Total
1490 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-22069 | 1 Oracle | 1 Weblogic Server | 2025-03-06 | 9.8 Critical |
| Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2024-31525 | 2025-03-06 | 7.2 High | ||
| Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain complete access to the system as the authorization mechanism is not validated on the server side and only on the client side. This can result, for example, in creating a new admin user in the system which enables persistent access for the attacker as an administrator. | ||||
| CVE-2020-26942 | 1 Axigen | 1 Axigen Mail Server | 2025-03-05 | 9.1 Critical |
| An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a setAdminPassword operation request, subsequently setting a new arbitrary password for the admin account. | ||||
| CVE-2023-27290 | 1 Ibm | 1 Observability With Instana | 2025-03-05 | 9.1 Critical |
| Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write access. IBM X-Force ID: 248737. | ||||
| CVE-2025-24924 | 2025-03-05 | 9.8 Critical | ||
| Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username | ||||
| CVE-2025-24865 | 1 Myscada | 1 Mypro | 2025-03-04 | 10 Critical |
| The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password. | ||||
| CVE-2023-21743 | 1 Microsoft | 1 Sharepoint Server | 2025-02-28 | 5.3 Medium |
| Microsoft SharePoint Server Security Feature Bypass Vulnerability | ||||
| CVE-2023-40598 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2025-02-28 | 8.5 High |
| In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance. | ||||
| CVE-2023-37373 | 1 Siemens | 1 Ruggedcom Crossbow | 2025-02-27 | 5.3 Medium |
| A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications accept unauthenticated file write messages. An unauthenticated remote attacker could write arbitrary files to the affected application's file system. | ||||
| CVE-2023-4516 | 1 Schneider-electric | 1 Interactive Graphical Scada System | 2025-02-27 | 7.8 High |
| A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allow a local attacker to change update source, potentially leading to remote code execution when the attacker force an update containing malicious content. | ||||
| CVE-2022-25770 | 1 Acquia | 1 Mautic | 2025-02-27 | 7.8 High |
| Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable. | ||||
| CVE-2023-24526 | 1 Sap | 1 Netweaver Application Server Java | 2025-02-27 | 5.3 Medium |
| SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user identity, resulting in escalation of privileges. This failure has a low impact on confidentiality of the data such that an unassigned user can read non-sensitive server data. | ||||
| CVE-2023-25589 | 1 Arubanetworks | 1 Clearpass Policy Manager | 2025-02-27 | 9.8 Critical |
| A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to create arbitrary users on the platform. A successful exploit allows an attacker to achieve total cluster compromise. | ||||
| CVE-2023-27060 | 1 Lightcms Project | 1 Lightcms | 2025-02-26 | 9.8 Critical |
| LightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerability via the image:make function. | ||||
| CVE-2023-28470 | 1 Couchbase | 1 Couchbase Server | 2025-02-24 | 5.3 Medium |
| In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication. | ||||
| CVE-2022-26925 | 1 Microsoft | 17 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 14 more | 2025-02-24 | 8.1 High |
| Windows LSA Spoofing Vulnerability | ||||
| CVE-2024-54176 | 2025-02-22 | 4.3 Medium | ||
| IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 and IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14 and 7.3 through 7.3.2 could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function. | ||||
| CVE-2024-8584 | 1 Learningdigital | 1 Orca Hcm | 2025-02-21 | 9.8 Critical |
| Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in. | ||||
| CVE-2024-28179 | 1 Jupyter | 1 Jupyter Server Proxy | 2025-02-21 | 9.1 Critical |
| Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing unauthenticated access to anyone who had network access to the Jupyter server endpoint. This vulnerability can allow unauthenticated remote access to any websocket endpoint set up to be accessible via Jupyter Server Proxy. In many cases, this leads to remote unauthenticated arbitrary code execution, due to how affected instances use websockets. The websocket endpoints exposed by `jupyter_server` itself is not affected. Projects that do not rely on websockets are also not affected. Versions 3.2.3 and 4.1.1 contain a fix for this issue. | ||||
| CVE-2022-34858 | 1 Miniorange | 1 Oauth 2.0 Client For Sso | 2025-02-20 | 9.8 Critical |
| Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress. | ||||