KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code…
Błędna implementacja algorytmu uwierzytelniania w Ivanti vTM pozwala na ominięcie uwierzytelnienia panelu admina.
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
Obejście uwierzytelnienia w Ivanti EPMM umożliwia nieautoryzowany dostęp do zasobów aplikacji.
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control.…
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
Obejście uwierzytelnienia w FortiOS umożliwia nieautoryzowanym atakującym dostęp do interfejsu administracyjnego.
A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC…
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2,…
Obejście uwierzytelnienia w PAN-OS pozwala nieautoryzowanemu atakującemu uzyskać uprawnienia administratora.
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to…
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
Obejście uwierzytelnienia w SmarterMail umożliwia przejęcie konta administratora.
Obejście uwierzytelnienia w cPanel i WHM umożliwia zdalnym atakującym dostęp do panelu.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability,… | ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems. |
Pilne działanie | 10,0 | 99,98 % | ||
| A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows… | A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code… |
Pilne działanie | 10,0 | 99,54 % | ||
| Błędna implementacja algorytmu uwierzytelniania w Ivanti vTM pozwala na ominięcie uwierzytelnienia panelu admina. | Błędna implementacja algorytmu uwierzytelniania w Ivanti vTM pozwala na ominięcie uwierzytelnienia panelu admina. |
Pilne działanie | 9,8 | 100 % | ||
| An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or… | An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier. |
Pilne działanie | 9,8 | 100 % | ||
| Obejście uwierzytelnienia w Ivanti EPMM umożliwia nieautoryzowany dostęp do zasobów aplikacji. | Obejście uwierzytelnienia w Ivanti EPMM umożliwia nieautoryzowany dostęp do zasobów aplikacji. |
Pilne działanie | 9,8 | 100 % | ||
| This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). | This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control.… |
Pilne działanie | 9,8 | 100 % | ||
| The identity authentication bypass vulnerability found in some Dahua products during the login process. | The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. |
Pilne działanie | 9,8 | 99,99 % | ||
| In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible | In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible |
Pilne działanie | 9,8 | 99,99 % | ||
| Obejście uwierzytelnienia w FortiOS umożliwia nieautoryzowanym atakującym dostęp do interfejsu administracyjnego. | Obejście uwierzytelnienia w FortiOS umożliwia nieautoryzowanym atakującym dostęp do interfejsu administracyjnego. |
Pilne działanie | 9,8 | 99,98 % | ||
| A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version… | A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication. |
Pilne działanie | 9,8 | 99,98 % | ||
| CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy… | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC… |
Pilne działanie | 9,8 | 99,97 % | ||
| A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass… | A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. |
Pilne działanie | 9,8 | 99,95 % | ||
| In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible | In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible |
Pilne działanie | 9,8 | 99,94 % | ||
| Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in… | Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2,… |
Pilne działanie | 9,8 | 99,87 % | ||
| Obejście uwierzytelnienia w PAN-OS pozwala nieautoryzowanemu atakującemu uzyskać uprawnienia administratora. | Obejście uwierzytelnienia w PAN-OS pozwala nieautoryzowanemu atakującemu uzyskać uprawnienia administratora. |
Pilne działanie | 9,8 | 99,86 % | ||
| Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without… | Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. |
Pilne działanie | 9,8 | 99,83 % | ||
| An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version… | An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older. |
Pilne działanie | 9,8 | 99,8 % | ||
| The identity authentication bypass vulnerability found in some Dahua products during the login process. | The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. |
Pilne działanie | 9,8 | 99,59 % | ||
| The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows… | The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to… |
Pilne działanie | 9,8 | 99,39 % | ||
| telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. |
Pilne działanie | 9,8 | 98,98 % | ||
| Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code… | Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. |
Pilne działanie | 9,8 | 98,96 % | ||
| In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to… | In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability. |
Pilne działanie | 9,8 | 97,48 % | ||
| An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password… | An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178. |
Pilne działanie | 9,8 | 97,17 % | ||
| Obejście uwierzytelnienia w SmarterMail umożliwia przejęcie konta administratora. | Obejście uwierzytelnienia w SmarterMail umożliwia przejęcie konta administratora. |
Pilne działanie | 9,8 | 96,54 % | ||
| Obejście uwierzytelnienia w cPanel i WHM umożliwia zdalnym atakującym dostęp do panelu. | Obejście uwierzytelnienia w cPanel i WHM umożliwia zdalnym atakującym dostęp do panelu. |
Pilne działanie | 9,3 | 98,53 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.