GHSA-WP76-GG32-8258 Parse Server exposes auth data via verify password endpoint

Impact The verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who knows a user's password can extract the MFA secret to generate valid MFA codes, defeating multi-factor authentication protection. Patch...

Parse Server exposes auth data via verify password endpoint

Impact The verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who knows a user's password can extract the MFA secret to generate valid MFA codes, defeating multi-factor authentication protection. Patch...

PT-2026-28610

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.63 Parse Server versions prior to 9.7.0-alpha.7 Description The verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attack...

CVE-2026-32702 Cleanuparr has Username Enumeration via Timing Attack

Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. From 2.7.0 to 2.8.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by...

CVE-2023-47435

An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected pages...

PT-2024-13451 · Unknown · Hexo-Theme-Matery

Name of the Vulnerable Software and Affected Versions: hexo-theme-matery version 2.0.0 Description: The issue lies in the verifyPassword function, allowing attackers to bypass authentication and access password-protected pages. Recommendations: For hexo-theme-matery version 2.0.0, as a temporary...

CVE-2024-24279

An issue in secdiskapp 1.5.1 management program for NewQ Fingerprint Encryption Super Speed Flash Disk allows attackers to gain escalated privileges via vsVerifyPassword and vsSetFingerPrintPower functions...

CVE-2022-22323

IBM Security Identity Manager IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x is vulnerable to a denial of service, caused by a heap-based buffer overflow in the Password Synch Plug-in. An authenticated attacker could exploit this vulnerability to cause a denial of servic...

Heap overflow

IBM Security Identity Manager IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x is vulnerable to a denial of service, caused by a heap-based buffer overflow in the Password Synch Plug-in. An authenticated attacker could exploit this vulnerability to cause a denial of servic...

ShaadiClone 2.0 Add Administrator

ShaadiClone v2.0 addadminmembercode.php Add Admin function validateform ifform.name.value == "" || !isNaNform.username.value alert"Please enter your name correctly."; form.username.focus; return false; ifform.name.value == "" || !isNaNform.fname.value alert"Please enter your name correctly.";...

Fedora Core 9 FEDORA-2009-1519 (python-fedora)

The remote host is missing an update to python-fedora announced via advisory FEDORA-2009-1519. OpenVAS Vulnerability Test $Id: fcore20091519.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-1519 python-fedora Authors: Thomas Reinke Copyright: Copyrig...