CVE-2024-48849 Authentication and Authorization Issues

Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through = 9.3.4...

USN-7224-1: Cyrus IMAP Server vulnerabilities

It was discovered that non-authentication-related HTTP requests could be interpreted in an authentication context by a Cyrus IMAP Server when multiple requests arrived over the same connection. An unauthenticated attacker could possibly use this issue to perform a privilege escalation attack. Thi...

CVE-2023-1907 Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session

A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously...

PT-2025-1068 · Dell · Dell Powerscale Insightiq

Name of the Vulnerable Software and Affected Versions: Dell PowerScale InsightIQ affected versions not specified Description: The issue is related to insufficient restriction of authentication attempts in the software, which can be exploited by a remote attacker to cause a denial of service...

PT-2025-2643 · Ibm · Ibm Openpages

Name of the Vulnerable Software and Affected Versions: IBM OpenPages version 9.0 Description: The issue allows an authenticated user to obtain sensitive information, such as configurations that should only be available to privileged users. Recommendations: For IBM OpenPages version 9.0, at the...

RLSA-2024:10952 Moderate: php:7.4 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: 1-byte array overrun in common path resolve code CVE-2023-0568 php: Passwordverify always return true with some hash CVE-2023-0567 php: Missing error check and insufficient random bytes in...

CVE-2024-52592

CVE-2024-52592 – Misskey : Misskey versions prior to 2024.11.0-alpha.3 suffer from missing validation in the ApInboxService.update function, allowing an attacker to modify poll results belonging to another user without authentication beyond a valid signature from any actor on any remote instance....

CVE-2024-21543

Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks...

USN-7108-2: AsyncSSH vulnerabilities

USN-7108-1 fixed vulnerabilities in AysncSSH. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the extension info message. An attacker able to intercept...

SUSE SLED15: postgresql15 / postgresql15-contrib / postgresql15-devel / etc (SUSE-SU-2024:4174-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4174-1 advisory. - CVE-2024-10976: Ensure cached plans are marked as dependent on the calling role when RLS appli...

CVE-2024-45337

Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...

QNAP QTS Multiple Vulnerabilities (QSA-24-49)

QNAP QTS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescription...

Moderate: php:7.4 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: 1-byte array overrun in common path resolve code CVE-2023-0568 php: Passwordverify always return true with some hash CVE-2023-0567 php: Missing error check and insufficient random bytes in...

Oracle Linux 9 : grafana (ELSA-2024-9115)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-9115 advisory. - fix CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work - resolve CVE-2023-3128 grafana: account takeover possible when using...

Fedora 41 : chromium (2024-3a6f9ab958)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3a6f9ab958 advisory. Update to 130.0.6723.58 High CVE-2024-9954: Use after free in AI Medium CVE-2024-9955: Use after free in Web Authentication Medium CVE-2024-9956:...

EulerOS 2.0 SP9 : OpenIPMI (EulerOS-SA-2024-2834)

According to the versions of the OpenIPMI packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenIPMI before 2.0.36 has an out-of-bounds array access for authentication type in the ipmisim simulator, resulting in denial of service or wit...

Citrix Gateway: Launch, Authentication, Policies and Endpoint Analysis (EPA)

Introduction This article provides a summary of some of the useful resources about how to investigate, troubleshoot, and prevent the most common issues related to launching a session on Citrix Gateway. This article includes links intended to help with topics which are related to Authentication, t...

CVE-2024-5732

A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Port. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public...

WordPress plugin Checkout Mestres do WP for WooCommerce 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Checkout Mestres d...

Lunary 安全漏洞

Lunary is a production toolkit for LLM open source by lunary. A security vulnerability exists in Lunary that stems from the lack of item ID validation in SQL queries, which is prone to authentication issues and allows unauthorized users to retrieve assessment results from any organization simply ...