146 matches found
CVE-2025-51092
The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The functions logIn and signUp build queries by directly concatenating user input and unvalidated table names without using prepared statements. While a prepareDat...
PT-2025-29719
Name of the Vulnerable Software and Affected Versions Eclipse GlassFish versions 7.0.16 and earlier Description Eclipse GlassFish is susceptible to login brute-force attacks due to the absence of restrictions on the number of failed login attempts. Recommendations Apply a configuration to limit t...
PT-2025-27790 · Unknown · Epc2 Windows
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue allows the device to automatically log in the EPC2 Windows user during startup without requesting a password. Recommendations: At the moment, there is no information about a newer...
CVE-2024-12226
In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was identified in Version 2 however it was determined that this could also be achieved in Version 1 and the fix was applied to both versions...
CVE-2025-47789
Horilla is an open-source HRMS affected in versions up to 1.3 where a crafted URL can redirect users to an external domain after login, enabling open redirection to arbitrary sites (e.g., phishing). The issue is tied to commit 1c72404df6888bb23af73c767fdaee5e6679ebd6, which fixes the vulnerabilit...
CVE-2024-11087
The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This make...
AZL-58986 CVE-2022-49535 affecting package kernel for versions less than 5.15.182.1-1
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI If lpfcissueelsflogi fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure...
WordPress Crypto plugin <= 2.18 - Authentication Bypass via log_in vulnerability
Authentication Bypass via login vulnerability discovered by István Márton in WordPress Plugin Crypto versions = 2.18...
GHSA-JW9C-MFG7-9RX2 SAML authentication bypass via Incorrect XPath selector
Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrar...
CVE-2024-45409 The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML...
Authentication Bypass By Spoofing
Apache SeaTunnel is vulnerable to Authentication Bypass by Spoofing. The vulnerability is due to a hardcoded JWT key in the application, allowing an attacker to forge any token to log in as any user...
CVE-2024-41611
In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely to the Telnet service and perform arbitrary commands...
CVE-2024-1573
Missing Authentication for Critical Function vulnerability in the mobile monitoring feature of Mitsubishi Electric GENESIS64 versions 10.97.2 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.2 and prior, Mitsubishi Electric Hyper Historian versions 10.97.2 and prior, Mitsubishi Electri...
CVE-2024-6295
CVE-2024-6295 concerns the udn News Android APP, where the app stores the unencrypted user session in the local database after login. The connected CNNVD entry specifies that versions prior to 4.20.1 are affected, enabling a malicious app or an attacker with physical access to retrieve the sessio...
CVE-2024-6295 udn News App - Insecure Data Storage
udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an attacker with physical access to the Android device can retrieve this session and use it to log into the news APP and other services provided by udn...
CVE-2024-3080
Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device...
GHSA-5R8W-66HQ-RC39 silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled
If remember me is on and users log in with the box checked, if the developer then disabled "remember me" function, any pre-existing cookies will continue to authenticate users...
PT-2024-40391 · Packagist · Silverstripe/Framework
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue arises after a password reset, where the ChangePasswordForm::doChangePassword function logs in the user without checking Member::canLogIn. This...
