Authentication bypass.

Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass

Windows Shell Spoofing Vulnerability

• Microsoft Windows 11 version 23H2
• Microsoft Windows 11 Version 24H2
• Authentication bypass

Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability

• Microsoft Windows 11 version 23H2
• Microsoft Windows 11 Version 24H2
• Authentication bypass

Windows NTFS Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass

Windows Notification Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• Authentication bypass

Windows DHCP Server Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass

Windows Error Reporting Tampering Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass

Microsoft PowerToys Tampering Vulnerability

• Microsoft PowerToys
• Authentication bypass

Windows Modern Device Management (MDM) Tampering Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows Server 2019
• Authentication bypass

Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Authentication bypass

Windows Credential Guard Spoofing Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• Authentication bypass

Windows Health and Optimized Experiences Service Information Disclosure Vulnerability

• Microsoft Windows 11 Version 24H2
• Microsoft Windows 11 Version 25H2
• Authentication bypass

Dynamics Business Central Information Disclosure Vulnerability

• Microsoft Dynamics NAV 2018
• Authentication bypass

Missing authentication for critical function in Swann Communications SWIFI-SE2KIC

• Swann Communications SWIFI-SE2KIC
• Authentication bypass

Missing authentication for critical function in Swann Communications SWIFI-SE2KIC

• Swann Communications SWIFI-SE2KIC
• Authentication bypass

Missing authentication for critical function in Swann Communications SWIFI-SE2KIC

• Swann Communications SWIFI-SE2KIC
• Authentication bypass

Remote Code Execution (RCE) vulnerability identified in the OpenText™ EnCase SAFE Agents

• OpenText Endpoint Investigator
• OpenText Endpoint Forensics & Response
• Authentication bypass

fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail

• fushengqian fuint
• Authentication bypass

oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints

• FJ-OMS oms-erp
• Authentication bypass

Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token

• ikaros
• Authentication bypass

RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page

• Zarestia-Dev rclone-manager
• Authentication bypass

Missing authentication in Ivanti Xtraction

• Ivanti Xtraction
• Authentication bypass

BUG-000187331 Portal for ArcGIS has a security vulnerability

• Esri Portal for ArcGIS
• Authentication bypass

Authentication bypass by spoofing in Ivanti Connect Secure

• Ivanti Connect Secure
• Authentication bypass

Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models

• NETGEAR RAX30
• NETGEAR RAX29
• Authentication bypass

MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery

• IBM mcp-context-forge
• Authentication bypass
• Hard-coded credentials

CVFS Missing Authentication

• Commvault Cloud
• Commvault Grid(HSX) CVFS
• Authentication bypass

1732E ArmorBlock® - Multiple Vulnerabilities

• Rockwell Automation 1732E ArmorBlock® I/O
• Authentication bypass

IBM WebSphere Application Server is affected by a bypass authentication vulnerability

• IBM WebSphere Application Server
• Authentication bypass

IBM WebSphere Application Server is affected by an authorization bypass

• IBM WebSphere Application Server
• Authentication bypass

Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition

• wazuh-manager
• Authentication bypass

Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token

• wazuh-manager
• Authentication bypass

FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard

• FreeRDP
• Authentication bypass

Missing authentication in NVIDIA NVSentinel

• NVIDIA NVSentinel
• Authentication bypass

Missing authentication in NVIDIA AIStore framework

• NVIDIA AIStore framework
• Authentication bypass

Missing Authentication Vulnerability in JTL-WMS

• JTL SW GmbH JTL-WMS
• Authentication bypass

AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication

• AdithyaYelloju Restaurant-Management-System
• Authentication bypass

SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication

• SourceCodester Human Resource Management System
• Authentication bypass

Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints

• Rapid7 Metasploit Framework
• Authentication bypass

An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.

• Authentication bypass

IBM i Information Disclosure

• i
• Authentication bypass

IBM Planning Analytics Local is affected by security vulnerabilities

• IBM Planning Analytics
• Authentication bypass

IBM Planning Analytics Local is affected by security vulnerabilities

• IBM Planning Analytics
• Authentication bypass

Frappe before 13.32.0 Weak Authentication via Print View Key

• frappe
• Authentication bypass

Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE

• Fire-Boltt BSW013
• Authentication bypass

Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection

• Fire-Boltt BSW013
• Authentication bypass

Netherman Portal del Hermano Account Takeover via Password Reset Oracle

• NetHerman Portal del Hermano (portaldelhermano.es)
• Authentication bypass
• CWE-640

Apache Allura: Oauth1 Replay Attack

• Apache Software Foundation Apache Allura
• Authentication bypass

Missing authentication in HAProxy Data Plane API EE and others

• HAProxy Data Plane API EE
• HAProxy Data Plane API CE
• Authentication bypass

KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication

• KusalkaSilva Learning-Management-System
• Authentication bypass

Improper Kerberos server verification in Progress MarkLogic Server

• Progress Software Corporation MarkLogic Server
• Authentication bypass

Netcore NR268 CGI Execution user_ok improper authentication

• Netcore NR268
• Authentication bypass

Improper authentication in Progress MarkLogic Server SAML processing

• Progress Software Corporation MarkLogic Server
• Authentication bypass
• Weak cryptography or TLS

ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion

• zitadel
• Authentication bypass

ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1

• zitadel
• Authentication bypass

Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens

• heym
• Authentication bypass

SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method

• surrealdb
• Authentication bypass

Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass

• getgrav grav-plugin-api
• Authentication bypass

Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie

• getgrav grav-plugin-login
• Authentication bypass

Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form

• getgrav grav-plugin-login
• Authentication bypass