kentico-xperience13-AuthBypass-wt-2025-0006

WT-2025-0006 CVE 아직 할당되지 않음 Kentico Xperience 13 CMS - 스테이징 서비스 인증 우회 확인 실행 화면 python3 watchTowr-vs-kentico-xperience13-AuthBypass-wt-2025-0006.py -H http://labcms / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | | / // || \ ||| | \ / // || / / /...

extloader

extLoader 압축 해제된 Chromium 확장 프로그램을 관리하고 배포하기 위한 작은 툴킷입니다. 다음 블로그 게시물에서 자세한 내용을 확인하세요: https://www.synacktiv.com/en/publications/the-phantom-extension-backdooring-chrome-through-uncharted-pathways 설치 직접 설치 pipx pipx install . extloader --help Python 3.10+를 대상으로 한 격리된 설치를 위해 pipx를 사용하세요. 개발 환경 설정 u...

enumpossible

enumpossible Checks a list of SSH servers for password-based auth availability and for the existence of SSH user enumeration vulnerability CVE-2018-15473 in those identified. Uses a slightly modified version of https://www.exploit-db.com/exploits/45939 by @LeapSecurity to check for CVE-2018-15473...

CVE-2023-50564

CVE-2023-50564 使用方法 まず、リバースシェル用のリスナーを設定します。 端末1 nc -nlvp リバースシェルを返送するpluckモジュールのインストールを試みるスクリプトを実行します。 端末2 go run exploit.go -url -password -i -p...

CVE-2026-94053 Apache MINA SSHD: LDAP injection in sshd-ldap

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...

CVE-2026-94053

The Apache MINA SSHD Java library is vulnerable to an authentication bypass via LDAP injection within the optional sshd-ldap component. The root cause is a lack of proper escaping for LDAP filter metacharacters, which allows an attacker to successfully authenticate using the username "" and passw...

CVE-2026-79763

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

EUVD-2026-86120

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

CVE-2026-79680: Authentication Bypass Using an Alternate Path or Channel

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared...

CVE-2026-81181: Session Fixation

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor...

CVE-2026-19641 On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...

CVE-2026-19641

CVE-2026-19641 affects Arista EOS devices where password-based login authentication is enabled (e.g., SSH password or Telnet). Due to CWE-116 (Improper Encoding or Escaping) , a specially crafted password can create orphan authentication sessions that accumulate in a limited session pool, eventua...

CVE-2026-19641 On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...

CVE-2026-19641: Improper Encoding or Escaping of Output

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...

Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then any password will successfully match during authentication, instead of being inactive. This flaw allows an attacker to successfully authenticate as a user whose password h...

Security Advisory 0152

Security Advisory 0152 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-19641 CVSSv3.1 Base Score: 5.3...

CVE-2026-76940

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

CVE-2026-76940

CVE-2026-76940 affects the Ebyte NE2-D11 device, which does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This lack of control allows an attacker to perform automated password-based authentication attacks against deployments relying on such aut...

CVE-2026-76940 Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

GO-2026-6169 WITHDRAWN: Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". When a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile...