CVE-2019-0708

CVE-2019-0708 CVE-2019-0708 with Metasploit-Framework The CVE-2019-0708 vulnerability exploits a flaw in user authentication, allowing bypass of authentication without any interaction. It directly connects via the RDP protocol to send malicious code and execute commands on the server. If exploite...

CVE-2018-15473

CVE-2018-15473 OpenSSH 7.7 - Username Enumeration Method The attacker can try to authenticate a user with a malformed packet for example, a truncated packet, and: if the user is invalid it does not exist, then userauthpubkey returns immediately, and the server sends an SSH2MSGUSERAUTHFAILURE to t...

linux-explorer

This project is no longer maintained! Linux Expl0rer Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask. Capabilities ps View full process list Inspect process memory map & fetch memory strings easly Dump process memory in one click Automatically search hash in publi...

CVE-2018-10933

CVE-2018-10933 CVE-2018-10933 sshlib user authentication attack - docker lab, test and exploit...

CVE-2026-110972: Zakład Ubezpieczeń Społecznych Płatnik: Płatnik performs client-side authentication

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 334 in version 10.02.002...

Futurum Software User Authentication Module SQL injection vulnerability

Versions of the Futurum Software User Authentication Module prior to May 2026 contain an SQL injection vulnerability. This vulnerability stems from insufficient validation and sanitization of user-supplied input, as well as improper WAF configuration. It may allow unauthenticated attackers to...

PT-2026-129186

Name of the Vulnerable Software and Affected Versions @graphql-tools/executor-legacy-ws versions prior to 1.1.36 Description In the buildWSLegacyExecutor function within packages/executors/legacy-ws/src/index.ts, the executorConnectionParams object is retained in the closure scope after a...

Pagekit-CMS-vulnerable-to-SQL-Injection-in-user-authentication

Pagekit CMS $value if !isnumeric$key...

CVE-2026-73827

SOY Calendar is affected by a cross-site scripting (XSS) vulnerability that allows an arbitrary script to be executed in the web browser of a user who is logging into the product. The vulnerability requires low privileges and active user interaction , with a CVSS 3.0 base score of 5.4 (MEDIUM) an...

A Catalog of User Authentication Patterns

Security patterns are intended to support the design and development of secure software systems. However, although established catalogs of security patterns exist, their practical application remains limited. In particular, despite these catalogs, concrete patterns for common security controls su...

Linux Distros Unpatched Vulnerability : CVE-2026-68569

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticated even if the...

EulerOS 2.0 SP11 : libssh2 (EulerOS-SA-2026-3135)

According to the versions of the libssh2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauthpassword of the file...

EulerOS 2.0 SP15 : libssh2 (EulerOS-SA-2026-2936)

According to the versions of the libssh2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauthpassword of the file...

CVE-2026-18362

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...

CVE-2026-18362 DFIR-IRIS Missing Brute Force Protection in User Authentication

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...

CVE-2026-18362 DFIR-IRIS Missing Brute Force Protection in User Authentication

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...

CVE-2026-18362

CVE-2026-18362 concerns the IRIS web application (noted in version 2.4.26 and possibly other revisions) that does not protect user authentication against brute-force attacks. The connected sources confirm the affected software and the underlying issue but do not provide details on exploit vectors...

BIT-OPENBAO-2024-7594 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Vault’s SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and defaultuser fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to...

EulerOS Virtualization 2.10.1 : libssh2 (EulerOS-SA-2026-2827)

According to the versions of the libssh2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauthpassword of the fi...

CVE-2026-28314: Authorization Bypass Through User-Controlled Key

SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments...