CVE-2025-27803

The eCharge Hardy Barth cPH2 and cPP2 charging stations (version 2.2.0 ) are vulnerable to a lack of authentication on their web interface and MQTT server . An attacker with network access can immediately gain administrative access , enabling them to perform arbitrary administrative actions, reco...

CVE-2025-27803 Missing Authentication in eCharge Hardy Barth cPH2 / cPP2 charging stations

The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actions and reconfigure the devices or potentially gain access ...

CVE-2025-27803: Missing Authentication for Critical Function

The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actions and reconfigure the devices or potentially gain access ...

CVE-2025-36535: Missing Authentication for Critical Function

The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational disruption, or arbitrary code execution depending on the environment and exposed functionality...

CVE-2025-48391: Missing Authentication for Critical Function

In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API...

CVE-2025-47850: Missing Authentication for Critical Function

In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning...

Local Privilege Escalation

github.com/redhatinsights/yggdrasil is vulnerable to local privilege escalation. The vulnerability is due to missing authentication and authorization checks on a DBus method that dispatches messages to worker processes, allowing any local user to trigger privileged package management actions...

📄 HP Sure Access Enterprise / Sure Click Enterprise Missing Authentication

SEC Consult conducted penetration tests on Sure Access in 2022 and on Sure Click in 2023 and established a contact with HP afterwards. After several rounds of emails and meetings with the product development team, the scope and limitations of Sure Access and Sure Click were made clear. This...

Missing Authentication for Critical Function

Overview org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to improperly locating method security annotations on private...

CVE-2025-0132

A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM. The attacker must have network access to the Broker VM to exploit this issue...

Multiple vulnerabilities in I-O DATA network attached hard disk 'HDL-T Series'

Overview Network attached hard disk 'HDL-T Series' provided by I-O DATA DEVICE, INC. contains multiple vulnerabilities. OS command injection CWE-78 Affected when 'Remote Link3 function' is enabled CVE-2025-32002 Missing authentication for critical function CWE-306 CVE-2025-32738 Chuya Hayakawa an...

CVE-2025-32738

Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a remote unauthenticated attacker may change the product settings...

CVE-2025-32738

Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a remote unauthenticated attacker may change the product settings...

CVE-2025-32738

Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a remote unauthenticated attacker may change the product settings...

CVE-2025-32738

CVE-2025-32738 affects I-O DATA HDL-T Series network-attached HDDs with firmware versions 1.21 and earlier. The flaw is a missing authentication for a critical function, enabling a remote unauthenticated attacker to change product settings. Public sources (JVNDB/Red Hat/US CVE feeds) confirm the ...

CVE-2025-32738: Missing Authentication for Critical Function

Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a remote unauthenticated attacker may change the product settings...

CVE-2025-0132

A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM. The attacker must have network access to the Broker VM to exploit this issue...

CVE-2025-0132 Cortex XDR Broker VM: Unauthenticated User Can Disable Internal Services

A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM. The attacker must have network access to the Broker VM to exploit this issue...

CVE-2025-0132

CVE-2025-0132 affects Palo Alto Networks Cortex XDR Broker VM, exposing a missing authentication flaw that allows an unauthenticated attacker with network access to disable certain internal services on the Broker VM. The CVE is documented with a CVSS 4.0 base vector (AV:N/AC:L/PR:N/UI:N/SI:N/VI:L...

Cortex XDR Broker VM: Unauthenticated User Can Disable Internal Services

A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM. The attacker must have network access to the Broker VM to exploit this issue. Work around: No known workarounds or mitigations...