PYSEC-2024-57

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password...

Django Security Vulnerabilities

Django is a set of open source web application frameworks based on the Python language from the Django Foundation. The framework includes an object-oriented mapper, view system, template system, and more. A security vulnerability exists in Django version 5.0 up to and including version 5.0.7, and...

GO-2024-2744 Access control change may take longer than expected in github.com/authelia/authelia/v4

If the file authentication backend is being used, the ewatch option is set to true, the refresh interval is configured to a non-disabled value, and an administrator changes a user's groups, then that user may be able to access resources that their previous groups had access to...

CVE-2023-28623 Unauthorized user can register an account in specific configurations in Zulip

Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: ZulipLDAPAuthBackend and an external authentication backend any aside of ZulipLDAPAuthBackend and EmailAuthBackend are the only ones enabled in AUTHENTICATIONBACKENDS in /etc/zulip/settings.py...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809 <=0.24.5), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148 <=0.4.17-next.0) +9 more potentially affected by CVE-2021-43776 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448 <=0.4.10)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-2022122206, =0.0.0-nightly-2022122206, =0.0.0-nightly-2022122206, =5.0.0-alpha.1, =1.0.0, =0.2.0, =1.0.0, =1.2.0...

PT-2020-6602 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 1.10.11 Description: The issue is related to the Experimental API in Apache Airflow, which previously allowed all API requests without authentication by default. This poses security risks to users who are not...

CVE-2019-7319

CVE-2019-7319 affects Cloudera Hue 6.0.0–6.1.0. When using authentication backends LdapBackend, PamBackend, SpnegoDjangoBackend, RemoteUserDjangoBackend, SAML2Backend, OpenIDBackend, or OAuthBackend, external users can be created with superuser privileges. This indicates a potential privilege-esc...

VMware Harbor Privilege Escalation (VMSA-2019-0015) (CVE-2019-16097)

The remote VMware Harbor cloud native registry is affected by a remote privilege escalation vulnerability. Instances of VMware Harbor with DB as the authentication backend and which allow users to self-register are vulnerable. An authenticated, non-administrator, remote attacker can exploit this ...

CVE-2019-16097

core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix:...

CVE-2019-16097

Harbor up to version 1.8.2 is affected by CVE-2019-16097: core/api/user.go allows non-admin users to create admin accounts via POST /api/users when Harbor uses DB as the authentication backend and self-registration is enabled. Impact is privilege escalation to administrator as described in multip...

Authentication Bypass

django-allauth is vulnerable to authentication bypass attacks. The vulnerability exists as the checkpassword function used in the authentication backend failed to reject authentication to a user if isactive=False is set...

MGASA-2014-0327 Updated kdelibs4 packages fix security vulnerability and various bugs

This update fixes a security vulnerability in the polkit authentication backend of kdelibs CVE-2014-5033 mga13792, and fixes some additional issues: - duplicate targets in PythonMacros.cmake reviewboard kde 111371, - kded4 leak sockets in NetworkInterface::isWireless bko324954, - media type...