CVE-2025-46826

insa-auth is an authentication server for INSA Rouen. A minor issue allowed third-party websites to access the server's secondary authentication bridge, potentially revealing basic student information name and number. However, the issue posed minimal risk, was never exploited, and had limited...

CVE-2025-3272

Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allow authenticated users to change their password without providing their old password. This issue affects Operations Bridge Manager: 24.2, 24.4...

CVE-2025-3759

CVE-2025-3759 affects WF2220. The documented vulnerability is that the endpoint /cgi-bin-igd/netcore_set.cgi, used to change device configuration, is accessible without authentication due to a missing access control check. Root cause: lack of authentication enforcement on configuration changes. R...

PT-2025-20382 · Telemessage · Telemessage Archiving Backend

Name of the Vulnerable Software and Affected Versions: TeleMessage archiving backend versions through 2025-05-05 Description: The issue concerns the acceptance of API calls from the TM SGNL aka Archive Signal app to request an authentication token, using hardcoded credentials. The credentials use...

PT-2025-20370 · Danfoss · Danfoss Ak-Sm 8Xxa Series

Name of the Vulnerable Software and Affected Versions: Danfoss AK-SM 8xxA Series versions prior to 4.2 Description: The issue is related to an improper authentication vulnerability in the Danfoss AKSM8xxA Series. This vulnerability affects the Danfoss AK-SM 8xxA Series prior to version 4.2...

CVE-2025-20973

Improper authentication in Secure Folder prior to version 1.8.12.0 in Android 13, and 1.9.21.00 in Android 14 allows physical attackers to reset the lock type of Secure Folder...

PT-2025-20291 · Opentext · Opentext Operations Bridge Manager

Name of the Vulnerable Software and Affected Versions: OpenText Operations Bridge Manager versions 2023.05, 23.4, 24.2, 24.4 Description: The issue is related to an Incorrect Authorization vulnerability that could allow privilege escalation by authenticated users. Recommendations: For versions...

PT-2025-19906 · Peprodev · Peprodev Ultimate Profile Solutions

Name of the Vulnerable Software and Affected Versions: PeproDev Ultimate Profile Solutions versions 1.9.1 through 7.5.2 Description: The issue is related to the lack of proper authentication in the handel ajax req function, specifically with the change user meta functionality. This allows attacke...

PT-2025-19971 · Huawei · Harmonyos

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns an improper implementation of authentication logic in the file system module. Successful exploitation of this issue may affect service confidentiality. Recommendations: At...

PT-2025-19970 · Unknown · Passport-Wsfed-Saml2

Name of the Vulnerable Software and Affected Versions: passport-wsfed-saml2 versions 3.0.5 through 4.6.3 Description: A vulnerability in passport-wsfed-saml2 allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done by adding...

CVE-2025-25016

CVE-2025-25016: Kibana suffers an Unrestricted File Upload weakness due to insufficient server-side validation, allowing an authenticated attacker to compromise software integrity by uploading a crafted file. Affected versions include Kibana 7.17.x before 7.17.19 and 8.0.x before 8.13.0. The issu...

CVE-2025-24206

An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may be able to bypass authentication polic...

CVE-2025-46627

The Tenda RX2 Pro (version 16.03.30.14 ) is vulnerable to a weak credentials flaw in its telnet service. An unauthenticated attacker can gain access by calculating the root password , which is derived from the last two digits or octets of the device's MAC address . This can lead to the disclosure...

PT-2025-18691 · Kunbus +1 · Kunbus Revolution Pi Os +1

Name of the Vulnerable Software and Affected Versions: KUNBUS Revolution Pi OS Bookworm 01/2025 Description: The issue arises because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server, where the...

CVE-2025-46557

XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16.10.0-rc-1, a user who can access pages located in the XWiki space by default, anyone can access the page XWiki.Authentication.Administrati...

CVE-2025-46557

Summary: CVE-2025-46557 affects XWiki platforms from multiple lines of release streams (15.3-rc-1 up to before 15.10.14; 16.0.0-rc-1 up to before 16.4.6; 16.5.0-rc-1 up to before 16.10.0-rc-1). A user who can view pages in the XWiki space can access XWiki.Authentication.Administration and, unless...

Any user with view access to the XWiki space can change the authenticator

Impact A user who can access pages located in the XWiki space by default, anyone can access the page XWiki.Authentication.Administration and unless an authenticator is set in xwiki.cfg switch to another installed authenticator. Note that, by default, there is only one authenticator available...

(Pwn2Own) Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass the firewall on the Iris modem in affected Tesla Model S vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firewall service. The issue results from a failure to obtain the...

CVE-2025-29906 Finit bundled getty can bypass /bin/login

Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the tty configuration directive that can bypass /bin/login, i.e., a user can log in as any user without authentication. This issue has been patched in version 4.1...

CVE-2025-29906 Finit bundled getty can bypass /bin/login

Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the tty configuration directive that can bypass /bin/login, i.e., a user can log in as any user without authentication. This issue has been patched in version 4.1...