CVE-2024-47533 Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes

Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. utils.getsharedsecret always returns -1, which allows anyone to connect to cobbler...

CVE-2024-47533

CVE-2024-47533 – Cobbler XML-RPC Authentication Bypass : The issue arises in Cobbler’s XML-RPC interface where utils.get_shared_secret() can return -1, allowing unauthenticated access with empty username and password -1. Affected versions are 3.0.0 up to but not including 3.2.3 and 3.3.0 up to 3....

CVE-2020-26062

A vulnerability in Cisco Integrated Management Controller could allow an unauthenticated, remote attacker to enumerate valid usernames within the vulnerable application. The vulnerability is due to differences in authentication responses sent back from the application as part of an authentication...

CVE-2023-20154

A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface with administrative privileges. This vulnerability is due to the improper handling of certain messages that are returned by the associated...

PT-2024-34484 · Unknown · Flightpath

Name of the Vulnerable Software and Affected Versions: FlightPath version 7.5 Description: The issue allows authenticated remote attackers with administrative rights to inject arbitrary JavaScript in the web browser of a user. This is achieved by including a malicious payload into the Last Name...

iperf3 security update

3.9-13 - Resolves: RHEL-29579 - vulnerable to marvin attack if the authentication option is used 3.9-12 - Resolves: RHEL-39975 - possible denial of service 3.9-11 - Related: 2223676 - bumping version for correct update path...

CVE-2024-52553

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b6d and earlier does not invalidate the previous session on login...

WordPress plugin MultiManager WP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

ALSA-2024:9325 Low: cockpit security update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fixes: cockpit: Authenticated user can kill any process when enabling...

The vulnerability of the JetBrains Hub account management software, related to deficiencies in authentication procedures, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the JetBrains Hub account management software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

WordPress plugin Social Login 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An authorization issue vulnerabilit...

Mastodon < 4.1.13 Authentication Bypass

According to its self-reported version number, the version of Mastodon running on the remote host is prior to 3.5.17 or 4.0.x prior to 4.0.13 or 4.1.x prior to 4.1.13 or 4.2.x prior to 4.2.5. Therefore, it may be affected by a remote user impersonation and takeover. Note that the scanner has not...

Mastodon < 4.2.5 Authentication Bypass

According to its self-reported version number, the version of Mastodon running on the remote host is prior to 3.5.17 or 4.0.x prior to 4.0.13 or 4.1.x prior to 4.1.13 or 4.2.x prior to 4.2.5. Therefore, it may be affected by a remote user impersonation and takeover. Note that the scanner has not...

RHEL 7 : openstack-ironic (RHSA-2016:1378)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1378 advisory. OpenStack Bare Metal ironic is a tool used to provision bare metal as opposed to virtual machines. It leverages common technologies such as PXE boot...

RHEL 7 : openstack-ironic (RHSA-2016:1377)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1377 advisory. OpenStack Bare Metal ironic is a tool used to provision bare metal as opposed to virtual machines. It leverages common technologies such as PXE boot...

NVIDIA shader out-of-bounds and eleven LevelOne router vulnerabilities

Cisco Talos' Vulnerability Research team recently discovered five Nvidia out-of-bounds access vulnerabilities in shader processing, as well as eleven LevelOne router vulnerabilities spanning a range of possible exploits. For Snort coverage that can detect the exploitation of these vulnerabilities...

The vulnerability of the PKIAuthenticationPlugin plugin for the Apache Solr search server allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the PKIAuthenticationPlugin plugin for the Apache Solr search server is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

Fortinet Fortigate MFA bypass by changing username case (FG-IR-19-283)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-19-283 advisory. - An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user...

CVE-2024-10386

CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in database manipulation...

CVE-2024-10386

CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in database manipulation...