Design/Logic Flaw

The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and including, 2.50. This is due to missing capability checks on several AJAX actions and nonce disclosure in the source page of the administrative dashboard. This makes...

CVE-2023-41089

CVE-2023-41089 affects DEXGate (DEXGate version 20130114). The vulnerability is improper authentication that can allow an attacker to impersonate a legitimate user while a session remains active, by exploiting the cookie header to generate legitimate requests. CVSS v3 base score 8.0 (ATT&CK conte...

Home Assistant Information Disclosure Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. An information disclosure vulnerability exists in Home Assistant versions prior to 2023.9.0, which stems from a vulnerability that allows an attacker to log in and...

Authentication flaw

Improper Authentication vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attacker to obtain sequence programs from the product or write malicious sequence programs or improper data in the product without authentication by sending...

Mitsubishi Electric MELSEC-F Series 授权问题漏洞

Mitsubishi Electric MELSEC-F Series is a basic micro PLC with analog and communication function scalability for industrial control equipment from Mitsubishi Electric Mitsubishi Electric, Japan. An authentication error vulnerability exists in the Mitsubishi Electric MELSEC-F Series, which can be...

CVE-2023-27312

SnapCenter Plugin for VMware vSphere versions 4.6 prior to 4.9 are susceptible to a vulnerability which may allow authenticated unprivileged users to modify email and snapshot name settings within the VMware vSphere user interface...

CVE-2023-44981 Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper quorum.auth.enableSasl=true, the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The...

Siemens Mendix 安全漏洞

The Mendix Forgot Password module allows your users to register your application or reset their own passwords without administrator involvement. A vulnerability exists in the Siemens Mendix Forgot Password module that can be exploited by an attacker to determine if a user is valid, allowing a bru...

Fortinet FortiMail Security Vulnerability

Fortinet FortiMail is a set of e-mail security gateway products of the U.S. Fita Fortinet. The product provides email security and data protection features. A security vulnerability exists in Fortinet FortiMail that stems from an incorrect authorization vulnerability that allows an authenticated...

The vulnerability of the Apache InLong data integration platform, related to weak password requirements, allows attackers to gain access to user accounts.

The vulnerability of the Apache InLong data integration platform is related to weak password requirements. Exploiting this vulnerability could allow a malicious actor to gain access to a user account remotely...

PT-2023-5991 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-beta1 and earlier Adobe Commerce versions 2.4.6-p2 and earlier Adobe Commerce versions 2.4.5-p4 and earlier Adobe Commerce versions 2.4.4-p5 and earlier Description: The issue is related to an Improper...

CVE-2023-3770

CVE-2023-3770 describes an incorrect input validation vulnerability in Ingeteam’s INGEPAC DA devices. The flaw allows an attacker on the same network to use the UDP discovery port (1925/UDP) to obtain device‑specific information without authentication. Affected component is the data validation on...

Missing Authentication For Critical Function

github.com/cilium/cilium is vulnerable to Missing Authentication. The vulnerability is due to the ValidateCNP function in validator.go which lacks checks for a policy with any malicious or incorrectly match configurations, allowing an attacker to create policies that bypass namespace restrictions...

CVE-2023-43652

JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered public knowledge and should not used ...

CVE-2023-43652 Non-MFA account takeover via using only SSH public key to login in jumpserver

JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered public knowledge and should not used ...

Siemens LOGO! 8 BM Missing Authentication For Critical Function (CVE-2020-25228)

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. A service available on port 10005/tcp of the affected devices could allow complete access to all services without authorization. An attacker could gain full control over an affected device, if he has access...

The vulnerability of Microsoft Exchange Server’s mail server, related to deficiencies in authentication procedures, allows attackers to carry out spear-phishing attacks.

The vulnerability of Microsoft Exchange Server is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to carry out spear-phishing attacks remotely...

The vulnerability of Mozilla VPN’s network software for clients, related to authentication procedures that allow attackers to circumvent existing security restrictions and set arbitrary VPN settings.

The vulnerability of Mozilla VPN’s network software for clients is related to deficiencies in the authentication process. Exploiting this vulnerability allows attackers to circumvent existing security restrictions and set arbitrary VPN settings...

Oracle Linux 8 : squid:4 (ELSA-2020-4743)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4743 advisory. - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as...

China Mobile Intelligent Home Gateway Authorization Issue Vulnerability

China Mobile Intelligent Home Gateway is an intelligent home gateway from China Mobile, a Chinese company. A security vulnerability exists in China Mobile Intelligent Home Gateway, which can be exploited to execute arbitrary code via the authentication mechanism...