified Description: The issue arises from the default values of Session.config.KeepAliveInterval and Session.config.ConnectionWriteTimeout, which can cause timed out writes that are not handled properly by readers...

HomeGallery 安全漏洞

HomeGallery is a self-hosted open source web gallery from HomeGallery Open Source. For browsing with tagged, mobile-friendly, and AI-driven image discovery. A security vulnerability exists in HomeGallery version 1.15.0 and earlier versions. An attacker could exploit this vulnerability to view...

PT-2024-17656

Name of the Vulnerable Software and Affected Versions: Open Design Alliance CDE inWEB SDK versions prior to 2025.3 Description: A vulnerability was discovered that allows exposure of sensitive information to an unauthorized actor. Installing CDE Server with default settings enables unauthorized...

VulnCheck KEV: CVE-2024-55956

Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the...

Versa Networks Versa Director insecure default PostgreSQL configuration

RISK EVALUATION Versa Networks Versa Director, by default, configures PostgreSQL to listen on all network interfaces using database credentials shared by multiple installations. From Advising Vulnerability In Versa Director: "This combination allows an unauthenticated attacker to access and...

SolarWinds Kiwi CatTools 安全漏洞

SolarWinds Kiwi CatTools is a network automation tool from the American company SolarWinds, Inc. It is used to manage configurations on network devices such as routers, switches, and firewalls. A security vulnerability exists in SolarWinds Kiwi CatTools version 3.12 and earlier, which stems from...

Microsoft Office NTLMv2 Disclosure

Exploit Title: Microsoft Office NTLMv2 Disclosure Vulnerability Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.office.com/ Software Link: https://www.office.com/ Details: https://github.com/passtheticket/CVE-2024-38200 Version: Microsoft Office 2019 MSO Build 1808...

PT-2024-30676 · Gotenna · Gotenna Pro Atak Plugin

Name of the Vulnerable Software and Affected Versions: goTenna Pro ATAK Plugin affected versions not specified Description: The goTenna Pro ATAK Plugin has a default setting to share Automatic Position, Location, and Information PLI updates every 60 seconds once the plugin is active and goTenna i...

Gematik Referenzvalidator 代码问题漏洞

Gematik Referenzvalidator is an open source tool from gematik. It is used for advanced validation of TI applications and Contoso resources for interoperability standards. A code issue exists in Gematik Referenzvalidator that stems from the use of insecure default settings in the Woodstox...

CVE-2024-44976 ata: pata_macio: Fix DMA table overflow

In the Linux kernel, the following vulnerability has been resolved: ata: patamacio: Fix DMA table overflow Kolbjørn and Jonáš reported that their 32-bit PowerMacs were crashing in pata-macio since commit 09fe2bfa6b83 "ata: patamacio: Fix maxsegmentsize with PAGESIZE == 64K". For example: kernel B...

Homepage 安全漏洞

Homepage is a highly customizable homepage with Docker and Service API integration from Homepage open source. A security vulnerability exists in Homepage version 0.9.1, which stems from a lack of authentication that makes the default settings vulnerable to DNS rebinding attacks, which could allow...

DEBIAN-CVE-2024-25581

When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer AXFR or IXFR over DNS over HTTPS, causing the process to stop...

[SECURITY] Fedora 40 Update: stalld-1.19.2-1.fc40

The stalld program monitors the set of system threads, looking for threads that are ready-to-run but have not been given processor time for some threshold period. When a starving thread is found, it is given a temporary boost using the SCHEDDEADLINE policy. The default is to allow 10 microseconds...

PT-2024-21912 · Intel · Intel Mas

Name of the Vulnerable Software and Affected Versions: IntelR MAS GUI affected versions not specified Description: The issue is related to incorrect default permissions in the software installer for IntelR MAS GUI, which may allow an authenticated user to potentially enable denial of service via...