CVE-2025-6386

The parisneo/lollms repository is affected by a timing attack vulnerability in the authenticateuser function within the lollmsauthentication.py file. This vulnerability allows attackers to enumerate valid usernames and guess passwords incrementally by analyzing response time differences. The...

CVE-2025-6386 Timing Attack Vulnerability in parisneo/lollms

The parisneo/lollms repository is affected by a timing attack vulnerability in the authenticateuser function within the lollmsauthentication.py file. This vulnerability allows attackers to enumerate valid usernames and guess passwords incrementally by analyzing response time differences. The...

CVE-2025-53167

Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-53167

Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-53167

Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-53167

Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-53167

CVE-2025-53167 affects Huawei HarmonyOS through an authentication vulnerability in the Distributed Collaboration Framework module. Huawei CNVD/CNNVD entries describe vulnerability in HarmonyOS versions 5.0.1 and 5.1.0, allowing potential service confidentiality compromise. Root cause is authentic...

The vulnerability of the CRM User Management Framework component of the Oracle Common Applications suite, a part of the Oracle E-Business Suite, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the CRM User Management Framework component in the Oracle Common Applications of the Oracle E-Business Suite relates to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

CVE-2025-6926

Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2...

CVE-2025-47479 WordPress WP Compress plugin <= 6.30.30 - Broken Authentication Vulnerability

Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a through = 6.30.30...

Dell OpenManage Network Integration Authentication Vulnerability

Dell OpenManage Network Integration is a set of system management tools provided by Dell for integrating third-party management platforms such as PowerEdge servers, VMware vCenter, and others. An authentication vulnerability exists in Dell OpenManage Network Integration that originates from an...

Mattermost Information Disclosure Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an information disclosure vulnerability that stems from insufficient authentication of channel members, which can be exploited by an attacker to cause sensitive information to b...

CVE-2025-6926

Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2...

CVE-2025-27458 CVE-2025-27458

The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption. The challenge is sent from the server to the client, is encrypted by the client and sent back. The server does the same encryption locally and if the responses...

CVE-2025-27458 CVE-2025-27458

The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption. The challenge is sent from the server to the client, is encrypted by the client and sent back. The server does the same encryption locally and if the responses...

CVE-2025-27456 CVE-2025-27456

The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks...

CVE-2025-27449 CVE-2025-27449

The MEAC300-FNADE4 does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks...

CVE-2025-1710

CVE-2025-1710 affects the maxView Storage Manager. The root cause is insufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks. Public technical details in connected sources confirm the issue and describe the i...

BIT-ASPNET-CORE-2025-24070 ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-34079 NSClient++ Authenticated Remote Code Execution via ExternalScripts API

An authenticated remote code execution vulnerability exists in NSClient++ version 0.5.2.35 when the web interface and ExternalScripts module are enabled. A remote attacker with the administrator password can authenticate to the web interface default port 8443, inject arbitrary commands as externa...