Threats Tagged 'cwe-303'

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database.

VMware vCenter in Cloud Foundation contains a critical authentication bypass vulnerability in the VMware Directory Service. This flaw allows an attacker with network access to bypass authentication and gain unauthorized access to the system. The vulnerability affects multiple versions of Cloud Foundation, including 5.x, 9.0.x.x, and 9.1.x.x. The vulnerability has a CVSS score of 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability. No official patch or remediation details are provided in the available data. There are no known exploits in the wild at this time.

Eclipse Jetty's Digest authentication server-side component encodes passwords using ISO-8859-1, which cannot represent characters outside this charset, such as Chinese, Cyrillic, or Greek. Password characters not representable in ISO-8859-1 are replaced with '?', allowing an attacker to craft a digest Authorization header with '?' characters that could match any password of the same length containing non-ISO-8859-1 characters. The recent HTTP Digest RFC-7616 supports a charset parameter defaulting to UTF-8, which allows correct encoding and decoding of passwords.

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to the scheduler webhook endpoint to execute all configured scheduled jobs or target a specific job, causing unintended execution of operator-defined commands under the web server process user.

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

This update includes the following RPMs: dotnet8.0: * aspnetcore-runtime-8.0-8.0.29-2.1.hum1 (aarch64, x86_64) * aspnetcore-runtime-dbg-8.0-8.0.29-2.1.hum1 (aarch64, x86_64) * aspnetcore-targeting-pack-8.0-8.0.29-2.1.hum1 (aarch64, x86_64) * dotnet-apphost-pack-8.0-8.0.29-2.1.hum1 (aarch64, x86_64) * dotnet-hostfxr-8.0-8.0.29-2.1.hum1 (aarch64, x86_64) * dotnet-runtime-8.0-8.0.29-2.1.hum1 (aarch64, x86_64) * dotnet-runtime-dbg-8.0-8.0.29-2.1.hum1 (aarch64, x86_64) * dotnet-sdk-8.0-8.0.129-2.1.hum1 (aarch64, x86_64) * dotnet-sdk-8.0-source-built-artifacts-8.0.129-2.1.hum1 (aarch64, x86_64) * dotnet-sdk-dbg-8.0-8.0.129-2.1.hum1 (aarch64, x86_64) * dotnet-targeting-pack-8.0-8.0.29-2.1.hum1 (aarch64, x86_64) * dotnet-templates-8.0-8.0.129-2.1.hum1 (aarch64, x86_64) * dotnet8.0-8.0.129-2.1.hum1.src (src) Security Fix(es): dotnet8.0: * CVE-2026-47304 * CVE-2026-50646 * CVE-2026-50649 * CVE-2026-50650