CVE-2023-46096

A vulnerability has been identified in SIMATIC PCS neo All versions V4.1. The PUD Manager of affected products does not properly authenticate users in the PUD Manager web service. This could allow an unauthenticated adjacent attacker to generate a privileged token and upload additional documents...

CVE-2022-39238

Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules PAM for user authentication, if a user presented valid credentials but the account is disabled or otherwise not allowed to access the host such...

CVE-2020-8510

An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en user+perms+lang, one can login as any user without a password...

CVE-2017-1000106

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. Its SCM content REST API supports the pipeline creation and editing feature in Blue...

CVE-2005-2916

Linksys WRT54G 3.01.03, 3.03.6, 4.00.7, and possibly other versions before 4.20.7, does not verify user authentication until after an HTTP POST request has been processed, which allows remote attackers to 1 modify configuration using restore.cgi or 2 upload new firmware using upgrade.cgi...

CVE-2025-1671

The Academist Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.6. This is due to the academistmembershipcheckfacebookuser function not properly verifying a user's identity prior to authenticating them. This makes it possible for...

CVE-2025-24806

Authelia (open-source authentication server) has a flaw where allowing sign-in via both username and email can cause login events to be counted separately, effectively doubling regulation limits and increasing brute-force risk when two-factor is not enforced or passwords are weak. The issue has a...

PT-2024-15248 · WordPress · Login As User/Customer

Name of the Vulnerable Software and Affected Versions: Login as User or Customer WordPress plugin versions 3.8 and earlier Description: The issue allows users to log in as any other user on the site, potentially leading to complete administrator account takeover. It is crucial to keep WordPress...

CVE-2022-38385

IBM Cloud Pak for Security CP4S 1.10.0.0 through 1.10.2.0 could allow an authenticated user to obtain highly sensitive information or perform unauthorized actions due to improper input validation. IBM X-Force ID: 233777...

Password field not displayed for published apps in Windows Server 2019

When publishing any O365 app such as Excel or Word, users are prompted to authenticate to Office 365 to activate the app. Password field is not rendered when the app is published so users can never authenticate. This also occurs with RDP initial app. Microsoft has reproduced the issue with using...

[Full-Disclosure] Mdaemon 7.0.1 IMAP overflow.

Let it be known that this bug is after authentication "postauth" and therefore useless. In the current version of Mdaemon from ALTN there exists an easy to exploit, run-of-the-mill stack overflow. By authenticating and sending a large argument to the STATUS command in the IMAP component, a buffer...

DoS in NETFile FTP/Web Server

Donato Ferrante Application: Fastream NETFile FTP/Web Server http://www.fastream.com/ Version: 6.5.1.980 Bug: Denial Of Service Date: 19-Apr-2004 Author: Donato Ferrante e-mail: [email protected] web: www.autistici.org/fdonato...

WFTPD 2.4.1RC11 - STATLIST Denial of Service

WFTPD 2.4.1RC11 - STATLIST Denial of Service source: https://www.securityfocus.com/bid/1506/info WFTPD versions prior to 2.4.1RC11 suffer from a number of vulnerabilities. 1 Issuing a STAT command while a LIST is in progress will cause the ftp server to crash. 2 If the REST command is used to wri...