CVE-2025-2746

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through...

CVE-2025-2746

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through...

Missing Critical Step in Authentication

Overview Kentico.Xperience.Libraries is a package for libraries and applications that use Kentico Xperience API. Affected versions of this package are vulnerable to Missing Critical Step in Authentication due to improper handling of empty SHA1 usernames in digest authentication, when the Staging...

CVE-2025-2746 Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through...

CVE-2025-2746

CVE-2025-2746 – Kentico Xperience Staging Service authentication bypass : Affected product is Kentico Xperience (CMS) up to version 13.0.172. The vulnerability is an authentication bypass in the Staging Service that handles passwords for the Staging Sync Server using digest authentication with em...

CVE-2024-9216 Authentication Bypass in gaizhenbiao/ChuanhuChatGPT

An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat history. The vulnerability arises because the username is provided via an HTTP request from the client side, rather than being read from a secu...

CVE-2020-29010

An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay allow remote authenticated actors to read the SSL VPN events log entries of users in other VDOMs by executing "get vpn ssl monitor" from the CLI. The sensiti...

CVE-2025-25381

Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information such as usernames and passwords...

CVE-2025-25381

CVE-2025-25381 affects the KSRTC AWATAR Android app (KSRTC Karnataka) with insecure plaintext storage of sensitive user data in SharedPreferences. The connected exploit documentation alleges plaintext credentials and personal data stored in shared_prefs, exposing users to device compromise if an ...

KSRTC AWATAR 访问控制错误漏洞

KSRTC AWATAR is an online bus ticket booking application of Karnataka State Road Transport KSRTC Corporation, India. A security vulnerability exists in KSRTC AWATAR v1.3.0, which stems from improper access control and could lead to viewing sensitive information such as usernames and passwords...

CVE-2025-25381

Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information such as usernames and passwords...

CVE-2025-25381

Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information such as usernames and passwords...

Linux Distros Unpatched Vulnerability : CVE-2020-35512

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free flaw was found in D-Bus Development branch = 1.13.16, dbus-1.12.x stable branch = 1.12.18, and dbus-1.10.x and older branches = 1.10.30 when a...

Linux Distros Unpatched Vulnerability : CVE-2020-13776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root...

The vulnerability of the PAM module pam_cap.so from the libcap library allows a hacker to elevate their privileges.

The vulnerability of the PAM module pamcap.so from the libcap library is related to deficiencies in access control due to incorrect identification of user names. Exploiting this vulnerability can allow attackers to increase their privileges...

XOne Web Monitor 安全漏洞

XOne Web Monitor is a monitoring dashboard from XOne. A security vulnerability exists in XOne Web Monitor version v02.10.2024.530, which stems from the presence of a SQL injection vulnerability that allows an attacker to steal all usernames and passwords via specially crafted input...

CVE-2024-54820

XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerability allows attackers to extract all usernames and passwords via a crafted input...

CVE-2024-54961

Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and email addresses of all current users...

CVE-2024-54961

Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and email addresses of all current users...

CVE-2024-13609

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data includi...