CVE-2024-55225: Incorrect Default Permissions

An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request...

CVE-2024-55225

An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request...

PT-2024-17898 · Quanta Computer · Qoca Aim

Name of the Vulnerable Software and Affected Versions: Quanta Computer's QOCA aim affected versions not specified Description: The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key issue. By controlling the user ID parameter, remote attackers with regular...

CVE-2024-52591

Misskey is an open source, federated social media platform. In affected versions missing validation in "ApRequestService.signedGet" and "HttpRequestService.getActivityJson" allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different...

CVE-2024-50381

A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices. The attacker only needs to provide the MAC address of the targeted device and can make a request to unclaim it from its original connection and make a reque...

CVE-2024-50381: Missing Authentication for Critical Function

A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices. The attacker only needs to provide the MAC address of the targeted device and can make a request to unclaim it from its original connection and make a reque...

keycloak-core: mTLS passthrough

A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication...

CVE-2022-20793: Missing Cryptographic Step

A vulnerability in pairing process of Cisco TelePresence CE Software and RoomOS Software for Cisco Touch 10 Devices could allow an unauthenticated, remote attacker to impersonate a legitimate device and pair with an affected device. This vulnerability is due to insufficient identity verification...

CVE-2024-10943

The CVE-2024-10943 entry relates to Rockwell Automation FactoryTalk Updater and describes an authentication bypass caused by shared secrets across accounts, potentially enabling a threat actor to impersonate a user when authentication information can be enumerated. Connected documents confirm the...

CVE-2024-10943 FactoryTalk® Updater Authentication Bypass

An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and could allow a threat actor to impersonate a user if the threat actor is able to enumerate additional information required during authentication...

CVE-2024-10943 FactoryTalk® Updater Authentication Bypass

An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and could allow a threat actor to impersonate a user if the threat actor is able to enumerate additional information required during authentication...

CVE-2024-49394

CVE-2024-49394 affects mutt and neomutt: the In-Reply-To header is not cryptographically signed, enabling an attacker to impersonate the sender by reusing an unencrypted but signed email. Public references in the connected documents show multiple advisories addressing this issue and releasing fix...

CVE-2024-49394 Mutt: neomutt: in-reply-to email header field it not protected by cryptograpic signing

In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender...

CVE-2024-10943: Insecure Storage of Sensitive Information

An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and could allow a threat actor to impersonate a user if the threat actor is able to enumerate additional information required during authentication...

PT-2024-8933

Name of the Vulnerable Software and Affected Versions: Snap One OVRC cloud affected versions not specified Description: A vulnerability exists in the Snap One OVRC cloud, allowing an attacker to impersonate a Hub device and send requests to claim and unclaim devices. The attacker only needs to...

Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability

Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user...

CVE-2024-8458

The CVE-2024-8458 entry concerns PLANET Technology switch models whose web interface is vulnerable to Cross-Site Request Forgery (CSRF). Affected component: the web application on certain PLANET switch devices. Root cause: CSRF in the web front end allows an unauthenticated remote attacker to tri...

CVE-2024-20350

CVE-2024-20350 affects Cisco Catalyst Center (formerly Cisco DNA Center). The issue is due to a static SSH host key in the SSH server, enabling unauthenticated, remote attackers to perform MITM on SSH connections and impersonate the appliance, potentially intercepting traffic, injecting terminal ...

Rockwell FactoryTalk Batch View < 3.00 Authentication Bypass

The version of Rockwell FactoryTalk Batch View installed on the remote Windows host is prior to 3.00. It is, therefore, affected by a vulnerability. - An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and could...

CVE-2024-38315 IBM Aspera Shares session fixation

IBM Aspera Shares 1.0 through 1.10.0 PL3 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system...