Filtered by CWE-287
Filtered by vendor Subscriptions
Total 3824 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-3935 2025-04-29 8.1 High
ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys.  It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server.  The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior.  This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.
CVE-2025-4015 2025-04-29 5.3 Medium
A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. It has been rated as critical. Affected by this issue is the function list of the file novel-system/src/main/java/com/java2nb/system/controller/SessionController.java. The manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-4018 2025-04-29 5.3 Medium
A vulnerability, which was classified as critical, has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This issue affects the function addCrawlSource of the file novel-crawl/src/main/java/com/java2nb/novel/controller/CrawlController.java. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-4019 2025-04-29 7.3 High
A vulnerability, which was classified as critical, was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. Affected is the function genCode of the file novel-admin/src/main/java/com/java2nb/common/controller/GeneratorController.java. The manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2022-37774 1 Maarch 1 Maarch Rm 2025-04-29 5.3 Medium
There is a broken access control vulnerability in the Maarch RM 2.8.3 solution. When accessing some specific document (pdf, email) from an archive, a preview is proposed by the application. This preview generates a URL including an md5 hash of the file accessed. The document's URL (https://{url}/tmp/{MD5 hash of the document}) is then accessible without authentication.
CVE-2024-47218 2 Versoft, Vesoft 2 Nebulagraph Studio, Nebulagraph Database 2025-04-28 9.8 Critical
An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows bypassing authentication.
CVE-2022-40602 1 Zyxel 2 Lte3301-m209, Lte3301-m209 Firmware 2025-04-28 9.8 Critical
A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has been enabled by an authenticated administrator.
CVE-2025-22228 1 Redhat 1 Apache Camel Spring Boot 2025-04-26 7.4 High
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
CVE-2022-37931 1 Hp 1 Nonstop Netbatch-plus 2025-04-25 7.3 High
A vulnerability in NetBatch-Plus software allows unauthorized access to the application.  HPE has provided a workaround and fix. Please refer to HPE Security Bulletin HPESBNS04388 for details.
CVE-2022-36133 1 Epson 18 Tm-c3500, Tm-c3500 Firmware, Tm-c3510 and 15 more 2025-04-25 9.1 Critical
The WebConfig functionality of Epson TM-C3500 and TM-C7500 devices with firmware version WAM31500 allows authentication bypass.
CVE-2024-1735 1 Linecorp 1 Armeria 2025-04-25 9.1 Critical
A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentication. All users who rely on armeria-saml older than version 1.27.2 must upgrade to 1.27.2 or later.
CVE-2024-44843 1 Steve-community 1 Steve 2025-04-25 5.9 Medium
An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via supplying crafted OCPP requests.
CVE-2021-45036 1 Velneo 1 Vclient 2025-04-25 8.7 High
Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server.
CVE-2022-36960 1 Solarwinds 1 Orion Platform 2025-04-24 8.8 High
SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges.
CVE-2022-46411 1 Veritas 2 Access Appliance, Netbackup Flex Scale Appliance 2025-04-24 8.8 High
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. A default password is persisted after installation and may be discovered and used to escalate privileges.
CVE-2022-38336 1 Mobatek 1 Mobaxterm 2025-04-24 8.1 High
An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication.
CVE-2023-44752 1 Oretnom23 1 Student Study Center Desk Management System 2025-04-24 9.8 Critical
An issue in Student Study Center Desk Management System v1.0 allows attackers to bypass authentication via a crafted GET request to /php-sscdms/admin/login.php.
CVE-2022-43549 1 Veeam 1 Veeam Backup For Google Cloud 2025-04-24 9.8 Critical
Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms.
CVE-2022-43504 1 Wordpress 1 Wordpress 2025-04-24 5.3 Medium
Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.
CVE-2022-43900 1 Ibm 1 Websphere Automation For Ibm Cloud Pak For Watson Aiops 2025-04-23 5.3 Medium
IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.2 could provide a weaker than expected security. A local attacker can create an outbound network connection to another system. IBM X-Force ID: 240827.