CVE-2024-33676

CVE-2024-33676 弱い認証と認可により、Enel X JuiceBox Level 2 EV充電器のオペレーティングシステムの機能やパラメータへのアクセスが可能になります。 説明 ローカルのEV充電器WLANネットワーク上のユーザーは、個人識別情報（PII）を抽出し、設定を変更し、オペレーティングシステムのファイルシステムを操作できます。これは、ポート2000上のローカルのGecko OSインターフェースの機能にアクセスすることで行われます。 この情報は2025年7月26日にBSides Albuquerqueで発表されました。スライドはこちらです。 製品詳細...

sj

sj Swagger Jacker sj is a command line tool designed to assist with auditing of exposed Swagger/OpenAPI definition files by checking the associated API endpoints for weak authentication. It also provides command templates for manual vulnerability testing. It does this by parsing the definition fi...

AttackTomcat

AttackTomcat 検出脆弱性リスト CVE-2017-12615 PUTファイルアップロード脆弱性 tomcat-pass-getshell 弱認証によるwarパッケージのデプロイ 弱いパスワードのブルートフォース CVE-2020-1938 Tomcat ファイル読み取り/インクルード 使用方法 初回使用前に、設定で設定ファイルを再設定してください。その他の問題はよくお読みください！！！、java -jar .jar で起動すると実行ログ情報を確認できます！！ ​ ソースコードをダウンロードしてMavenでコンパイルするか、直接Releasesをダウンロードしてください。 ​...

ls-poc

CVE-2026-30368 概念実証コード !IMPORTANT これはパッチ適用済みであり、現在は認証情報が必要です。回避策を使用して自分自身に対して操作を実行してください。 はじめに CVE-2026-30368 により、攻撃者は Lightspeed Classroom 管理の脆弱な認証の欠陥を介して生徒のデバイスを制御できます。 この POC（poc.js）は、LS Classroom 拡張機能のサービスワーカーをグローバルコンテキストで実行します。ワーカーは一部の機能で classroom.wasm も実行します。wasm-loader.js...

CVE-2025-70994

CVE-2025-70994: ヤデア T5 電動自転車における脆弱な認証 !WARNING このリポジトリは、教育および学術的なセキュリティ研究のみを目的として公開されています。ここで提供される情報と概念実証コードは、既知の暗号上の欠陥 CWE-1390 を実証し、車両の所有者とメーカーが物理的セキュリティを理解し改善することを支援するためのものです。 著者は、車両への不正アクセスや違法行為を容認、推奨、または支援するものではありません。概念実証コードは厳密にパッシブ信号アナライザ...

Weak Authentication

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Weak Authentication via the JWT authentication flow's email-based fallback lookup, which does not verify the emailverified claim before resolving a user identity. An attack...

CVE-2026-93355

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...

CVE-2026-93355

The LiteLLM platform is vulnerable to a weak JWT authentication flaw caused by an email-based fallback lookup that fails to verify the email_verified claim. An attacker with a valid JWT from a configured identity provider can authenticate as any existing user by using an unverified email address ...

EUVD-2026-88462

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...

CVE-2026-93355: Weak Authentication

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...

PT-2026-102338

Name of the Vulnerable Software and Affected Versions LiteLLM affected versions not specified Description A weak authentication issue exists in the JWT authentication flow. An attacker with a valid JSON Web Token JWT from the configured identity provider can authenticate as any existing user by...

CVE-2026-92288: Weak Authentication

Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. checkEndPointAuthenticationCredentials skips th...

BIT-DOTNET-SDK-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability

Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life EOL software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry...

BIT-DOTNET-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability

Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life EOL software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry...

BIT-ASPNET-CORE-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability

Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life EOL software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry...

sj v2.8.2

sj Swagger Jacker sj is a command line tool designed to assist with auditing of exposed Swagger/OpenAPI definition files by checking the associated API endpoints for weak authentication. It also provides command templates for manual vulnerability testing. It does this by parsing the definition fi...

CVE-2025-15679 BMC root account active without password on BullSequana XH3406 and XH3515

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...

CVE-2026-77483

Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-73025

Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-77483

CVE-2026-77483 affects Microsoft SQL Server and involves a weak authentication mechanism that allows an authorized attacker (low privileges required) to elevate privileges over a network . The CVSS 3.1 score is 8.8 (HIGH) with vectors for network attack, low complexity, no user interaction, and h...