CVE-2023-47435

An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected pages...

Electrolink FM/DAB/TV Transmitter 安全漏洞

The Electrolink FM/DAB/TV Transmitter is a series of transmitters from Electrolink. A security vulnerability exists in the Electrolink FM/DAB/TV Transmitter that originates from the ability to bypass the authentication mechanism, which could result in unauthorized system configuration changes or...

keycloak: secondary factor bypass in step-up authentication

A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote user authenticated with a password to register a false second authentication factor along with an existing one and bypass authentication...

PT-2024-19105 · Electrolink · Electrolink Fm/Dab/Tv Transmitter

Name of the Vulnerable Software and Affected Versions: Electrolink FM/DAB/TV Transmitter affected versions not specified Description: The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages, allowing more critical operations to the...

The vulnerability of the adodb_addslashes() function in the adodb library, which allows a hacker to bypass the authentication process

The vulnerability of the adodbaddslashes function in the adodb library is related to incorrect authentication. Exploiting this vulnerability could allow an attacker to bypass the authentication process...

Authentication Bypass

OpenMetadata is vulnerable to Authentication Bypass. The vulnerability is caused due to improper path validation in the JwtFilter, allowing attackers to bypass authentication mechanisms by exploiting the presence of path parameters in requests...

CVE-2024-1735

A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentication. All users who rely on armeria-saml older than version 1.27.2 must upgrade to 1.27.2 or later...

SUSE SLES15 Security Update : libssh (SUSE-SU-2024:0525-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0525-1 advisory. Update to version 0.9.8 jscPED-7719: Fix CVE-2023-6004: Command injection using proxycommand bsc1218209 Fix CVE-2023-48795: Potenti...

CVE-2023-47422

An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via a crafted URL...

Security Updates for Microsoft Skype for Business (February 2024)

The Microsoft Skype for Business installation on the remote host is missing a security update. It is, therefore, affected by remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. %NASLMINLEVEL 80900 C Tenable, Inc...

PT-2024-14223 · Allegra · Allegra

Name of the Vulnerable Software and Affected Versions: Allegra affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this issue, the existing authentication...

CVE-2024-22394

An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow a remote attacker to bypass authentication. This issue affects only firmware version SonicOS 7.1.1-7040...

CVE-2023-40545

Authentication bypass when an OAuth2 Client is using clientsecretjwt as its authentication method on affected 11.3 versions via specially crafted requests...

Authentication flaw

Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 and later, FR Configurator2 all versions, GT Designer3 Version1GOT1000 all versions, GT Designer3 Version1GOT2000 all versions, GX Works2 versions 1.11M and later, GX Works3 all...

Path traversal

NetVision Information airPASS has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files...

RubyGems Authorization Issues Vulnerability

RubyGems is a Ruby package manager from the RubyGems organization. The product is primarily used to distribute and manage Ruby packages. RubyGems has an authorization issue vulnerability that stems from allowing an attacker to bypass MFA requirements and take over an account...

Attacks, Vulnerabilities and Actors 25 December to 31 December 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of eight executed attacks, four instances of adversary activity, and five exploited...

Security Bulletin: Vulnerability in cryptography may affect IBM Spectrum Sentinel Anomaly Scan Engine (CVE-2023-23931, CVE-2023-38325)

Summary Vulnerabilities in python cryptography may affect IBM Spectrum Sentinel Anomaly Scan Engine. Vulnerabilities include: Python cryptography allowing remote attacker bypass authentication and obtain access to launch further attacks on the system. Vulnerability Details CVEID:CVE-2023-23931...

CVE-2023-48389

Multisuns EasyLog web+ has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files...

Path traversal

Multisuns EasyLog web+ has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files...