CVE-2024-12838

The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regular privileges to send a crafted request to switch to the identity of any user, including administrators...

CVE-2024-12838 Changing Information Technology CGFIDO - Authentication Bypass

The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regular privileges to send a crafted request to switch to the identity of any user, including administrators...

PT-2024-17758 · Changing Information Technology · Cgfido

Name of the Vulnerable Software and Affected Versions: CGFIDO affected versions not specified Description: The login mechanism via device authentication of CGFIDO from Changing Information Technology has an authentication bypass issue. If a user visits a forged website, the agent program deployed...

CVE-2024-12838: Authentication Bypass by Assumed-Immutable Data

The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regular privileges to send a crafted request to switch to the identity of any user, including administrators...

CHANGING CGFIDO security vulnerabilities

CHANGING CGFIDO is a passwordless authentication system from China-based CHANGING. A security vulnerability exists in CHANGING CGFIDO versions 0.0.1 through 1.1.0, which originates from an authentication bypass vulnerability in the passwordless login mechanism that allows a remote attacker with...

SecureSTATION security vulnerabilities

SecureSTATION is an application from SecureSTATION, Inc. A security vulnerability exists in SecureSTATION v.2.5.5.3116-S50-SMA-B20160811A and prior versions, which stems from the presence of an insecure privilege vulnerability that allows a physically proximate attacker to obtain sensitive...

WordPress plugin “” has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security...

CVE-2024-48846 Cross Side Request Forgery, CSRF

Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02...

UBUNTU-CVE-2024-45608

GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17...

GLPI SQL injection vulnerability

GLPI is an open source IT and asset management software from an individual developer. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and i...

Exploit for Incorrect Default Permissions in Google Android

CVE-2022-20474 Analysis - Self-changed Bundle under LazyValue...

CVE-2024-50252 mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumipip: Fix memory leak when changing remote IPv6 address The device stores IPv6 addresses that are used for encapsulation in linear memory that is managed by the driver. Changing the remote address of an ip6gre net...

CVE-2024-10653

IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrative privileges to inject and execute OS commands on the server...

CVE-2024-10653 CHANGING Information Technology IDExpert - OS Command Injection

IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrative privileges to inject and execute OS commands on the server...

CVE-2024-10651 CHANGING Information Technology IDExpert - Arbitrary File Read through Path Traversal

IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrator privileges to exploit this vulnerability to read arbitrary system files...

CVE-2024-10651 CHANGING Information Technology IDExpert - Arbitrary File Read through Path Traversal

IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrator privileges to exploit this vulnerability to read arbitrary system files...

CHANGING ID Expert Security Vulnerability

CHANGING IDExpert is an authentication system based on zero trust and integrating various mechanisms such as FIDO, biometrics, MFA, etc. from China-based CHANGING. A security vulnerability exists in CHANGING IDExpert versions 2.5 to 2.8, which originates from incorrectly validating specific...

PT-2024-16431 · Changing Information Technology · Idexpert

Name of the Vulnerable Software and Affected Versions: IDExpert from CHANGING Information Technology affected versions not specified Description: The issue is related to improper validation of a parameter for a specific functionality in IDExpert, allowing unauthenticated remote attackers to injec...

CVE-2024-10653: Improper Neutralization of Special Elements used in an OS Command

IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrative privileges to inject and execute OS commands on the server...

CVE-2024-10652: Improper Neutralization of Input During Web Page Generation

IDExpert from CHANGING Information Technology does not properly validate a parameter for a specific functionality, allowing unauthenticated remote attackers to inject JavsScript code and perform Reflected Cross-site scripting attacks...