PT-2024-23225 · Typo3 · Openid Connect Authentication Extension For Typo3

Name of the Vulnerable Software and Affected Versions: OpenID Connect Authentication extension for TYPO3 affected versions not specified Description: The issue concerns a security bypass in the authentication service of the OpenID Connect Authentication extension for TYPO3. The authentication...

The vulnerability of the application layer in real-time content management system SQL Directus, related to the use of incorrect alias names, allows attackers to bypass the password protection for arbitrary users.

The vulnerability of the application layer in real-time database content management system SQL Directus is related to the use of names with incorrect references. Exploiting this vulnerability could allow an attacker to reset the password of an arbitrary user remotely...

Medium: grub2

Issue Overview: The "/boot/efi/EFI/fedora/grub.cfg" configuration file allows an unprivileged user with physical access to a computer to bypass the GRUB password protection feature on many but not all UEFI-based systems. CVE-2023-4001 Affected Packages: grub2 Issue Correction: Run dnf update grub...

The vulnerability of the LDAP authentication implementation in the software platform based on git for collaborative code development on GitLab allows a hacker to bypass the password of an arbitrary user and gain access to the system.

The vulnerability of the LDAP authentication implementation in the software platform based on git for collaborative code development on GitLab is related to the possibility of password reset due to insufficient access control. Exploiting this vulnerability could allow a malicious actor to reset t...

The vulnerability of cloud-based software for creating and using Nextcloud Server’s data storage solution lies in the lack of authentication attempt limits, allowing attackers to bypass passwords.

The vulnerability of cloud-based software for creating and using Nextcloud Server storage solutions is related to the absence of restrictions on authentication attempts. Exploiting this vulnerability can allow a malicious actor to bypass any password restrictions...

SUSE CVE-2023-49791

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to one-time password bypass (CVE-2023-43045)

Summary IBM Sterling Partner Engagement Manager has addressed a reflected one-time password bypass vulnerability. Vulnerability Details CVEID: CVE-2023-43045 DESCRIPTION: IBM Sterling Partner Engagement Manager could allow a remote user to perform unauthorized actions due to improper...

The vulnerability of the application software interface of the JumpServer system for auditing security operations and maintenance allows a perpetrator to bypass passwords.

The vulnerability of the application software interface of the JumpServer security audit system for operation and maintenance involves insufficient protection of operational data during the loading of external libraries. Exploiting this vulnerability allows a malicious actor to remotely reset...

OpenText Visual COBOL License Issue Vulnerability

OpenText Visual COBOL is an integrated development environment IDE from OpenText Corporation designed to support the development and maintenance of the COBOL programming language. A security vulnerability exists in OpenText Visual COBOL and COBOL Server that stems from the fact that when user...

The vulnerability of the Intel PROSet/Wireless WiFi and Killer WiFi networking tools, related to bypassing authentication by using a password, allows attackers to gain increased privileges.

The vulnerability of the Intel PROSet/Wireless WiFi and Killer WiFi networking tools relates to bypassing authentication by using a password. Exploiting this vulnerability can allow attackers to gain increased privileges...

Design/Logic Flaw

SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impa...

CVE-2023-36624

Loxone Miniserver Go Gen.2 through 14.0.3.28 allows an authenticated operating system user to escalate privileges via the Sudo configuration. This allows the elevated execution of binaries without a password requirement...

The vulnerability of the microprogramming software for FS S3900-24T4S devices, due to deficiencies in access control, allows attackers to escalate their privileges and bypass the administrator password.

The vulnerability of the microprogramming software for FS S3900-24T4S switches is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges and bypass the administrator password...

Devolutions Workspace 安全漏洞

Devolutions Workspace is a mobile and desktop application from Devolutions Canada. A security vulnerability exists in Devolutions Workspace Desktop version 2023.1.1.3 and prior versions. An attacker could exploit the vulnerability to unlock Hub Workspace without being prompted to enter a password...

Design/Logic Flaw

An Improper Link Resolution Before File Access vulnerability in console port access of Juniper Networks Junos OS on NFX Series allows an attacker to bypass console access controls. When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the...

The vulnerability of the admin.html page of the P5E GNSS satellite receiver’s microprogramming software allows a hacker to bypass the administrator password.

The vulnerability of the admin.html page of the P5E GNSS satellite receiver’s microprogrammed software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to remotely compromise the administrator’s password...

Schneider Electric v1.0 - Directory traversal & Broken Authentication Vulnerability

Exploit Title: Schneider Electric v1.0 - Directory traversal & Broken Authentication Google Dork: inurl:/scada-vis Exploit Author: parsa rezaie khiabanloo Vendor Homepage: https://www.se.com/ Version: all-versions Tested on: Windows/Linux/Android Attacker can using these dorks and access to the...

Nextcloud 安全漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud iOS versions prior to 4.7.0, which stems from the ability to bypass the app password of an iOS app...

DEBIAN-CVE-2023-0567

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid...

VMware Workspace ONE Content 访问控制错误漏洞

VMware Vmware Workspace One is a platform from VMware that supports cross-device applications for rapid delivery and management of applications. The platform, which includes VMware Horizon and VMware Horizon Cloud, integrates access control, application management, and multi-platform endpoint...