Common Weakness Enumeration

CWE-305

Allowed

Authentication Bypass by Primary Weakness

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

322 vulnerabilities reference this CWE, most recent first.

GHSA-56WX-66PX-9J66

Vulnerability from github – Published: 2025-05-13 21:34 – Updated: 2025-05-13 21:34
VLAI
Summary
OPKSSH Vulnerable to Authentication Bypass
Details

Impact

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.

Patches

The vulnerability does not exist in more recent versions of OPKSSH. his only impacts OPKSSH when used to verify ssh keys on a server, the OPKSSH client is unaffected. To remediate upgrade to a version of OPKSSH v0.5.0 or greater.

To determine if you are vulnerable run on your server:

opkssh --version

If the version is less than 0.5.0 you should upgrade. To upgrade to the latest version run:

wget -qO- "https://raw.githubusercontent.com/openpubkey/opkssh/main/scripts/install-linux.sh" | sudo bash

References

CVE-2025-4658

The upstream vulnerability in OpenPubkey is CVE-2025-3757 and has the security advisory https://github.com/openpubkey/openpubkey/security/advisories/GHSA-537f-gxgm-3jjq

Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openpubkey/opkssh"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-4658"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-305"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-13T21:34:58Z",
    "nvd_published_at": "2025-05-13T17:16:04Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nVersions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.\n\n### Patches\n\nThe vulnerability does not exist in more recent versions of OPKSSH. his only impacts OPKSSH  when used to verify ssh keys on a server, the OPKSSH client is unaffected. To remediate upgrade to a version of OPKSSH v0.5.0 or greater.\n\nTo determine if you are vulnerable run on your server:\n\n```bash\nopkssh --version\n```\n\nIf the version is less than 0.5.0 you should upgrade. To upgrade to the latest version run:\n\n```bash\nwget -qO- \"https://raw.githubusercontent.com/openpubkey/opkssh/main/scripts/install-linux.sh\" | sudo bash\n``` \n\n\n### References\n\n[CVE-2025-4658](https://www.cve.org/CVERecord?id=CVE-2025-4658)\n\nThe upstream vulnerability in OpenPubkey is [CVE-2025-3757](https://www.cve.org/CVERecord?id=CVE-2025-3757) and has the security advisory https://github.com/openpubkey/openpubkey/security/advisories/GHSA-537f-gxgm-3jjq",
  "id": "GHSA-56wx-66px-9j66",
  "modified": "2025-05-13T21:34:58Z",
  "published": "2025-05-13T21:34:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openpubkey/opkssh/security/advisories/GHSA-56wx-66px-9j66"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4658"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openpubkey/opkssh"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OPKSSH Vulnerable to Authentication Bypass "
}

GHSA-59M6-82QM-VQGJ

Vulnerability from github – Published: 2023-07-21 20:17 – Updated: 2023-07-21 20:17
VLAI
Summary
Dapr API token authentication bypass in HTTP endpoints
Details

Summary

A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request.

Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 and 1.11.2.

Impact

This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the dapr-api-token in the request is invalid or missing.

Patches

The issue has been fixed in Dapr 1.10.9 and 1.11.2.

Details

When API token authentication is enabled, Dapr requires all calls from applications to include the dapr-api-token header, with a value matching what's included in the Dapr's configuration. In order to allow for healthchecks to work, the /v1.0/healthz and /v1.0/healthz/outbound HTTP APIs are excluded from the API token authentication check, and are always allowed.

Dapr <= 1.10.8 and <= 1.11.1 implemented the allowlisting of the healthcheck endpoints by permitting all requests whose URL contains /healthz to bypass the API token authentication check. The match applied anywhere in the URL, including the querystring.

As a consequence, attackers were able to bypass API token authentication by including /healthz anywhere in the URL, including as a querystring parameter. This allowed attackers to invoke any Dapr API using HTTP, including perform service invocation.

Proof of Concept

``` $ curl -v http://localhost:3500/v1.0/metadata * Trying ::1:3500... * Connected to localhost (::1) port 3500 (#0)

GET /v1.0/metadata HTTP/1.1 Host: localhost:3500 User-Agent: curl/7.74.0 Accept: /

  • Mark bundle as not supporting multiuse < HTTP/1.1 401 Unauthorized < Date: Mon, 17 Jul 2023 18:13:13 GMT < Content-Type: text/plain; charset=utf-8 < Content-Length: 17 < Traceparent: 00-00000000000000000000000000000000-0000000000000000-00 <
  • Connection #0 to host localhost left intact invalid api token

$ curl -v http://localhost:3500/v1.0/metadata -H "dapr-api-token: mytoken" * Trying ::1:3500... * Connected to localhost (::1) port 3500 (#0)

GET /v1.0/metadata HTTP/1.1 Host: localhost:3500 User-Agent: curl/7.74.0 Accept: / dapr-api-token: mytoken

  • Mark bundle as not supporting multiuse < HTTP/1.1 200 OK < Date: Mon, 17 Jul 2023 18:13:26 GMT < Content-Type: application/json < Content-Length: 119 < Traceparent: 00-00000000000000000000000000000000-0000000000000000-00 <
  • Connection #0 to host localhost left intact {"id":"foo","actors":[],"extended":{"daprRuntimeVersion":"v1.11.1"},"components":[],"httpEndpoints":[],"subscriptions":[]}

$ curl -v http://localhost:3500/v1.0/metadata?foo=/healthz * Trying ::1:3500... * Connected to localhost (::1) port 3500 (#0)

GET /v1.0/metadata?foo=/healthz HTTP/1.1 Host: localhost:3500 User-Agent: curl/7.74.0 Accept: /

  • Mark bundle as not supporting multiuse < HTTP/1.1 200 OK < Date: Mon, 17 Jul 2023 18:13:44 GMT < Content-Type: application/json < Content-Length: 119 < Traceparent: 00-00000000000000000000000000000000-0000000000000000-00 <
  • Connection #0 to host localhost left intact {"id":"foo","actors":[],"extended":{"daprRuntimeVersion":"v1.11.1"},"components":[],"httpEndpoints":[],"subscriptions":[]}
Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/dapr/dapr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.11.0"
            },
            {
              "fixed": "1.11.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/dapr/dapr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-37918"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-305"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-21T20:17:36Z",
    "nvd_published_at": "2023-07-21T21:15:11Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n\nA vulnerability has been found in Dapr that allows bypassing [API token authentication](https://docs.dapr.io/operations/security/api-token/), which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request.\n\n\nUsers who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 and 1.11.2.\n\n\n### Impact\n\n\nThis vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing.\n\n\n### Patches\n\n\nThe issue has been fixed in Dapr 1.10.9 and 1.11.2.\n\n\n### Details\n\n\nWhen API token authentication is enabled, Dapr requires all calls from applications to include the `dapr-api-token` header, with a value matching what\u0027s included in the Dapr\u0027s configuration. In order to allow for healthchecks to work, the `/v1.0/healthz` and `/v1.0/healthz/outbound` HTTP APIs are excluded from the API token authentication check, and are always allowed.\n\n\nDapr \u003c= 1.10.8 and \u003c= 1.11.1 implemented the allowlisting of the healthcheck endpoints by permitting all requests whose URL contains `/healthz` to bypass the API token authentication check. The match applied anywhere in the URL, including the querystring.\n\n\nAs a consequence, attackers were able to bypass API token authentication by including `/healthz` anywhere in the URL, including as a querystring parameter. This allowed attackers to invoke any Dapr API using HTTP, including perform service invocation.\n\n\n### Proof of Concept\n\n\n```\n$ curl -v http://localhost:3500/v1.0/metadata\n* Trying ::1:3500...\n* Connected to localhost (::1) port 3500 (#0)\n\u003e GET /v1.0/metadata HTTP/1.1\n\u003e Host: localhost:3500\n\u003e User-Agent: curl/7.74.0\n\u003e Accept: */*\n\u003e\n* Mark bundle as not supporting multiuse\n\u003c HTTP/1.1 401 Unauthorized\n\u003c Date: Mon, 17 Jul 2023 18:13:13 GMT\n\u003c Content-Type: text/plain; charset=utf-8\n\u003c Content-Length: 17\n\u003c Traceparent: 00-00000000000000000000000000000000-0000000000000000-00\n\u003c\n* Connection #0 to host localhost left intact\ninvalid api token\n\n\n$ curl -v http://localhost:3500/v1.0/metadata -H \"dapr-api-token: mytoken\"\n* Trying ::1:3500...\n* Connected to localhost (::1) port 3500 (#0)\n\u003e GET /v1.0/metadata HTTP/1.1\n\u003e Host: localhost:3500\n\u003e User-Agent: curl/7.74.0\n\u003e Accept: */*\n\u003e dapr-api-token: mytoken\n\u003e\n* Mark bundle as not supporting multiuse\n\u003c HTTP/1.1 200 OK\n\u003c Date: Mon, 17 Jul 2023 18:13:26 GMT\n\u003c Content-Type: application/json\n\u003c Content-Length: 119\n\u003c Traceparent: 00-00000000000000000000000000000000-0000000000000000-00\n\u003c\n* Connection #0 to host localhost left intact\n{\"id\":\"foo\",\"actors\":[],\"extended\":{\"daprRuntimeVersion\":\"v1.11.1\"},\"components\":[],\"httpEndpoints\":[],\"subscriptions\":[]}\n\n\n$ curl -v http://localhost:3500/v1.0/metadata?foo=/healthz\n* Trying ::1:3500...\n* Connected to localhost (::1) port 3500 (#0)\n\u003e GET /v1.0/metadata?foo=/healthz HTTP/1.1\n\u003e Host: localhost:3500\n\u003e User-Agent: curl/7.74.0\n\u003e Accept: */*\n\u003e\n* Mark bundle as not supporting multiuse\n\u003c HTTP/1.1 200 OK\n\u003c Date: Mon, 17 Jul 2023 18:13:44 GMT\n\u003c Content-Type: application/json\n\u003c Content-Length: 119\n\u003c Traceparent: 00-00000000000000000000000000000000-0000000000000000-00\n\u003c\n* Connection #0 to host localhost left intact\n{\"id\":\"foo\",\"actors\":[],\"extended\":{\"daprRuntimeVersion\":\"v1.11.1\"},\"components\":[],\"httpEndpoints\":[],\"subscriptions\":[]}\n",
  "id": "GHSA-59m6-82qm-vqgj",
  "modified": "2023-07-21T20:17:36Z",
  "published": "2023-07-21T20:17:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37918"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dapr/dapr/commit/99d6799c97b79397443c8c96737c9b893126a1ae"
    },
    {
      "type": "WEB",
      "url": "https://docs.dapr.io/operations/security/api-token"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dapr/dapr"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Dapr API token authentication bypass in HTTP endpoints"
}

GHSA-5FV2-2P94-9GH7

Vulnerability from github – Published: 2026-03-25 15:31 – Updated: 2026-03-25 15:31
VLAI
Details

A use-after-return vulnerability exists in the named server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-3591"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-305"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-25T14:16:37Z",
    "severity": "MODERATE"
  },
  "details": "A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.",
  "id": "GHSA-5fv2-2p94-9gh7",
  "modified": "2026-03-25T15:31:29Z",
  "published": "2026-03-25T15:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3591"
    },
    {
      "type": "WEB",
      "url": "https://downloads.isc.org/isc/bind9/9.20.21"
    },
    {
      "type": "WEB",
      "url": "https://downloads.isc.org/isc/bind9/9.21.20"
    },
    {
      "type": "WEB",
      "url": "https://kb.isc.org/docs/cve-2026-3591"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5HG3-FFV7-G5FF

Vulnerability from github – Published: 2023-01-18 18:30 – Updated: 2023-01-26 15:30
VLAI
Details

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-3100"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-305"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-18T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.",
  "id": "GHSA-5hg3-ffv7-g5ff",
  "modified": "2023-01-26T15:30:31Z",
  "published": "2023-01-18T18:30:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3100"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2022-3100"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5HWC-8C64-25VM

Vulnerability from github – Published: 2023-04-25 21:30 – Updated: 2024-04-04 03:41
VLAI
Details

The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-40723"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-305"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-25T19:15:10Z",
    "severity": "MODERATE"
  },
  "details": "The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.",
  "id": "GHSA-5hwc-8c64-25vm",
  "modified": "2024-04-04T03:41:01Z",
  "published": "2023-04-25T21:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40723"
    },
    {
      "type": "WEB",
      "url": "https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_19_rn"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5Q3W-6P3J-MW6P

Vulnerability from github – Published: 2026-03-11 12:31 – Updated: 2026-06-02 15:31
VLAI
Details

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-3784"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-305"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-11T11:16:00Z",
    "severity": "MODERATE"
  },
  "details": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection.",
  "id": "GHSA-5q3w-6p3j-mw6p",
  "modified": "2026-06-02T15:31:54Z",
  "published": "2026-03-11T12:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/3584903"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
    },
    {
      "type": "WEB",
      "url": "https://curl.se/docs/CVE-2026-3784.html"
    },
    {
      "type": "WEB",
      "url": "https://curl.se/docs/CVE-2026-3784.json"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/03/11/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-625F-424X-6J4W

Vulnerability from github – Published: 2022-05-24 17:27 – Updated: 2022-05-24 17:27
VLAI
Details

A vulnerability has been identified in SIMATIC HMI United Comfort Panels (All versions). Affected devices insufficiently validate authentication attempts as the information given can be truncated to match only a set number of characters versus the whole provided string. This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-15787"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-305"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-09-09T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in SIMATIC HMI United Comfort Panels (All versions). Affected devices insufficiently validate authentication attempts as the information given can be truncated to match only a set number of characters versus the whole provided string. This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack.",
  "id": "GHSA-625f-424x-6j4w",
  "modified": "2022-05-24T17:27:38Z",
  "published": "2022-05-24T17:27:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15787"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-542525.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-629X-6X88-9G8P

Vulnerability from github – Published: 2025-05-02 15:31 – Updated: 2025-05-02 15:31
VLAI
Details

KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-32011"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-305"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-01T19:15:57Z",
    "severity": "CRITICAL"
  },
  "details": "KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal.",
  "id": "GHSA-629x-6x88-9g8p",
  "modified": "2025-05-02T15:31:45Z",
  "published": "2025-05-02T15:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32011"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01"
    },
    {
      "type": "WEB",
      "url": "http://packages.revolutionpi.de/pool/main/p/pictory"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-65MJ-7C86-79JF

Vulnerability from github – Published: 2022-01-27 15:23 – Updated: 2022-02-07 22:34
VLAI
Summary
Authentication Bypass in ADOdb/ADOdb
Details

Impact

An attacker can inject values into a PostgreSQL connection string by providing a parameter surrounded by single quotes.

Depending on how the library is used in the client software, this may allow an attacker to bypass the login process, gain access to the server's IP address, etc.

Patches

The vulnerability is fixed in ADOdb versions 5.20.21 (952de6c4273d9b1e91c2b838044f8c2111150c29) and 5.21.4 or later (b4d5ce70034c5aac3a1d51d317d93c037a0938d2).

The simplest patch is to delete line 29 in drivers/adodb-postgres64.inc.php:

diff --git a/drivers/adodb-postgres64.inc.php b/drivers/adodb-postgres64.inc.php
index d04b7f67..729d7141 100644
--- a/drivers/adodb-postgres64.inc.php
+++ b/drivers/adodb-postgres64.inc.php
@@ -26,7 +26,6 @@ function adodb_addslashes($s)
 {
    $len = strlen($s);
    if ($len == 0) return "''";
-   if (strncmp($s,"'",1) === 0 && substr($s,$len-1) == "'") return $s; // already quoted

    return "'".addslashes($s)."'";
 }

Workarounds

Ensure the parameters passed to ADOConnection::connect() or related functions (nConnect(), pConnect()) are not surrounded by single quotes.

Credits

Thanks to Emmet Leahy (@meme-lord) of Sorcery Ltd for reporting this vulnerability, and to the huntr team for their support.

References

  • Original issue report https://huntr.dev/bounties/bdf5f216-4499-4225-a737-b28bc6f5801c/
  • ADOdb reference issue #793

For more information

If you have any questions or comments about this advisory: * Add a note in issue #793 * Contact the maintainers on Gitter

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.20.20"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "adodb/adodb-php"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.20.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.21.3"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "adodb/adodb-php"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.21.0"
            },
            {
              "fixed": "5.21.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-3850"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-305"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-24T22:39:29Z",
    "nvd_published_at": "2022-01-25T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nAn attacker can inject values into a PostgreSQL connection string by providing a parameter surrounded by single quotes.\n\nDepending on how the library is used in the client software, this may allow an attacker to bypass the login process, gain access to the server\u0027s IP address, etc.\n\n### Patches\n\nThe vulnerability is fixed in ADOdb versions 5.20.21 (952de6c4273d9b1e91c2b838044f8c2111150c29) and 5.21.4 or later (b4d5ce70034c5aac3a1d51d317d93c037a0938d2).\n\nThe simplest patch is to delete line 29 in `drivers/adodb-postgres64.inc.php`:\n\n```php\ndiff --git a/drivers/adodb-postgres64.inc.php b/drivers/adodb-postgres64.inc.php\nindex d04b7f67..729d7141 100644\n--- a/drivers/adodb-postgres64.inc.php\n+++ b/drivers/adodb-postgres64.inc.php\n@@ -26,7 +26,6 @@ function adodb_addslashes($s)\n {\n    $len = strlen($s);\n    if ($len == 0) return \"\u0027\u0027\";\n-   if (strncmp($s,\"\u0027\",1) === 0 \u0026\u0026 substr($s,$len-1) == \"\u0027\") return $s; // already quoted\n \n    return \"\u0027\".addslashes($s).\"\u0027\";\n }\n```\n\n### Workarounds\n\nEnsure the parameters passed to *ADOConnection::connect()* or related functions (_nConnect()_, _pConnect()_) are not surrounded by single quotes.\n\n### Credits\n\nThanks to **Emmet Leahy** (@meme-lord) of Sorcery Ltd for reporting this vulnerability, and to the [huntr](https://huntr.dev/) team for their support.\n\n### References\n\n- Original issue report https://huntr.dev/bounties/bdf5f216-4499-4225-a737-b28bc6f5801c/\n- ADOdb reference issue #793 \n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Add a note in issue #793\n* Contact the maintainers on [Gitter](https://gitter.im/adodb/adodb)\n",
  "id": "GHSA-65mj-7c86-79jf",
  "modified": "2022-02-07T22:34:28Z",
  "published": "2022-01-27T15:23:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ADOdb/ADOdb/security/advisories/GHSA-65mj-7c86-79jf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3850"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ADOdb/ADOdb/issues/793"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ADOdb/ADOdb/commit/952de6c4273d9b1e91c2b838044f8c2111150c29"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ADOdb/ADOdb/commit/b4d5ce70034c5aac3a1d51d317d93c037a0938d2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ADOdb/ADOdb"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/bdf5f216-4499-4225-a737-b28bc6f5801c"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00006.html"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2022/dsa-5101"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authentication Bypass in ADOdb/ADOdb"
}

GHSA-662C-CJ8Q-QC4G

Vulnerability from github – Published: 2024-08-08 12:30 – Updated: 2024-08-08 12:30
VLAI
Details

An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the password re-entry requirement to approve a policy.

Severity
4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-4784"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-305"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-08T10:15:09Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the password re-entry requirement to approve a policy.",
  "id": "GHSA-662c-cj8q-qc4g",
  "modified": "2024-08-08T12:30:34Z",
  "published": "2024-08-08T12:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4784"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2486223"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/461248"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list