CWE-1390 vulnerabilities

CVE-2025-62844 is a medium severity vulnerability in QNAP Systems Inc. QuRouter affecting version 2.6.x. It involves weak authentication that could allow an attacker with local network access to gain sensitive information. The vulnerability has been fixed in QuRouter version 2.6.2.007 and later. There are no known exploits in the wild at this time.

Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.

Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions.

The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.

Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.

Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.

CVE-2025-57713 is a low-severity weak authentication vulnerability affecting QNAP Systems Inc. 's File Station 5, specifically versions 5.5.x prior to 5.5.6.5166. Remote attackers can exploit this flaw without privileges or user interaction to gain limited sensitive information. The vulnerability is classified under CWE-1390, indicating a weakness in authentication mechanisms. Although the CVSS score is low (1.

SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.

SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges.

A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing the users password. This vulnerability occurs when MFA is enabled but not completed within a 7-day period.

Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally.

Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.

Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.

A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced during device setup. A malicious actor can retrieve device identifiers with either physical access or by capturing identifiers from pictures of the devices posted on publicly accessible websites such as eBay.

Active Directory Certificate Services Elevation of Privilege Vulnerability

Windows Kerberos Elevation of Privilege Vulnerability

tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.