Threats Tagged 'cwe-288'

Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.

Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.

A vulnerability in Wapt Server versions before 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restrictions by sending a specially crafted packet. This enables the attacker to retrieve a valid session token for a targeted account, potentially leading to unauthorized access.

An authentication bypass vulnerability exists in Check Point Security Management Server and Multi-Domain Security Management Server (MDS). This flaw could allow an unauthenticated remote attacker with network access to management services to execute arbitrary commands on the Security Management Server. Exploitation could lead to full compromise of the Security Management system. The issue was discovered internally by Check Point, and there is no indication of active exploitation at this time.

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity.