The vulnerability of the System Configuration component of the Oracle Financial Services Analytical Applications Infrastructure platform allows a perpetrator to gain full control over the application.

The vulnerability of the System Configuration component of the Oracle Financial Services Analytical Applications Infrastructure platform relates to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker operating remotely to gain full control ove...

PT-2025-53392

Name of the Vulnerable Software and Affected Versions Pexip Infinity versions prior to 39.0 Description A critical function within a product-internal API lacks proper authentication. An attacker who has already gained the ability to execute code on one node within a Pexip Infinity installation ca...

CVE-2024-49587 Glutton V1 endpoints missing authentication

Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed...

PT-2025-51840

Name of the Vulnerable Software and Affected Versions Netun Solutions HelpFlash IoT version v18 178 221102 ASCII PRO 1R5 50 Description The over-the-air OTA firmware update process in the software does not properly authenticate update servers or validate firmware signatures, and relies on...

The vulnerability in the web interface of the Juniper Networks Junos Space Security Director allows a attacker to gain unauthorized access to and modify protected information.

The vulnerability of the Juniper Networks Junos Space Security Director web interface interface is related to the absence of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to and modify the protected information...

CVE-2025-59516

Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally...

pipeshub-ai 代码问题漏洞

pipeshub-ai is an enterprise automation platform open-sourced by PipesHub AI - The Open Source Alternative to Glean. A code issue vulnerability exists in versions prior to pipeshub-ai 0.1.0-beta, which stems from a lack of authentication and could allow an attacker to remotely overwrite files or...

CVE-2025-42875

The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, violating secure authentication practices causing low impact on Confidentiality, Integrity and Availability of the...

CVE-2025-42875

CVE-2025-42875 relates to the SAP NetWeaver/Internet Communication Framework where authentication checks are missing for features needing user identification, enabling reuse of authorization tokens. The issue, described across multiple feeds, indicates a vulnerability in SAP’s web/EC framework th...

The vulnerability of the Apache OpenOffice office software package, related to the lack of authentication, allows attackers to circumvent existing security restrictions.

The vulnerability of the Apache OpenOffice office software is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions through a specially created file...

The vulnerability of the Modbus TCP protocol implementation in DIRIS Digiware M-70 communication gateways allows a perpetrator to cause service interruptions or increase their privileges.

The vulnerability of the Modbus TCP protocol implementation in DIRIS Digiware M-70 microprogramming communication switches is related to the absence of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to cause service failures or increase their...

The vulnerability of the reporting framework for FACTION penetration testing lies in the ability to execute arbitrary code and gain access to read, modify, or delete information, which can be exploited by attackers through the loading of malicious extensions.

The vulnerability of the reporting framework for FACTION penetration testing lies in the loading of malicious extensions due to the absence of authentication procedures. Exploiting this vulnerability allows a remote attacker to execute arbitrary code and gain access to read, modify, or delete...

CVE-2025-63435

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official...

PT-2025-47949

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official...

PT-2025-47710

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including,...

CVE-2025-12937 ACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update

The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'acfflmupdatetemplatewithpastedlayout' function in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers to...

SolarWinds Serv-U 安全漏洞

SolarWinds Serv-U is an FTP File Transfer Protocol server software from SolarWinds USA. A security vulnerability exists in SolarWinds Serv-U that stems from a lack of an authentication process that could lead to code execution by an attacker with administrator privileges...

CVE-2025-63225

The Eurolab ELTS100UBX device firmware version ELTS100v1.UBX is vulnerable to Broken Access Control due to missing authentication on critical administrative endpoints. Attackers can directly access and modify sensitive system and network configurations, upload firmware, and execute unauthorized...

CVE-2025-64307

The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to manipulate robot control functions, including initiating or halting runners, assigning jobs, clearing stations, and deploying storage totes...

General Industrial Controls Lynx+ Gateway 访问控制错误漏洞

General Industrial Controls Lynx+ Gateway is an industrial automation gateway from General Industrial Controls India. An access control error vulnerability exists in the General Industrial Controls Lynx+ Gateway that stems from a lack of critical authentication on the embedded web server, which...