Authentication Bypass

keylime is vulnerable to Authentication Bypass. The vulnerability is due to insufficient validation during agent registration, where a malicious actor can register a new agent with a different TPM while reusing an existing agent’s UUID, allowing the attacker to overwrite the legitimate agent...

CVE-2025-46287

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An attacker may be able to spoof their FaceTi...

CVE-2025-46287

An inconsistent user interface issue in Apple products was addressed through improved state management. This vulnerability could allow an attacker to spoof their FaceTime caller ID . The flaw affects multiple platforms, including iOS (18.7.3, 26.2), iPadOS (18.7.3, 26.2), macOS (Sonoma 14.8.3, Se...

NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)

Impact NeuVector supports login authentication through OpenID Connect. However, the TLS verification which verifies the remote server's authenticity and integrity for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle MITM attacks. Starting from...

EUVD-2024-55321

Authentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1...

CVE-2024-8273

Authentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1...

CVE-2024-8273

Authentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1...

CVE-2024-8273

CVE-2024-8273 : HYPR Server suffers an Authentication Bypass by Spoofing , allowing identity spoofing. The issue affects HYPR Server versions before 10.1 . Impact is high for confidentiality and availability per CVSS. A remediation mentioned in sources is to upgrade to version 10.1 or later (no a...

The Impact of Robotic Process Automation (RPA) on Identity and Access Management

As enterprises refine their strategies for handling Non-Human Identities NHIs, Robotic Process Automation RPA has become a powerful tool for streamlining operations and enhancing security. However, since RPA bots have varying levels of access to sensitive information, enterprises must be prepared...

Access Control System Vault Bound Principal IAM Bypass

The vulnerability of the boundprincipaliam component in the Access Control System Vault and the Corporate Information Archiving Platform Vault Enterprise involves exploiting authentication by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumven...

📄 Cisco ISE API 3.1 Command Injection

Proof of concept exploit for a command injection vulnerability in Cisco ISE API version 3.1. ============================================================================================================================================= | Title : Cisco ISE API 3.1 command injection Exploits | |...

CVE-2024-8273: Authentication Bypass by Spoofing

Authentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1...

HYPR Server security vulnerabilities

HYPR Server is a server from HYPR, Inc. A security vulnerability exists in HYPR Server versions prior to 10.1 that stems from an authentication bypass that could lead to identity spoofing...

PT-2025-50631

Name of the Vulnerable Software and Affected Versions HYPR Server versions prior to 10.1 Description A security issue exists in HYPR Server that allows for authentication bypass through identity spoofing. This flaw could potentially allow an attacker to impersonate legitimate users. Recommendatio...

Webinar: How Attackers Exploit Cloud Misconfigurations Across AWS, AI Models, and Kubernetes

Cloud security is changing. Attackers are no longer just breaking down the door; they are finding unlocked windows in your configurations, your identities, and your code. Standard security tools often miss these threats because they look like normal activity. To stop them, you need to see exactly...

Spiderman Phishing Kit Targets European Banks with Real-Time Credential Theft

Varonis threat analysts warn about Spiderman, a dangerous new kit that automates attacks against European banks and crypto customers, stealing a victim’s full identity profile...

EUVD-2025-201852

The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, violating secure authentication practices causing low impact on Confidentiality, Integrity and Availability of the...

EUVD-2025-201929

A vulnerability has been identified in COMOS V10.6 All versions, COMOS V10.6 All versions, NX V2412 All versions V2412.8700, NX V2506 All versions V2506.6000, Simcenter 3D All versions V2506.6000, Simcenter Femap All versions V2506.0002, Solid Edge SE2025 All versions V225.0 Update 10, Solid Edge...

CVE-2025-65797

Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service DoS...

PT-2025-49765

The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, violating secure authentication practices causing low impact on Confidentiality, Integrity and Availability of the...