Login System Project 1.0 SQL Injection

============================================================================================================================================= | Title : Login System Project 1.0 Auth By Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 129.0.1 6...

CVE-2024-7503 WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover

The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of loose comparison of the activation code in the 'wooslgconfirmemailuser' function. This makes it possible for unauthenticated attackers to l...

CVE-2024-42062 Apache CloudStack: User Key Exposure to Domain Admins

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that...

Virtuozzo Hybrid Infrastructure 6.2 Hotfix 2 (6.2.0-142)

This update provides security and stability fixes. Vulnerability id: VSTOR-75009, VSTOR-76816, VSTOR-87057 Stability fixes for the hypervisor. Vulnerability id: VSTOR-87588 Fixed an issue with storage space calculation for the "Other" category in the "Logical space" chart in the admin panel...

Virtuozzo Hybrid Infrastructure 6.1 Update 1 Hotfix 5 (6.1.1-49)

This update provides security and stability fixes. Vulnerability id: VSTOR-75009, VSTOR-76816 Stability fixes for the hypervisor. Vulnerability id: VSTOR-85653, VSTOR-87742 Stability fixes for the chunk service. Vulnerability id: VSTOR-88832 A security fix for networks. Vulnerability id:...

LDAP Communication Error on XenMobile Device Manager

The following LDAP communication error appears on XenMobile Device Manager: javax.naming.CommunicationException: simple bind failed: xxxx-xxx-xxx.xxx.xxx.com:666Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed:...

CVE-2023-40702 PingOne MFA Integration Kit MFA bypass

PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate a...

CVE-2024-3603

The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osmmap' shortcode in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes such as 'theme'. This makes it possible...

U.S. Dept Of Defense: Restrict any user from Login to their account

A security vulnerability was discovered where an attacker could change their email address to the victim's email, effectively restricting the victim from accessing their account. The vulnerability stemmed from improper authentication on the "Update Profile" functionality of the website...

CVE-2024-5432 Lifeline Donation <= 1.2.6 - Authentication Bypass

The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.6. This is due to insufficient verification on the user being supplied during the checkout through the plugin. This makes it possible for unauthenticated attackers to log in as...

Use Of A Key Past Its Expiration Date

moodle/moodle is vulnerable to Use of a Key Past its Expiration Date. The vulnerability is caused due to improper key generation, as the same key is used interchangeably for a user's QR login key and their auto-login key. This allows an attacker to exploit the same key used interchangeably for a...

CVE-2024-38277

A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two...

CVE-2024-38277 moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys

A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two...

CVE-2024-37368

A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote system with FTView to send a packet to the customer’s server to view an HMI project. Due to the lack of proper authentication, this action is allowed without...

CVE-2024-37368

Summary (CVE-2024-37368) Rockwell Automation FactoryTalk View SE is affected by an improper authentication vulnerability that allows a remote user with FTView to send a packet from a remote system to view an HMI project. Affected product: FactoryTalk View SE, version v11.0 (confirmed by ICSA advi...

Toshiba e-STUDIO Security Vulnerability

Toshiba e-STUDIO is a series of high-end office multifunction printers from Toshiba Japan. A security vulnerability exists in Toshiba e-STUDIO that originates from an administrator authentication process that can be bypassed to access multifunction device system information and web pages for...

CVE-2024-29849: Veeam discloses Critical Vulnerability that allows attackers to bypass user authentication on its Backup Enterprise Manager web interface

On May 21, 2024, Veeam revealed a severe flaw across its Veeam Backup Enterprise Manager VBEM web interface that enables an unauthenticated attacker to log into the web interface as any user. Officially designated as CVE-2024-29849, the vulnerability presents a major threat with a CVSS V3 rating ...

Withdrawn Advisory: lunary-ai/lunary XSS in SAML metadata endpoint

Withdrawn Advisory This advisory has been withdrawn because the lunary npm package is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory. The underlying vulnerability report is still valid, but it doesn't affect...

Typo3 Information Disclosure in User Authentication

It has been discovered that login failures have been logged on the default stream with log level "warning" including plain-text user credentials...

GHSA-M96R-7VQM-J95G Typo3 Information Disclosure in User Authentication

It has been discovered that login failures have been logged on the default stream with log level "warning" including plain-text user credentials...