23 matches found
CVE-2026-57220
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remote client to declare oversized frame length...
CVE-2026-48108 Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input
Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce the SSH identification-string rules as deliberately as OpenSSH. In particular, the server-side identification reader used the same permissive path as the client, allowing...
Apache ActiveMQ < 5.19.2 / 6.0.x < 6.1.9 / 6.2.0 MQTT Control Packet Validation Vulnerability (CVE-2025-66168)
The version of Apache ActiveMQ running on the remote host is prior to 5.19.2, 6.0.x prior to 6.1.9, or 6.2.0. It is, therefore, affected by a vulnerability: - Apache ActiveMQ does not properly validate the remaining length field in MQTT control packets which may lead to an integer overflow during...
EUVD-2023-47957
Malicious code in bioql PyPI...
CVE-2025-20265: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device. This vulnerability is due to a lack of proper handling of user input...
CVE-2025-44528: Uncontrolled Resource Consumption
An issue in Texas Instruments LP-CC2652RB SimpleLink CC13XX CC26XX SDK 7.41.00.17 allows attackers to cause a Denial of Service DoS via sending a crafted LLPauseEncReq packet during the authentication and connection phase, causing a Denial of Service DoS...
PT-2025-26641
Name of the Vulnerable Software and Affected Versions: Texas Instruments LP-CC2652RB SimpleLink CC13XX CC26XX SDK version 7.41.00.17 Description: An issue in the Texas Instruments LP-CC2652RB SimpleLink CC13XX CC26XX SDK allows attackers to cause a Denial of Service DoS via sending a crafted LL...
TheGreenBow Windows Certified VPN Client 安全漏洞
TheGreenBow Windows Certified VPN Client is a client VPN from TheGreenBow. A security vulnerability exists in TheGreenBow Windows Certified VPN Client. A remote attacker could exploit the vulnerability to execute arbitrary code via the IKEv2 authentication phase...
PT-2024-31747 · Thegreenbow · Thegreenbow Windows Standard Vpn Client +4
Name of the Vulnerable Software and Affected Versions: TheGreenBow Windows Standard VPN Client versions 6.87.108 and older TheGreenBow Windows Enterprise VPN Client versions 6.87.109 and older TheGreenBow Windows Enterprise VPN Client versions 7.5.007 and older TheGreenBow Android VPN Client...
CVE-2023-49328
On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve remote code execution via Argument Injection in the server-to-server module...
Symfony Security Vulnerabilities
Symfony is a PHP framework for web and console applications and a set of reusable PHP components from Symfony, Inc. A security vulnerability exists in Symfony that stems from a user identifier not changing between the authentication phase and a successful login...
GHSA-3H68-WVV6-8R5H Improper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak
The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does n...
PT-2021-12032 · Openvpn · Openvpn Access Server
Name of the Vulnerable Software and Affected Versions: OpenVPN Access Server versions 2.7.3 through 2.8.7 Description: The issue allows remote attackers to trigger an assert during the user authentication phase. This occurs when incorrect authentication token data is provided in an early phase of...
CVE-2019-7218
Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app like google authenticator is able to bypass the first authentication phase username/password mechanism an...
httpd: ap_get_basic_auth_pw() authentication bypass
It was discovered that the use of httpd's apgetbasicauthpw API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd...
httpd: ap_get_basic_auth_pw() authentication bypass
It was discovered that the use of httpd's apgetbasicauthpw API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd...
httpd: ap_get_basic_auth_pw() authentication bypass
It was discovered that the use of httpd's apgetbasicauthpw API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd...
httpd: ap_get_basic_auth_pw() authentication bypass
It was discovered that the use of httpd's apgetbasicauthpw API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd...
httpd: ap_get_basic_auth_pw() authentication bypass
It was discovered that the use of httpd's apgetbasicauthpw API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd...
ALPINE-CVE-2017-3167
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the apgetbasicauthpw by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed...