215 matches found
HTC
HTC | HackTheCCTV Credenciales de DVR expuestas | CVE-2018-9995 | El nombre de usuario de CCTV filtrado para obtener acceso de inicio de sesión Uso Open https://www.zoomeye.org/ Search With Keywod : /login.rsp $ python3 thecctv.py...
WordPress Security Optimizer - The All-In-One Protection Plugin plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password vulnerability
WordPress Security Optimizer - The All-In-One Protection Plugin plugin 1.6.5 - Login Access IP Allowlist Bypass via postpassword vulnerability discovered by Shivamani Vastrala in WordPress Plugin SiteGround Security versions 1.6.5...
CVE-2026-64940
Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...
Multiple vulnerabilities in NetKids iMark
Overview NetKids iMark provided by Integrated Systems Technologies, Inc. contains multiple vulnerabilities listed below: Uncontrolled search path element CWE-427 - CVE-2026-66344 Unquoted search path or element CWE-428 - CVE-2026-66839 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported...
EUVD-2026-46736
Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite component: PJM Command Center. The supported version that is affected is V16. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Project Manufacturing...
Oracle VM VirtualBox 安全漏洞
Oracle VM VirtualBox is a virtual machine management software developed by Oracle Corporation. Version 7.2.6 of Oracle VM VirtualBox contains a security vulnerability. This vulnerability stems from issues with the Core component, which may allow attackers with high privileges to log in and execut...
BIT-AUTHENTIK-2024-47070 authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header
authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding X-Forwarded-For header with an unparsable IP address, e.g. a. This results in a possibility of logging into any account with a known logi...
Security update for util-linux
This update for util-linux fixes the following issues: CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for "login -h" bsc1258859. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
SUSE-SU-2026:21016-1 Security update for util-linux
This update for util-linux fixes the following issues: Security issues: - CVE-2025-14104: heap buffer overread in setpwnam when processing 256-byte usernames bsc1254666. - CVE-2026-3184: access control bypass due to improper hostname canonicalization in login bsc1258859. Non security issues: -...
Security update for util-linux
This update for util-linux fixes the following issues: CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for "login -h" bsc1258859. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
openSUSE 15 Security Update : util-linux (SUSE-SU-2026:0856-1)
The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:0856-1 advisory. - CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for 'login -h' bsc1258859. Tenable has extracted the preceding description...
Security update for util-linux
This update for util-linux fixes the following issues: CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for "login -h" bsc1258859. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
openSUSE Security Advisory (SUSE-SU-2026:0803-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2026-28778 Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100
International Datacasting Corporation IDC SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the xd user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the xd user has write permissions to their home...
CVE-2025-70866
LavaLite CMS version 10.1.0 is vulnerable to Incorrect Access Control , which allows an authenticated user with low-level privileges (User role) to gain unauthorized access to the admin backend . The root cause is that the admin and user authentication guards share the same user provider without ...
SSH Key Persistence
This Metasploit module will add an SSH key to a specified user or all, to allow remote login via SSH at any time. No payload is required for this module to work. If an SSH key is not provided, a new 4096 bit RSA keypair will be generated. The private key will be stored as loot for later use...
CVE-2025-59091
CVE-2025-59091 affects the Kaba exos 9300 datapoint server used for relaying status information to Access Managers. The description across multiple sources indicates hard-coded credentials for four users that can sign in to the datapoint server on ports 1004/1005, enabling login to send/receive i...
CVE-2025-59091 Hardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300
Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the Access Managers. This information, among other things, is used to graphically...
Chainlit vulnerable to improper access restriction
Overview Chainlit provided by Chainlit contains the following vulnerability. Authorization bypass through user-controlled key CWE-639 - CVE-2025-68492 Shotaro Kimura of NRI SecureTechnologies, Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...
