CVE-2024-45033

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged...

CVE-2024-12437

The CVE-2024-12437 entry affects the Marketplace Items WordPress plugin and is a stored XSS via the plugin’s envato shortcode in versions ≤ 1.5.5, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or higher, enabling inj...

GHSA-V6JV-P6R8-J78W NiceGUI On Air authentication issue

Summary Once a user logins to one browser, all other browsers are logged in without entering password. Even incognito mode. Impact high...

CVE-2025-21618 NiceGUI On Air authentication issue

NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1...

Top Open Source API Security Tools

The modern world relies on Application Programming Interfaces APIs. They allow applications to communicate with each other, servers, and consumers to facilitate data sharing and simplify application development. Without them, the internet would be unrecognizable. However, APIs also present a...

CVE-2024-12371 Rockwell Automation PowerMonitor™ 1000 Remote Code Execution

A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and...

CVE-2024-12259

CVE-2024-12259 affects the CRM WordPress Plugin – RepairBuddy (all versions up to 3.8120). Root cause: missing authorization/identity validation when updating a user’s email via the wc_update_user_data AJAX action, enabling authenticated attackers with subscriber+ to change any user email (includ...

[SECURITY] [DLA 3993-1] pgpool2 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3993-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA December 12, 2024 https://wiki.debian.org/LTS -...

USN-7108-2 python-asyncssh vulnerabilities

USN-7108-1 fixed vulnerabilities in AysncSSH. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the extension info message. An attacker able to intercept...

CVE-2024-11015

The Sign In With Google plugin for WordPress is vulnerable to an authentication bypass in all versions up to and including 1.8.0 . The root cause is that the authenticate_user function fails to implement sufficient null value checks when processing the access token and user information. This flaw...

CVE-2024-45493

An issue exists in MSA FieldServer Gateway versions 5.0.0 through 6.5.2 (fixed in 7.0.0 ) that allows an attacker to bypass local login restrictions. While internal user accounts are intended to be restricted to local device access only, the bypass may allow an attacker to authenticate with these...

OAuth Client & OpenID Connect SSO | OAuth/OIDC Login - Critical - Cross Site Scripting - SA-CONTRIB-2024-067

This module enables you to authenticate users through an Identity Provider IdP or OAuth Server, allowing them to log in to your Drupal site. The module does not sufficiently escape query parameters sent to the callback URL when displaying error messages, particularly if the code parameter is...

CVE-2024-49804

CVE-2024-49804 affects IBM Security Verify Access Appliance versions 10.0.0–10.0.8. The vulnerability allows a locally authenticated non-administrative user to escalate privileges due to unnecessary permissions used to perform certain tasks. Affected product/version details are corroborated by mu...

Exploit for Missing Authentication for Critical Function in Alibaba Nacos

Introduction The Nacos Derby command execution vulnerability...

PT-2024-27285 · Ibm · Ibm Concert

Name of the Vulnerable Software and Affected Versions: IBM Concert Software versions 1.0.0 through 1.0.2.1 Description: The issue allows an authenticated user to obtain sensitive information that could aid in further attacks against the system. Recommendations: For versions 1.0.0 through 1.0.2.1,...

USN-7108-1 python-asyncssh vulnerabilities

Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the extension info message. An attacker able to intercept communications could possibly use this issue to downgrade the algorithm used for client authentication. CVE-2023-46445 Fabian Bäumer, Marcus...

CVE-2024-48966

The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedde...

CVE-2024-48966

The CVE-2024-48966 case affects Baxter Life2000 ventilator software tools used for testing and calibration, where the test/calibration tools do not require authentication. The root cause is lack of user authentication on these tools, enabling an attacker with access to the Service PC to obtain di...

CVE-2024-48966 Life2000 service tools for test and calibration do not support user authentication

The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedde...

CVE-2024-48966 Life2000 service tools for test and calibration do not support user authentication

The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedde...