CVE-2025-53013

Summary (CVE-2025-53013, Himmelblau) : Versions 0.9.10–0.9.16 allow offline authentication to a Linux host via Himmelblau using an invalid Linux Hello PIN. The root cause is an incorrect handling in acquire_token_by_hello_for_business_key: offline, a TPMFail is expected for an invalid key, but a ...

CVE-2025-53013 Himmelblau offline auth permits authentication with invalid Hello PIN

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an invalid Linux Hello PIN, provided the host is offline. While the user gains access to th...

CVE-2025-53013 Himmelblau offline auth permits authentication with invalid Hello PIN

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an invalid Linux Hello PIN, provided the host is offline. While the user gains access to th...

Himmelblau 授权问题漏洞

Himmelblau is an Azure Entra ID authentication module open-sourced by Himmelblau. An authorization issue vulnerability exists in Himmelblau versions 0.9.10 to 0.9.16, which stems from an invalid Linux Hello PIN authentication that can be used while offline...

PT-2025-27005

Name of the Vulnerable Software and Affected Versions: Himmelblau versions 0.9.10 through 0.9.16 Description: A vulnerability in Himmelblau allows a user to authenticate to a Linux host using an invalid Linux Hello PIN when the host is offline. This issue arises from an incorrect assumption in th...

CVE-2025-49970

Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog hello-fse-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE Blog: from n/a through = 1.0.6...

CVE-2025-49970

Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog hello-fse-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE Blog: from n/a through = 1.0.6...

CVE-2025-49970 WordPress Hello FSE Blog theme <= 1.0.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog hello-fse-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE Blog: from n/a through = 1.0.6...

CVE-2025-49970

CVE-2025-49970 — WordPress Hello FSE Blog theme

PT-2025-26338 · Unknown · Hello Fse Blog

Name of the Vulnerable Software and Affected Versions: Hello FSE Blog versions 1.0.0 through 1.0.6 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Hello FSE Blog version...

WordPress plugin Hello FSE Blog Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

The vulnerability of the biometric authentication function in Windows Hello on Windows operating systems allows a intruder to gain unauthorized access to protected information.

The vulnerability of the biometric authentication function in Windows Hello on Windows operating systems is related to errors in information processing. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

WordPress Hello FSE Blog theme <= 1.0.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Peter Thaleikis in WordPress Theme Hello FSE Blog versions = 1.0.6...

CVE-2025-47969

Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized attacker to disclose information locally...

CVE-2025-47969

Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized attacker to disclose information locally...

CVE-2025-47969

Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized attacker to disclose information locally...

Malicious code in hello-gator (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99c626fd5c61521e9e6c52377eb5d3a75ea4230c12ca16c294e86ead8364c064 Any computer that has this package installed or running should be considered...

MAL-2025-5033 Malicious code in hello-gator (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99c626fd5c61521e9e6c52377eb5d3a75ea4230c12ca16c294e86ead8364c064 Any computer that has this package installed or running should be considered...

Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized attacker to disclose information locally...

Microsoft Windows Hello 信息泄露漏洞

Microsoft Windows Hello is a biometric-based login from Microsoft Corporation USA that allows you to sign in using your face, fingerprint or PIN. An information disclosure vulnerability exists in Microsoft Windows Hello. The following products and versions are affected: Windows 11 Version 22H2 fo...