CVE-2025-46631: Improper Authentication

Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the router's OS by sending a /goform/telnet web request...

CVE-2025-4144: Improper Authentication

PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27...

CVE-2025-46630: Improper Authentication

Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable 'ate' a remote system management binary by sending a /goform/ate web request...

Improper Authentication

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Authentication. An attacker can circumvent required actions configured by an administrator such as...

CVE-2025-29906: Improper Authentication

Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the tty configuration directive that can bypass /bin/login, i.e., a user can log in as any user without authentication. This issue has been patched in version 4.1...

CVE-2025-46348: Improper Authentication

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated...

CVE-2025-3910: Improper Authentication

A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication...

CVE-2021-47664

Due to improper authentication mechanism an unauthenticated remote attacker can enumerate valid usernames...

CVE-2025-3850

A vulnerability, which was classified as problematic, has been found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This issue affects some unknown processing of the component API. The manipulation leads to improper authentication. The attack may be initiated remotely. The complexity of an attack is...

CVE-2025-2492

An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthorized execution of functions. Refer to the 'ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information...

Improper Authentication

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Improper Authentication due to improper enforcement of multi-factor authentication during the self-enrollment process. An attacker can bypass the intended security controls by exploiting this weakne...

Improper Authentication

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Improper Authentication due to improper handling of user session states during the multi-factor authentication process. An attacker can access sensitive information about other users by exploiting t...

Security Bulletin: Multiple vulnerabilities have been identified in Apache Solr shipped with IBM Operations Analytics - Log Analysis

Summary Multiple vulnerabilities in Apache Solr affect IBM Operations Analytics - Log Analysis. These have been addressed. Vulnerability Details CVEID:CVE-2024-45216 DESCRIPTION: Apache Solr could allow a remote attacker to bypass security restrictions, caused by improper authentication validatio...

Improper Authentication

rasapro is vulnerable to Improper Authentication. The vulnerability is due to voice connectors not properly implementing authentication, even when a token is configured in the credentials.yml file, allowing an attacker to submit voice data from an unauthenticated source...

CVE-2025-3627: Improper Authentication

A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using two-factor authentication 2FA...

CVE-2025-3634: Improper Authentication

A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes...

CVE-2021-47664 Enumeration of valid user names

Due to improper authentication mechanism an unauthenticated remote attacker can enumerate valid usernames...

CVE-2021-47664

CVE-2021-47664 describes an authentication issue that allows an unauthenticated remote attacker to enumerate valid usernames. The initial entry provides a CVSS v3.1 base score of 5.3 (Medium) with Network attack vector, Low attack complexity, and no privileges required. The connected sources reit...

CVE-2021-47664 Enumeration of valid user names

Due to improper authentication mechanism an unauthenticated remote attacker can enumerate valid usernames...

Franka Emika Robot 安全漏洞

Franka Emika Robot is a robot from the German company Franka. A security vulnerability exists in Franka Emika Robot that stems from an improper authentication mechanism that allows an unauthenticated, remote attacker to enumerate valid usernames...