35 matches found
CVE-2026-73444: Incorrect Implementation of Authentication Algorithm
On affected platforms running Arista EOS with VRRPv2 IP Authentication Header IP-AH authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the...
PT-2026-84597
Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication...
CVE-2024-35585
Oxford Nanopore MinKNOW , a sequencing software used in nanopore-based genomic analysis, is vulnerable to weak authentication in versions before 24.06 . The application relies on a client's source IP address as its authentication mechanism, meaning an attacker who can spoof or originate traffic f...
CVE-2024-35585
Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication...
EUVD-2024-55746
Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication...
CVE-2025-26866 Apache HugeGraph-Server: RAFT and deserialization vulnerability
A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...
CVE-2025-26866
Apache HugeGraph-Server is vulnerable to remote code execution (RCE) due to insecure Hessian deserialization within the PD store . An attacker can exploit this by using a malicious Raft node to perform object injection attacks . To remediate this vulnerability, users are recommended to upgrade to...
EUVD-2008-0578
Malware in sbrugna...
EUVD-2022-4573
Malicious code in bioql PyPI...
EUVD-2022-53198
Malicious code in bioql PyPI...
Security Bulletin: Apache ZooKeeper Admin Server IPAuthenticationProvider Vulnerability: Authentication Bypass via Spoofed X-Forwarded-For Header
Summary When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider,...
The vulnerability of the IPAuthenticationProvider component of the centralized service for managing configuration information, naming, distributed synchronization, and providing group services via Apache ZooKeeper allows a attacker to bypass the authentication process.
The vulnerability of the IPAuthenticationProvider component of the centralized service for managing configuration information, naming, distributed synchronization, and providing group services via Apache ZooKeeper is related to the ability to bypass authentication through phising techniques...
Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...
DEBIAN-CVE-2024-51504
When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...
UBUNTU-CVE-2024-51504
When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...
Apache 2.4.x < 2.4.54 Authentication Bypass
The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by an authentication bypass vulnerability as referenced in the 2.4.54 advisory. - X-Forwarded-For dropped by hop-by-hop mechanism in modproxy: Apache HTTP Server 2.4.53 and earlier may not send...
BIT-APACHE-2022-31813 mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application...
CLSA-2023-1695752598 httpd: Fix of 4 CVEs
CVE-2022-23943: Fix out-of-bound write in modsed - CVE-2022-22721: Fix integer overflow which resulted in out-of-bounds write - CVE-2022-28615: Fix read beyond bounds in apstrcmpmatch - CVE-2022-31813: Fix possible bypass of IP based authentication...
Security Bulletin: IBM Aspera Orchestrator affected by vulnerability ( CVE-2022-31813)
Summary The following vulnerability has been addressed in IBM Aspera Orchestrator 4.0.1. Vulnerability Details CVEID:CVE-2022-31813 DESCRIPTION: Apache HTTP Server could allow a remote attacker to bypass security restrictions, caused by the failure to send the X-Forwarded- headers to the origin...
TOTOLINK LR350 缓冲区错误漏洞
TOTOLINK LR350 is a 4G LTE router from China's Gion Electronics TOTOLINK that supports converting 4G signals to wired signals for home and office scenarios. A buffer overflow vulnerability exists in the TOTOLINK LR350. The vulnerability stems from a buffer overflow after authentication via the...