CVE-2025-26635

Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network...

CVE-2025-26635

CVE-2025-26635 describes a Windows Hello security feature bypass caused by weak authentication, enabling an authorized attacker to bypass a security feature over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) yields a base score of 6.5 (Medium) with confidentiality and int...

Active Directory Certificate Services Elevation of Privilege Vulnerability

Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network...

SUSE CVE-2024-58036

Net::Dropbox::API 1.9 and earlier for Perl uses the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Net::Dropbox::API uses the Data::Random library which specifically states that it is "Useful mostly for test...

Siemens Industrial Edge Devices

SUMMARY Siemens Industrial Edge Devices contain a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Siemens has released new versions for several affected products and recommends to update to...

Siemens Industrial Edge Device Kit

SUMMARY Industrial Edge Device Kit contains a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Industrial Edge Device Builders integrate Industrial Edge Device Kit into their offerings...

CVE-2024-45551 Weak Authentication in HLOS

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass...

CVE-2024-45551 Weak Authentication in HLOS

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass...

CVE-2024-45551

CVE-2024-45551 targets Qualcomm closed‑source components (Gatekeeper) and describes a cryptographic issue during PIN/password verification. The vulnerability arises when RPMB writes can be dropped on verification failure, potentially enabling a user throttling bypass. The available sources confir...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to a weak Content Security Policy on the /proxy/ route. An attacker can bypass the CSP of the media proxy and execute arbitrary JavaScript when opening external images in a new tab or window. Note: This is...

The vulnerability of the microprogrammed software for ViewJet C-more Series sensor panels, which stems from the use of weak encryption algorithms, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the microprogrammed software for ViewJet C-more Series sensor panels is related to the use of weak encryption algorithms. Exploiting this vulnerability could allow an intruder to gain unauthorized access to protected information...

The vulnerability of the modTMSM component in the Trend Micro Apex Central security monitoring and management tool allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the modTMSM component in the Trend Micro Apex Central security management and monitoring tool is related to insufficient checking of incoming requests. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the modOSCE component of the Trend Micro Apex Central security monitoring and management tool allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the modOSCE component of the Trend Micro Apex Central security monitoring and management tool is related to insufficient checking of incoming requests. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected informatio...

CVE-2025-25211

Weak password requirements issue exists in CHOCO TEI WATCHER mini IB-MCT001 all versions. If this issue is exploited, a brute-force attack may allow an attacker unauthorized access and login...

CVE-2025-22938

Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords...

Drupal Access code 安全漏洞

Drupal Access code is a Drupal module for the Drupal community. A security vulnerability exists in Drupal Access code versions prior to 2.0.4, which stems from an improperly restricted authentication attempt that could lead to brute force cracking...

Over 1,500 PostgreSQL Servers Compromised in Fileless Cryptocurrency Mining Campaign

Exposed PostgreSQL instances are the target of an ongoing campaign designed to gain unauthorized access and deploy cryptocurrency miners. Cloud security firm Wiz said the activity is a variant of an intrusion set that was first flagged by Aqua Security in August 2024 that involved the use of a...

Brocade Fabric OS Remote Code Execution / Information Disclosure

Brocade Fabric OS versions prior to 9.2.2 suffer from 10 vulnerabilities including, but not limited to, remote code execution, information disclosure, man-in-the-middle, weak cryptography, and hardcoded key vulnerabilities. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory Information Titl...

Important: dotnet8.0

Issue Overview: Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network. CVE-2025-24070 Affected Packages: dotnet8.0 Issue Correction: Run dnf update dotnet8.0 --releasever 2023.7.20250331 to update your system. New Packages: aarch6...

Important: dotnet8.0

Issue Overview: Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network. CVE-2025-24070 Affected Packages: dotnet8.0 Issue Correction: Run dnf update dotnet8.0 --releasever 2023.7.20250331 or dnf update --advisory ALAS2023-2025-912...