73288 matches found
CVE-2026-64829
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...
CVE-2026-64829 Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...
EUVD-2026-47782
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...
CVE-2026-64829 Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...
CVE-2026-64829 Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...
CVE-2026-64829
CVE-2026-64829 affects Question2Answer up to version 1.8.8. The issue is a session invalidation bug in the forgot-password flow: the handler qa_finish_reset_user() does not clear the sessioncode, allowing a previously issued remember-me cookie to continue authenticating the account after a passwo...
tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...
tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...
CVE-2026-4773 OTP Bypass in Magarsus' IDM-MFA
Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10...
Malicious code in dev-helper-bg (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce930400319131adb4adf9f442340165a52a3ebd8320c497d1de05a3f896cac3 On import devhelper, devhelper/init.py calls startdecryptor at module top level, which spawns a daemon thread running decryptandrun. That function...
Malicious code in make-helper (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e6560048133cc76a9e325b02b2719f89d59c500d09409bb10b6f4afb14401 On import devhelper, the package's init.py starts a daemon thread that runs decryptor.decryptandrun: it fetches an AES-GCM key from the hardcoded...
SUSE-SU-2026:22895-1 Security update for python-cryptography
This update for python-cryptography fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-...
SUSE-SU-2026:22896-1 Security update for pam
This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290...
SUSE SLES12 Security Update : pam (SUSE-SU-2026:3162-1)
The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3162-1 advisory. This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290...
Plone 2.5.x < 2.5.2 Multiple Vulnerabilities
The version of Plone installed on the remote host is 2.5.x prior to 2.5.2. It is, therefore, affected by the following vulnerabilities: - Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other...
SUSE SLED15: pam / pam-32bit / pam-devel / pam-devel-32bit / pam-doc / pam-extra / etc (SUSE-SU-2026:3163-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3163-1 advisory. This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's...
Plone 2.0.x < 2.1.3 Insecure Access Control
The version of Plone installed on the remote host is 2.0.x prior to 2.1.3. It is, therefore, affected by an insecure access control due to not restricting access to the changeMemberPortrait, deletePersonalPortrait, and testCurrentPassword methods. An unauthenticated, remote attacker can exploit...
PT-2026-63532
Name of the Vulnerable Software and Affected Versions Eclipse Jetty affected versions not specified Description The Digest authentication server-side component and the DigestAuthentication.apply method in the HTTP client use ISO-8859-1 encoding to process passwords. Because ISO-8859-1 cannot...
Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...