172494 matches found
Exch-CVE-2021-26855_Priv
Exch-CVE-2021-26855 ProxyLogon è il nome generico formale per CVE-2021-26855, una vulnerabilità su Microsoft Exchange Server che consente a un attaccante di bypassare l'autenticazione e impersonare l'amministratore. Abbiamo anche concatenato questo bug con un'altra vulnerabilità post-autenticazio...
CVE-2025-64446_CVE-2025-58034
FortiWeb Remote Code Execution RCE Exploit über die CVE-2025-64446 + CVE-2025-58034-Kette Beschreibung Dieses Skript verkettet zwei kritische Schwachstellen in Fortinet FortiWeb, um eine nicht authentifizierte Remote-Codeausführung mit Root-Rechten zu erreichen: 1. CVE-2025-64446 –...
CVE-2026-15365
A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app...
CVE-2026-15365
CVE-2026-15365 affects vivo Kids Mode , where a pop-up logic flaw in a certain feature allows users to bypass password verification and access Quick Apps outside the app. The vulnerability requires a physical attack vector and is scored CVSS 4.0 Base 2.4 (LOW) , with low impact on confidentiality...
CVE-2026-14216
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks...
EUVD-2026-66269
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks...
CVE-2026-14216
The Booking for Appointments and Events Calendar (Amelia) WordPress plugin, versions prior to 2.4.7 , is missing an authentication check when processing its pending notification queue. This allows an unauthenticated attacker over the network to force the dispatch of queued notifications and integ...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
CVE-2026-80196
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...
CVE-2026-80200
Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to...
kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode
A flaw was found in the Linux kernel's iSCSI target functionality. This vulnerability allows a remote attacker to cause a buffer overflow by sending a specially crafted Challenge-Handshake Authentication Authentication Protocol CHAP response. The system fails to validate the length of the...
PAN-OS Management Web Interface - Authentication Bypass
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege...
Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution
Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...
USN-8681-1 openjdk-25 vulnerabilities
It was discovered that the JSSE component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of OpenJDK 25 did not correctly authorize users. A remote attack...
Incorrect Authorization
Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Incorrect Authorization via the FormAuthenticator and AuthenticatorBase FORM authentication flow. An attacker can bypass a security...
Authentication Bypass by Primary Weakness
Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the authentication process when using certain authentication mechanisms such as...
Replay Attack
Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Replay Attack in the DIGEST authenticator’s nonce-count window handling. An attacker can reuse a valid DIGEST-authenticated request...
EUVD-2026-66121
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...
EUVD-2026-66132
Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from...
PT-2026-82338
Name of the Vulnerable Software and Affected Versions disconf version 2.6.36 Description Incorrect Access Control allows anonymous attackers to read all configuration items and files managed by the config center. This occurs because the LoginInterceptor explicitly whitelists specific...