CVE-2024-12869 Improper Authentication in infiniflow/ragflow

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed...

CVE-2024-12869

CVE-2024-12869 affects infiniflow/ragflow v0.12.0 and is caused by improper authentication that lets a user view another user’s invite list, exposing personal data (emails/usernames) and enabling privacy leakage. This aligns with reported impact (data leakage leading to phishing/spam risk). Some ...

CVE-2024-8053 Improper Authentication in open-webui/open-webui

In version v0.3.10 of open-webui/open-webui, the api/v1/utils/pdf endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading...

CVE-2024-8053 Improper Authentication in open-webui/open-webui

In version v0.3.10 of open-webui/open-webui, the api/v1/utils/pdf endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading...

PT-2025-12151

Name of the Vulnerable Software and Affected Versions infiniflow/ragflow version v0.12.0 Description The issue is related to improper authentication, allowing a user to view another user's invite list. This can lead to a privacy breach, exposing personal or private information such as email...

CVE-2025-22228: Improper Authentication

BCryptPasswordEncoder.matchesCharSequence,String will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same...

CVE-2024-12869: Missing Authentication for Critical Function

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed...

CVE-2025-2388

A vulnerability was found in Keytop 路内停车收费系统 2.7.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /saas/commonApi/park/getParks of the component API. The manipulation leads to improper authentication. The attack can be launched remotely...

CVE-2025-2395

The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter cookies to log in as an administrator...

CVE-2025-26475: Improper Authentication

Dell Secure Connect Gateway SCG 5.0 Appliance - SRS, versions 5.26, Enables Live-Restore setting which enhances security by keeping containers running during daemon restarts, reducing attack exposure, preventing accidental misconfigurations, and ensuring security controls remain active...

Dell Secure Connect Gateway（Dell SCG） 授权问题漏洞

Dell Secure Connect Gateway Dell SCG is a secure connectivity gateway from Dell, Inc. An authorization issue vulnerability exists in Dell Secure Connect Gateway Dell SCG versions prior to 5.28.00.14, which stems from the Live-Restore setting being enabled, and could lead to improper authenticatio...

CVE-2025-2339

A vulnerability was found in otale Tale Blog 2.0.5. It has been classified as problematic. This affects an unknown part of the file /%61dmin/api/logs. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public an...

CVE-2025-30116: Improper Authentication

An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Remotely Dumping of Video Footage and the Live Video Stream can occur. It allows remote attackers to access and download recorded video footage from the SD card via port 9091. Additionally, attackers can connect to port 90...

CVE-2025-2388

A vulnerability was found in Keytop 路内停车收费系统 2.7.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /saas/commonApi/park/getParks of the component API. The manipulation leads to improper authentication. The attack can be launched remotely...

CVE-2025-2388 Keytop 路内停车收费系统 API getParks improper authentication

A vulnerability was found in Keytop 路内停车收费系统 2.7.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /saas/commonApi/park/getParks of the component API. The manipulation leads to improper authentication. The attack can be launched remotely...

CVE-2025-2388 Keytop 路内停车收费系统 API getParks improper authentication

A vulnerability was found in Keytop 路内停车收费系统 2.7.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /saas/commonApi/park/getParks of the component API. The manipulation leads to improper authentication. The attack can be launched remotely...

CVE-2025-2388

The CVE-2025-2388 entry concerns Keytop 路内停车收费系统 2.7.1. A vulnerability in the API endpoint /saas/commonApi/park/getParks leads to improper authentication. The issue is exploitable remotely, and the exploit has been disclosed publicly. No remediation or patch details are provided in the available...

Improper Authentication

Ratify is vulnerable to Improper Authentication. The vulnerability is due to insufficient registry validation due to the Azure authentication providers failing to verify that the target registry is an Azure Container Registry ACR before exchanging an Entra ID EID token, potentially exposing token...

CVE-2025-2395

The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter cookies to log in as an administrator...

CVE-2025-2395

The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter cookies to log in as an administrator...