4667 matches found
CVE-2026-111257
With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any...
CVE-2026-111261
The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade...
EUVD-2026-121255
The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user...
CVE-2026-111257
Apache TomEE contains a vulnerability where it silently creates an administrative user with well-known credentials at startup if the default configuration is used and no users are defined in the default user database (CWE-1392). A remote attacker can exploit these credentials to authenticate to w...
EUVD-2026-121224
With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any...
CVE-2026-111257 Apache TomEE: Well-known administrative credentials created at startup
With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any...
CVE-2026-111257: Apache Software Foundation Apache TomEE: With the default configuration and no users defined in the default user database, TomEE silently adds an administrative…
With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any...
PT-2026-141735
With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any...
EUVD-2026-113897
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint POST /api/guest/staff/login that allows remote attackers to force authentication because checkGuestClientAuthentication only allowlists clientlogin and clientcreate, leaving stafflogin...
PT-2026-133515
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint POST /api/guest/staff/login that allows remote attackers to force authentication because checkGuestClientAuthentication only allowlists client login and client create, leaving staff logi...
CVE-2026-112374: FOSSBilling: FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST…
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint POST /api/guest/staff/login that allows remote attackers to force authentication because checkGuestClientAuthentication only allowlists clientlogin and clientcreate, leaving stafflogin...
CVE-2026-90867
Improper access control in the Web Admin console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts...
CVE-2026-90867
Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4 is susceptible to an Improper Access Control vulnerability (CWE-284) within the Web Admin console . This flaw could allow remote actors to access administrative functionality via remote authentication attempts . Th...
CVE-2026-90867 Improper Access Control of Web Admin Console in Progress WS_FTP Server
Improper access control in the Web Admin console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts...
EUVD-2026-113024
Improper access control in the Web Admin console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts...
CVE-2026-90867: Progress Software WS_FTP Server: Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and…
Improper access control in the Web Admin console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts...
Progress Software WS_FTP Server permission and access control issue vulnerability
Versions prior to Progress Software WSFTP Server 2024.0.7 and 2025.0.4 contain a permission and access control vulnerability. This issue stems from improper access controls within the Web Admin console, potentially exposing administrative functions to remote authentication attempts...
PT-2026-132335
Improper access control in the Web Admin console of Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts...
EUVD-2026-98078
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests...
CVE-2026-16823 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication...