273 matches found
PT-2025-30177 · Metasoft · Metacrm
Name of the Vulnerable Software and Affected Versions: Metasoft MetaCRM versions up to 6.4.2 Description: A critical issue exists in Metasoft MetaCRM. The vulnerability affects an unknown part of the /debug.jsp file and leads to improper authentication. The attack can be initiated remotely. The...
CVE-2025-53938
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Authentication Bypass vulnerability was identified in the /dao/verificarrecursoscargo.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows unauthenticated...
CVE-2025-6168
CVE-2025-6168 affects GitLab Enterprise Edition versions 18.0 before 18.0.4 and 18.1 before 18.1.2. The issue allows authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests. Descriptions in multiple sources (NVD, OSV, CIRCL, CVE lists) align on...
CVE-2025-42959 Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476
An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code HMAC credential, extracted from a system missing specific security patches, is reused in a replay attack against a different system. Even if the target system is fully patched, successful exploitation...
CVE-2025-6800
Marvell QConvergeConsole restoreESwitchConfig Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability...
CVE-2025-48952
NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentication logic allows users to bypass password verification using SHA-256 magic hashes, due to loose comparison in PHP. In vulnerable versions of the application, a password...
PT-2025-28100 · Huawei +1 · Harmonyos
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A vulnerability exists in the authentication mechanism of a distributed collaboration framework module. The successful exploitation of this issue may affect the confidentiality of the servic...
CVE-2025-45424
Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication...
PT-2025-27302 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns an authentication bypass in an online payment processing system. No further details are available regarding the technical aspects of the issue, such as API endpoints,...
CVE-2025-53013
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an invalid Linux Hello PIN, provided the host is offline. While the user gains access to th...
CVE-2025-53013 Himmelblau offline auth permits authentication with invalid Hello PIN
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an invalid Linux Hello PIN, provided the host is offline. While the user gains access to th...
CVE-2025-49825
Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch...
Authentication Bypass
Apache Tomcat is vulnerable to Authentication Bypass. The vulnerability is due to improper handling of resource mounting paths PreResources or PostResources in Apache Tomcat, which allows access to resources via alternate, unprotected paths...
CVE-2025-32879
An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to connect with the device via BLE if no other device is connected. While connected, none of the BLE services and characteristics of the device...
CVE-2024-50562
An Insufficient Session Expiration vulnerability CWE-613 in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session...
CVE-2025-49150
Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent...
CVE-2025-3461
The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. This issue affects Quantenna Wi-Fi chipset through versi...
PT-2025-24059
Name of the Vulnerable Software and Affected Versions Soar Cloud HRD Human Resource Management System versions prior to 7.3.2025.0408 Description A missing authentication for critical function vulnerability in the client application allows remote attackers to bypass authentication and access...
[SECURITY] [DLA 4195-1] krb5 security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4195-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès May 30, 2025 https://wiki.debian.org/LTS -...
