CVE-2025-7703

Authentication vulnerability in the mobile application（tech.palm.id）may lead to the risk of information leakage...

CVE-2025-6226

Mattermost versions 10.5.x = 10.5.6, 10.8.x = 10.8.1, 10.7.x = 10.7.3, 9.11.x = 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of...

PT-2025-30066 · Microsoft · Azure Machine Learning

Name of the Vulnerable Software and Affected Versions: Azure Machine Learning affected versions not specified Description: Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. Recommendations: At the moment, there is no information abou...

CVE-2025-49830

Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can use the policy yaml parser to reference files on the Secrets Manager, Self-Hosted server. These references may be used as reconnaissance to better understand th...

CVE-2025-37107

An authentication bypass vulnerability exists in HPE AutoPass License Server APLS prior to 9.18...

CVE-2025-20285 Cisco Identity Services Engine IP Filter Access Restriction for Admin Access Configuration Bypass Vulnerability

A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP access restrictions and log in to the device from a disallowed IP address. This vulnerability is due to improper enforcement of access controls...

CVE-2025-20274

The CVE-2025-20274 issue affects Cisco Unified Intelligence Center: a vulnerability in the web-based management interface allows an authenticated remote attacker to upload arbitrary files due to improper validation. This could let an attacker store malicious files and execute arbitrary commands o...

CVE-2025-37104 HPE Telco Service Orchestrator Software, Authenticated SQL Injection

A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients to to perform a SQL Injection attack when sending a service request, and potentially exfiltrate the database's vendor name to unauthorized authenticated...

CVE-2025-49319

CVE-2025-49319 refers to a Missing Authorization (Broken Access Control) vulnerability in the Wishlist for WooCommerce plugin. Public sources indicate it affects Wishlist for WooCommerce versions up to and including 3.2.3, due to incorrectly configured access control security levels that enable u...

CVE-2025-7703

Authentication vulnerability in the mobile application（tech.palm.id）may lead to the risk of information leakage...

CVE-2025-7703

Authentication vulnerability in the mobile application（tech.palm.id）may lead to the risk of information leakage...

CVE-2025-7703

Authentication vulnerability in the mobile application（tech.palm.id）may lead to the risk of information leakage...

CVE-2025-7703

Technical details for CVE-2025-7703 are not publicly disclosed in the provided documents. Monitor for updates from vendors and security advisories.

Authen::SASL::Perl::DIGEST_MD5 安全漏洞

Authen::SASL::Perl::DIGESTMD5 is a module in the Perl language from the Perl community. A security vulnerability exists in Authen::SASL::Perl::DIGESTMD5 versions 2.04 through 2.1800 and earlier, which stems from insecure cnonce generation...

CVE-2025-49830

Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can use the policy yaml parser to reference files on the Secrets Manager, Self-Hosted server. These references may be used as reconnaissance to better understand th...

CVE-2025-53826 FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of...

CVE-2025-53826

CVE-2025-53826 concerns File Browser (v2.39.0) where the authentication system issues long‑lived JWTs that remain valid after logout. This creates a risk of session replay, allowing an attacker to reuse a valid token to access authenticated endpoints until expiry. Multiple connected sources corro...

CVE-2025-53826 FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of...

CVE-2025-3396

An issue has been discovered in GitLab EE affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed authenticated project owners to bypass group-level forking restrictions by manipulating API requests...

CVE-2024-38648

Summary: CVE-2024-38648 is a vulnerability in Ivanti Desktop and Server Management (Ivanti DSM) prior to version 2024.2. It arises from a hardcoded secret that could allow an authenticated attacker on an adjacent network to decrypt sensitive data, including user credentials. Affected products/ver...