Magento Mass Importer <0.7.24 - Remote Auth Bypass

Magento Mass Importer aka MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. id: CVE-2020-5777 info: name: Magento Mass Importer 0.7.24 - Remote Auth Bypass author: dwisiswant0...

SonarQube - Authentication Bypass

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. id: CVE-2020-27986 info: name: SonarQube - Authentication Bypass author: pikpikcu severity: high description: | SonarQube 8.4.2.36762 allows remote attackers to...

Alerta < 8.1.0 - Authentication Bypass

Alerta prior to version 8.1.0 is prone to authentication bypass when using LDAP as an authorization provider and the LDAP server accepts Unauthenticated Bind requests. id: CVE-2020-26214 info: name: Alerta 8.1.0 - Authentication Bypass author: CasperGN,daffainfo severity: critical description:...

Netgear-WN604 downloadFile.php - Information Disclosure

There is an information leakage vulnerability in the downloadFile.php interface of Netgear WN604. A remote attacker using file authentication can use this vulnerability to obtain the administrator account and password information of the wireless router, causing the router's background to be...

Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS)

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...

JetBrains TeamCity > 2023.11.3 - Authentication Bypass

In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible id: CVE-2024-23917 info: name: JetBrains TeamCity 2023.11.3 - Authentication Bypass author: iamnoooob,rootxharsh,pdresearch severity: critical description: | In JetBrains TeamCity before 2023.11.3...

WordPress Plugin MainWP Child - Authentication Bypass

The plugin is vulnerable to an authentication bypass that allows an unauthenticated user to login as an administrator without providing a password. This vulnerability is only exploitable when the plugin has not been connected to a MainWP Dashboard and the "Require unique security ID" option is no...

Apache CloudStack - SAML Signature Exclusion

The CloudStack SAML authentication disabled by default does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response...

Ray Static File - Local File Inclusion

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. id: CVE-2023-6020 info: name: Ray Static File - Local File Inclusion author: byt3bl33d3r severity: high description: | LFI in Ray's /static/ directory allows attackers to read any file on the...

phpIPAM - 1.6 - Cross-Site Scripting

phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

Strapi Versions <=4.5.6 - Authentication Bypass

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that...

Discuz! X5.0 - Authentication Bypass

Discuz! X5.0 20260320 through 20260501 contains an authentication bypass caused by exploitation of a shared cryptographic key and encryption oracle in dbbak.php and loggingctl::loggingmore, letting unauthenticated remote attackers access database backup and restore functions, exploit requires...

WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass

Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in ismainwpauthenticated function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrat...

phpBB < 3.3.17 - Authentication Bypass

phpBB before 3.3.17 contains an authentication bypass vulnerability in the login-link feature. By setting the authprovider query parameter to "apache", an unauthenticated attacker can bypass password verification and log in as any user, including administrators. The Apache auth provider trusts th...

CVE-2024-4040-SSTI-LFI-PoC

CVE-2024-4040 SSTI & LFI PoC - استغلال | CrushFTP هذا دليل إثبات المفهوم لثغرة حقن القالب من جانب الخادم SSTI وتضمين الملفات المحلية LFI في CrushFTP. الميزات استغلال الثغرات ذات الخطورة الحرجة في خوادم CrushFTP من خلال حقن القالب من جانب الخادم SSTI وتجاوز المصادقة. رفع هذا الاستغلال إلى تضمين...

CVE-2023-36899

CVE-2023-36899 بيئة وأدوات إعادة إنتاج لثغرة CVE-2023-36899، والتي تستهدف تجاوز مصادقة الجلسة بدون ملفات تعريف الارتباط في إطار عمل ASP.NET. Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework CVE-2023-36899 في تطوير الويب الحديث، على الرغم من أن ملفات تعريف الارتباط cooki...

CVE-2024-6670

CVE-2024-6670 إثبات مفهوم PoC لثغرة تجاوز المصادقة عبر حقن SQL في Progress Software WhatsUp Gold HasErrors CVE-2024-6670 يمكن العثور على تحليل السبب الجذري للثغرة في مدونتي: https://summoning.team/blog/progress-whatsup-gold-sqli-cve-2024-6670/ الاستخدام root@kitploit: python CVE-2024-6670.py...

fitness-app

تطبيق Fitbit مفتوح المصدر لنظام Android هذا التطبيق مبني على أعمال Jiska Classen وMatthias Hanreich وSteffen Kreis وTobias Krichel وJohannes Riedel وSven Ströher. الميزات مسح أجهزة Fitbit بتقنية BLE المصادقة ضد خادم Fitbit مثل التطبيق الأصلي الحصول على بيانات اعتماد المصادقة من خادم Fitbit لإعادة...

SAP_EEM_CVE-2020-6207

PoC لـ CVE-2020-6207 فقدان فحص المصادقة في SAP Solution Manager يتيح هذا السكربت فحص واستغلال فحوصات المصادقة المفقودة في سيرفلت SAP EEM tcsmdagentapplicationeem والتي تؤدي إلى RCE على وكلاء SAP SMDAgents المتصلين بـ SAP Solution Manager الاكتشاف الأصلي: Pablo Artuso Yvan 'iggy' G الورقة البحثية:...

latma

Outil d'analyse de mouvement latéral L'outil d'analyse de mouvement latéral LATMA collecte les journaux d'authentification du domaine et des environnements Azure AD et recherche les potentielles attaques de mouvement latéral et activités suspectes. Le mouvement latéral peut se situer dans...