CVE-2025-34034

CVE-2025-34034 relates to a hardcoded credential vulnerability in the Blue Angel Software Suite on embedded Linux devices. The affected software contains multiple default/hardcoded user accounts not disclosed publicly, allowing unauthenticated or low-privilege attackers to gain administrative acc...

PT-2025-26688

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.3 Description Gogs, an open-source self-hosted Git service, contains a flaw where unprivileged user accounts can execute arbitrary commands on the Gogs instance. This is due to an insufficient patch for a previous...

PT-2025-26710 · Mb Connect Line +1 · Mbconnect24 +2

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A low-privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user's password. Recommendations: At the moment,...

The vulnerability of the software for managing and controlling access to corporate resources and IBM Security Verify Governance applications, which stems from weak password requirements, allows attackers to gain unauthorized access to user account information.

The vulnerability of the software for managing and controlling access to corporate resources and applications of IBM Security Verify Governance is related to weak password requirements. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to user accounts...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from the lack of protective measures for website structures, allowing attackers to gain access to user accounts.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to a user’s account...

CVE-2025-47713

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can reset the password of user-accounts of Admin role type. This operation is not appropriately restricted and allows the attacker to assume...

CVE-2025-49197 Deprecated TLS version supported

The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user account...

CVE-2025-4973

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an accoun...

CVE-2025-47849 Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and...

PT-2025-25171 · Apache · Apache Cloudstack

Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions 4.10.0.0 through 4.20.0.0 Description: A privilege escalation issue exists where a malicious Domain Admin user in the ROOT domain can obtain the API key and secret key of user-accounts of Admin role type in the same...

GHSA-WW28-4M4V-CQ4J BackendAI Missing Authentication for Critical Function

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled...

CVE-2025-29877 File Station 5

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2024-22330 IBM Security Verify Governance information disclosure

IBM Security Verify Governance 10.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...

CVE-2024-22330

CVE-2024-22330 affects IBM Security Verify Governance ISVG 10.0.2 where default password policy does not require strong passwords, exposing accounts to compromise. Public metrics indicate a high-impact CVSS 3.1 base score (9.8) with network attack vector and no user interaction. IBM remediation r...

The vulnerability of the SimpleOne ITSM automation system, related to deficiencies in authentication procedures, allows a perpetrator to gain access to user accounts.

The vulnerability of the SimpleOne ITSM automation system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to user accounts...

CVE-2024-34399

UNSUPPORTED WHEN ASSIGNED An issue was discovered in BMC Remedy Mid Tier 7.6.04. An unauthenticated remote attacker is able to access any user account without using any password. NOTE: This vulnerability only affects products that are no longer supported by the maintainer and the impacted version...

CVE-2024-23192

RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accounts. Attackers could perform malicious API requests or extract information from the users account...

CVE-2024-25118

TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the editing forms of the TYPO3 backend user interface. This allowed attackers to crack the plaintext password using brute force techniques. Exploiting this...

CVE-2024-21984

StorageGRID formerly StorageGRID Webscale versions prior to 11.8 are susceptible to a difficult to exploit Reflected Cross-Site Scripting XSS vulnerability. Successful exploit requires the attacker to know specific information about the target instance and trick a privileged user into clicking a...

CVE-2024-51561

This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting and manipulating the responses exchanged during the second factor authentication process...