74812 matches found
CVE-2025-41711
CVE-2025-41711 describes an unauthenticated remote disclosure risk where an attacker can use firmware images to extract password hashes and brute-force plaintext passwords of accounts with limited access. The connected sources (RH Red Hat, EUVD/ENISA, NVD, CVE listing, and related enrichments) co...
CVE-2025-41711 Use of a Broken or Risky Cryptographic Algorithm for firmware images of power analyzer
An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access...
PT-2026-24431
Name of the Vulnerable Software and Affected Versions Tenda i24V3.0si version 3.0.0.5 Description The firmware contains a hardcoded password, allowing attackers to log in as root. The hardcoded password is located in the '/etc ro/shadow' file. Recommendations Update to a newer version that...
Parse Server 安全漏洞
Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that runs Node.js. There were security vulnerabilities in versions of Parse Server prior to 8.6.14 and 9.5.2-alpha.1. These vulnerabilities stemmed from insufficient type checking of t...
CVE-2025-70802
Tenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etcro/shadow, which allows attackers to log in as root...
CVE-2025-69614
Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account takeover. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-27, fixed 2025-10-31...
CVE-2025-70802
CVE-2025-70802 affects Tenda G1V3.1si firmware version V16.01.7.8. The vulnerability is a hardcoded password present in /etc_ro/shadow, enabling an attacker to log in as root. Multiple connected sources (NVD, Red Hat, ENISA EUVD, CVE record) corroborate the same description and firmware detail. E...
CVE-2025-69614
CVE-2025-69614 affects Deutsche Telekom AG Telekom Account Management Portal (versions prior to 2025-10-27). Root cause: Incorrect Access Control via activation token reuse on the password-reset endpoint, enabling unauthorized password resets and potential full account takeover. Impact is rated C...
Janitza UMG 96RM-E 24V和Janitza UMG 96RM-E 230V 加密问题漏洞
Both the Janitza UMG 96RM-E 24V and Janitza UMG 96RM-E 230V are multi-functional power quality analyzers from the German company Janitza. There are encryption vulnerabilities in these devices, as attackers can use firmware images to extract password hashes and brute-force their way into plaintext...
PT-2026-24432
Name of the Vulnerable Software and Affected Versions Tenda G1V3.1si version V16.01.7.8 Description The firmware contains a hardcoded password, located in the '/etc ro/shadow' file, that allows attackers to gain root access. The vulnerable file is '/etc ro/shadow'. Recommendations Update to a new...
PT-2026-24411
Name of the Vulnerable Software and Affected Versions Aruba AOS-CX affected versions not specified Description A critical authentication bypass flaw exists in Aruba AOS-CX switches. This flaw allows an unauthenticated remote attacker to reset administrator passwords through the web management...
Deutsche Telekom Account Management Portal 安全漏洞
The Deutsche Telekom Account Management Portal is an online portal system used by Deutsche Telekom in Germany for managing user accounts and configuring services. Versions of the Deutsche Telekom Account Management Portal prior to October 2025 contained security vulnerabilities. These...
CVE-2025-69614
Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account takeover. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-27, fixed 2025-10-31...
EulerOS 2.0 SP13 : util-linux (EulerOS-SA-2026-1300)
According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the...
Fortinet FortiManager MFA Bypass in GUI (FG-IR-26-090)
The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-090 advisory. - An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3,...
PT-2026-24239
🚨 CVE-2026-22572 An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.2 through 7.2.11, FortiManager 7.6.0 through 7.6.3, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.2...
Devolutions Remote Desktop Manager < 2025.3.32 / 2026.1 < 2026.1.6 Sensitive Information Exposure (DEVO-2026-0005)
The version of Devolutions Remote Desktop Manager installed on the remote host is prior to 2025.3.32 or 2026.1 prior to 2026.1.6. It is, therefore, affected by a sensitive information exposure vulnerability: - Improper enforcement of the Disable password saving in vaults setting in the connection...
PT-2026-24256
Name of the Vulnerable Software and Affected Versions Deutsche Telekom AG Telekom Account Management Portal versions prior to 2025-10-27 Description An incorrect access control issue exists due to activation token reuse on the password-reset endpoint. This allows unauthorized password resets and...
