PT-2023-19794 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 13.3.1 Description: The issue arises from insufficient validation of the redirect URL during miauth authentication, allowing arbitrary JavaScript execution when a user allows the link. This can be exploited when user...

CVE-2022-32570

Improper authentication in the IntelR Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-33946

Improper authentication in the IntelR SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2023-13326 · Intel · Intel Sur

Name of the Vulnerable Software and Affected Versions: IntelR SUR software versions prior to 2.4.8902 Description: The issue is related to improper authentication, which may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For versions...

PT-2023-13079 · Intel · Intel Quartus Prime Pro +1

Name of the Vulnerable Software and Affected Versions: IntelR Quartus Prime Pro and Standard edition software affected versions not specified Description: The issue is related to improper authentication, which may allow an authenticated user to potentially enable escalation of privilege via local...

CVE-2023-0102 CVE-2023-0102

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary files...

JSA10379 - Security Vulnerability in Pulse Connect Secue (PCS) RADIUS authentication mechanism

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. If RADIUSis being used as the authentication mechanism on PCS running an affected release of the OS, then in a specific scenario, an unauthenticated user may be able to get past the...

SA40207 - [Pulse Secure] File content disclosure issue (CVE-2016-4787)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. An issue was discovered with the Pulse Connect Secure device that could allow an attacker to print out contents from files from a limited and specific directory on the device. When...

PT-2023-16470 · WordPress · Wicked Folders

Name of the Vulnerable Software and Affected Versions: Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description: The issue is related to a missing capability check on the ajax add folder function, allowing authenticated attackers with subscriber-level permissions and...

CVE-2022-24895 Symfony vulnerable to Session Fixation of CSRF tokens

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enable...

CVE-2023-24830 Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3...

The vulnerability of the implementation of the LDAP authentication process mechanism in the Zoho ManageEngine ServiceDesk Plus system allows a perpetrator to escalate their privileges.

The vulnerability of the LDAP authentication process implementation in Zoho ManageEngine ServiceDesk Plus is related to deficiencies in the authentication procedures. Exploiting this vulnerability can allow attackers to increase their privileges remotely...

CVE-2022-3820

An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a...

PT-2023-1149 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10611 Zoho ManageEngine ServiceDesk Plus versions 13.x prior to 13004 Description: The issue is related to the implementation of the authentication mechanism via the LDAP protocol in th...

PT-2023-1708 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS for Java version 7.50 Description: The issue is related to missing authentication checks in SAP NetWeaver AS for Java, allowing an unauthenticated attacker to attach to an open interface and utilize an open naming and directo...

CVE-2023-22278

m-FILTER prior to Ver.5.70R01 Ver.5 Series and m-FILTER prior to Ver.4.87R04 Ver.4 Series allows a remote unauthenticated attacker to bypass authentication and send users' unintended email when email is being sent under the certain conditions. The attacks exploiting this vulnerability have been...

PT-2023-14216 · Adeel Ahmed · Ip Blacklist Cloud

Name of the Vulnerable Software and Affected Versions: Adeel Ahmed's IP Blacklist Cloud plugin versions prior to 5.01 Description: The issue is related to an authentication SQL Injection vulnerability. Recommendations: For versions prior to 5.01, update to version 5.01 or later to resolve the iss...

GitLab 15.4 < 15.4.6 / 15.5 < 15.5.5 / 15.6 < 15.6.1 (CVE-2022-3820)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registrie...

PT-2023-13280 · Google · Android Core

Name of the Vulnerable Software and Affected Versions: Android Core affected versions not specified Description: The issue is related to memory corruption in the Android core, caused by improper validation of an array index when returning feature IDs after license authentication. Recommendations:...

Session fixation

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 221195...