Vulnerability of the Server component: The Pluggable Auth feature of the Oracle MySQL Server database management system, which allows attackers to cause service interruptions.

The vulnerability of the Oracle MySQL Server component, related to the Pluggable Auth feature of the Oracle Database Management System, involves improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause service interruptions using the MySQL protocol...

CVE-2024-45887

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to doOpenVPN...

CVE-2024-45891

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to deletewlanprofile...

GO-2024-3228 Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

Coder vulnerable to post-auth URL redirection to untrusted site 'Open Redirect' in github.com/coder/coder...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the parentField parameter in the index method of backend/controller/auth/Auth.php file. An attacker can manipulate SQL queries and access or modify data in the database. Remediation There is no fixed version for...

SQL injection in funadmin

funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php...

CVE-2024-48230

funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php...

Apache HugeGraph Server 1.0.x < 1.3.0 (CVE-2024-27348)

The version of Apache HugeGraph Server installed on the remote host is prior to 1.3.0. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27348 advisory. - RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server:...

CVE-2024-21165

...

Malicious code in auth-oauth-device (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9511 Malicious code in auth-oauth-device (npm)

--- -= Per source details. Do not edit below this line.=-...

PT-2024-14501 · Unknown · Freescout End-User Portal

Name of the Vulnerable Software and Affected Versions: FreeScout End-User Portal module versions prior to 1.0.65 Description: The issue allows an attacker to authenticate as an arbitrary user because a session token can be sent to the "/auth" endpoint. Recommendations: For versions prior to 1.0.6...

CentOS 6 : chromium-browser (RHSA-2020:3377)

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3377 advisory. - Heap buffer overflow in background fetch in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via ...

CVE-2024-47556

Pre-Auth RCE via Path Traversal...

CVE-2024-47557

CVE-2024-47557 affects Xerox FreeFlow Core. The root cause is a path traversal flaw that enables pre-auth remote code execution . PT-2024-32656 corroborates a pre-auth RCE via path traversal but provides no specific affected versions or fix information. Exploitation details are not provided in th...

CVE-2024-47557 Pre-Auth RCE via Path Traversal

Pre-Auth RCE via Path Traversal...

CVE-2024-47556 Pre-Auth RCE via Path Traversal

Pre-Auth RCE via Path Traversal...

CVE-2024-47556

CVE-2024-47556 relates to Xerox FreeFlow Core and is described as a Pre-Auth RCE via Path Traversal. The provided documents indicate: affected product is Xerox FreeFlow Core (vague on specific versions) and the underlying issue is a path traversal condition enabling pre-auth remote code execution...

CVE-2024-47556 Pre-Auth RCE via Path Traversal

Pre-Auth RCE via Path Traversal...

Timing Attack

basic-auth-connect is vulnerable to Timing Attack. The vulnerability is due to improper implementation of the equality comparison, where the comparison function reveals differences in the time taken to process incorrect versus correct input, allowing an attacker to infer sensitive information bas...