EUVD-2025-37960

Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or tampered tokens to gain unauthorized...

HCL DevOps Loop 安全漏洞

HCL DevOps Loop is a suite of code development platforms from HCL India. A security vulnerability exists in HCL DevOps Loop that stems from the API authentication middleware not properly validating token expiration times and cryptographic signatures, which could lead to the use of expired or...

CVE-2025-11529 ChurchCRM API Endpoint AuthMiddleware.php AuthMiddleware missing authentication

A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit...

CVE-2025-11529 ChurchCRM API Endpoint AuthMiddleware.php AuthMiddleware missing authentication

A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit...

Linux Distros Unpatched Vulnerability : CVE-2021-38562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Best Practical Request Tracker RT 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against...

Improper Access Control

marshmallow-packages/nova-tiptap is vulnerable to Improper Access Control. The vulnerability is due to missing authentication middleware and lack of file validation on the /nova-tiptap/api/file endpoint, which allows an attacker to upload arbitrary files e.g., PHP scripts or binaries to any...

GO-2024-3350 WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service in github.com/clidey/whodb/core

WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service in github.com/clidey/whodb/core...

WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service

Summary A Denial of Service DoS vulnerability in the authentication middleware allows any client to cause memory exhaustion by sending large request bodies. The server reads the entire request body into memory without size limits, creating multiple copies during processing, which can lead to Out ...

GHSA-5PF6-CQ2V-23WW WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service

Summary A Denial of Service DoS vulnerability in the authentication middleware allows any client to cause memory exhaustion by sending large request bodies. The server reads the entire request body into memory without size limits, creating multiple copies during processing, which can lead to Out ...

GHSA-C4CM-R9FH-JGJ9 commonground-api-common unexploitable privilege escalation in JWT authentication middleware

Impact This is a privilege escalation vulnerability. The impact is negligible and entirely theoretical. A non-exploitable weakness was found in how the client-supplied JWTs are verified. Because an explicit allow-list of known algorithms is used in the PyJWT library, user-supplied invalid...

Session Fixation

uptime-kuma is vulnerable to Session Fixation. The vulnerability is caused by a lack of session token invalidation in the server.js authentication middleware. This allows attackers with a token to maintain access even after the user's password changed...

passport 跨站请求伪造漏洞

passport is an Express-compatible Node.js authentication middleware from Jared Hanson, an individual developer in the United States. A vulnerability exists in passport in the form of an authorization issue that stems from the fact that it does not clear the session object during authentication,...

FreeBSD : Grafana -- Privilege escalation (db895ed0-6298-11ed-9ca2-6c3be5272acd)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db895ed0-6298-11ed-9ca2-6c3be5272acd advisory. - Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and...

UBUNTU-CVE-2022-39328

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patche...

CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patche...

CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patche...

Authentication flaw

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...

CVE-2021-45232 security vulnerability on unauthorized access.

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...

GHSA-JWQP-28GF-P498 Scrapy HTTP authentication credentials potentially leaked to target websites

Impact If you use HttpAuthMiddleware i.e. the httpuser and httppass spider attributes for HTTP authentication, all requests will expose your credentials to the request target. This includes requests generated by Scrapy components, such as robots.txt requests sent by Scrapy when the ROBOTSTXTOBEY...

Scrapy 信息泄露漏洞

Scrapy is a free and open source web crawler framework written in Python. Scrapy suffers from an information disclosure vulnerability where if you use the HttpAuthMiddleware i.e., the httpuser and httppass attributes for HTTP authentication, all requests will disclose your credentials to the...