PT-2025-40590

Name of the Vulnerable Software and Affected Versions QNAP Authenticator versions prior to 1.3.1.1227 Description An improper authentication issue exists in QNAP Authenticator. An attacker with physical access can exploit this to compromise system security. Recommendations Update to QNAP...

GTT GROUP OpenSIAC 授权问题漏洞

GTT GROUP OpenSIAC is a digital service management platform from GTT GROUP, Inc. GTT GROUP OpenSIAC suffers from an authorization issue vulnerability that stems from improper authentication and could lead to an attacker impersonating a user using the Cl@ve authentication method...

CVE-2025-41064: Improper Authentication

Incorrect authentication vulnerability in OpenSIAC, which could allow an attacker to impersonate a person using Cl@ve as an authentication method...

CVE-2025-61665: Improper Authentication

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the getrelatoriossocios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and...

Juniper ScreenOS Improper Authentication Vulnerability

Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device...

Improper Authentication

esphome is vulnerable to improper authentication. The vulnerability is due to the webserver authentication check incorrectly passing when the client-supplied base64-encoded Authorization value is empty or a substring of the correct value, which allows an attacker to gain unauthorized access to...

The vulnerability of the Job Invocation component in the tfm-rubygem-foreman_ansible package allows a attacker to disclose confidential information.

The vulnerability of the Job Invocation component in the tfm-rubygem-foremanansible package is related to incorrect authentication. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose confidential information...

CVE-2025-20160: Improper Authentication

A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication. This vulnerability exists because the system does not properly check whether the required...

CVE-2025-9965

Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any application from/to the device.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 commit d0f97fd9...

CVE-2025-9965

The CVE-2025-9965 entry concerns Novakon P series devices (P – V2001.A.C518o2) with an improper authentication vulnerability that allows unauthenticated attackers to upload and download arbitrary applications to/from the device. The root cause is improper authentication on P series control interf...

CVE-2025-0672: Improper Authentication

An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may...

CVE-2025-9965: Improper Authentication

Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any application from/to the device.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 commit d0f97fd9...

CVE-2025-0663: Improper Authentication

A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. A single cryptographic key is used across all tenants to sign authentication cookies, allowing a privileged user in one tenant to forge authentication...

WordPress plugin Service Finder Bookings 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the getAuthToken function. An attacker can cause denial of service and compromise file integrity by performing a network-level man-in-the-middle attack that provides invalid data to the process. Remediation...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the getAuthToken function. An attacker can cause denial of service and compromise file integrity by performing a network-level man-in-the-middle attack that provides invalid data to the process. Remediation...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the getAuthToken function. An attacker can cause denial of service and compromise file integrity by performing a network-level man-in-the-middle attack that provides invalid data to the process. Remediation...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the getAuthToken function. An attacker can cause denial of service and compromise file integrity by performing a network-level man-in-the-middle attack that provides invalid data to the process. Remediation...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the Manager web UI endpoints /api/v1/jobs and /preheats. An attacker can gain unauthorized access to create, delete, or modify jobs, and initiate preheat jobs by sending unauthenticated requests to these...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the Manager web UI endpoints /api/v1/jobs and /preheats. An attacker can gain unauthorized access to create, delete, or modify jobs, and initiate preheat jobs by sending unauthenticated requests to these...