18976 matches found
ECOVACS robot lawnmowers 安全漏洞
ECOVACS robot lawnmowers is a series of lawnmowers from the Chinese company ECOVACS. A security vulnerability exists in ECOVACS robot lawnmowers that originates from storing the anti-theft PIN in plaintext in the device file system. An attacker could steal the lawnmower, read the PIN, and reset t...
WordPress TH Variation Swatches plugin 1.0.8-1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset vulnerability
Cross-Site Request Forgery to Plugin Settings Reset vulnerability discovered by luckybuddy in WordPress Plugin TH Variation Swatches versions 1.0.8-1.3.2...
CVE-2025-0651
Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'Reset all settings" option the WARP service will...
GHSA-M3HP-8546-5QMR Duplicate Advisory: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2p82-5wwr-43cw. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without...
Duplicate Advisory: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2p82-5wwr-43cw. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without...
CVE-2025-0604
CVE-2025-0604 is a Keycloak authentication bypass vulnerability where, after an AD password reset, Keycloak updates credentials without performing an LDAP bind to validate them against AD. This can allow access for accounts that are expired or disabled, bypassing AD restrictions. Public details i...
CVE-2025-0604 Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD...
CVE-2025-0604 Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD...
Keycloak 授权问题漏洞
Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak suffers from an authorization issue vulnerability that stems from a failure to validate a new password during a password reset, which allows an expired or disabled AD user to bypass restrictions...
PT-2025-3979
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw was found in Keycloak that allows users to bypass Active Directory restrictions when resetting their password. The system updates the password without performing an LDAP bind to...
CVE-2024-49736
In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-49736
In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2023-37025
A Null pointer dereference vulnerability in the Mobile Management Entity MME in Magma = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allows network-adjacent attackers to crash the MME via an S1AP Reset packet missing an expected ResetType field...
CVE-2024-49736
In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-49736
In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-49736
Google Android is affected by a denial-of-service vulnerability caused by a logic error in the MainClear.java file. An attacker can exploit this flaw to trigger a factory reset without explicit user consent and without requiring additional execution privileges. Exploitation does not require user ...
CVE-2024-6466
NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified...
CVE-2024-6466
NEC Corporation's WebSAM DeploymentManager (versions v6.0 through v6.80 ) is vulnerable to a clickjacking attack because the X-FRAME-OPTIONS header is not specified. This allows a network-based attacker to reset configurations or restart products . To mitigate this risk, users are advised to rest...