Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the file upload. An administrator can execute arbitrary JavaScript in the context of the application by uploading a crafted SVG or HTML file containing malicious scripts, which are then served to users without...

PT NGFW Firewall Authentication Bypass

The vulnerability of the PT NGFW firewall is related to the absence of authentication. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

DIRIS Digiware M-70 Modbus DoS

The vulnerability of the Modbus TCP and Modbus RTU protocols implemented by DIRIS Digiware M-70 communication gateways is related to the absence of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Modbus TCP DoS

The vulnerability of the Modbus TCP protocol implementation in DIRIS Digiware M-70 communication gateways is related to the absence of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Lynx+ Gateway Restart

The vulnerability of the web server of the microprogramming software for devices used in integrating and managing industrial automation systems, the Lynx+ Gateway, is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow an attacker to remotel...

Nagios XI SSH Web Terminal Code Execution

The vulnerability of the SSH web terminal component of the Nagios XI monitoring infrastructure is related to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and expose sensitive information...

SIMATIC CP SIPLUS Authentication Bypass

The vulnerability of the microprogramming software for SIMATIC CP and SIPLUS communication modules is related to the absence of authentication for critical functions. Exploiting this vulnerability can allow an attacker, operating remotely, to gain full access to configuration information...

EUVD-2023-27989

Malicious code in bioql PyPI...

ABAP SAP NetWeaver Authentication Bypass Privilege Escalation

The vulnerability of the software used for developing and executing applications in the ABAP language of SAP NetWeaver Application Server is related to the absence of an authentication process. Exploiting this vulnerability allows a malicious actor to increase their privileges remotely...

Flowise security vulnerabilities

Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in versions prior to Flowise 3.0.1 that stems from the lack of authentication and role-based access control in the default installation, which could lead to the execution of un-sandboxed ...

GitLab Authentication Bypass Task Status Modification

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to remotely modify the status of tasks in publicly accessible projects...

CVE-2024-12537

In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely...

CVE-2024-12537 Unauthenticated Denial of Service in open-webui/open-webui

In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely...

PT-2025-12138

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.32 Description The absence of authentication mechanisms in open-webui/open-webui allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request...

Oracle WebLogic Server Data Compromise

The vulnerability of the Oracle WebLogic Server application server’s Core component is related to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

Service Requests Oracle Customer Care Data Compromise

The vulnerability of the Service Requests component in the Oracle Customer Care software of the Oracle E-Business Suite lies in the lack of an authentication mechanism. Exploiting this vulnerability allows a malicious actor to manipulate the confidentiality and integrity of protected information...

Mattermost Auth Bypass Message Deletion

The vulnerability of the Mattermost instant messaging application is related to the absence of authentication procedures. Exploiting this vulnerability could allow a malicious actor to delete any message at will...

Microsoft Azure Stack HCI Privilege Escalation

The vulnerability of the hyper-converged infrastructure of the Microsoft Azure Stack HCI platform is related to the absence of authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges...

JetBrains YouTrack Auth Bypass

The vulnerability of the JetBrains YouTrack project and task management software is related to the absence of an authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

BIG-IP Shell Privilege Escalation

The vulnerability of the TMOS Shell configuration tool, which is used for managing monitors in the BIG-IP Access Policy Manager, as well as programs like BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP...