Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabExplore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Recent security developmentsWeak Authentication vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Authentication Abuse.This issue affects Broadcast Live Video: from n/a through 7.3.15.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Microsoft Configuration Manager allows an unauthorized attacker to disclose information over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Windows Storage allows an authorized attacker to elevate privileges locally.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Windows Language Experience Service allows an authorized attacker to perform tampering locally.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Windows State Repository Service allows an authorized attacker to perform tampering locally.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application. The security update addresses the vulnerability by correcting the way that WER handles and executes files.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Windows AppContainer allows an authorized attacker to disclose information locally.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Windows App Readiness Service allows an authorized attacker to perform tampering locally.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC Process Historian 2022 (All versions), SIMATIC WinCC Runtime Professional V17 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC Runtime Professional V20 (All versions), SIMATIC WinCC Runtime Professional V21 (All versions), SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected systems do not properly secure their remote user authentication with the deprecated NTLM protocol. This could allow unauthenticated remote attackers, who have achieved a machine in the middle position, to relay NTLM authentication and impersonate a legitimate user. The potential impact depends on the services that are accessible, e.g. a SQL server used by WinCC.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication Abuse.This issue affects WPBruiser {no- Captcha anti-Spam}: from n/a through 3.6.2.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 42569, Acronis Cyber Protect 17 (Windows) before build 42587.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
