Tag: authentication bypass
Attackers breach Cisco ISE management interface through an API blind spot
Cisco's identity appliance is being hit through an API endpoint that never checked who was asking.
JFrog Artifactory auth bypass already abused for admin tokens
WatchTowr reports attackers are minting admin tokens through the critical JFrog Artifactory auth bypass patched August 28.
SAML plugin bugs hand WordPress admin access to strangers
Two unauthenticated bugs in the miniOrange SAML plugin let attackers log in as any WordPress user.
Rapid7 urges emergency patching of Citrix NetScaler login bypass
Citrix fixed a CVSS 9.3 authentication bypass in NetScaler ADC and Gateway that attackers are expected to exploit quickly.
Forged JWT tokens put unpatched SharePoint servers in attacker hands
Attackers are exploiting a critical SharePoint authentication bypass days after Rapid7 shipped proof-of-concept code.
Pass-ta-key attacks turn endpoint malware into passkey account takeover
Unit 42 details three ways malware can abuse Chrome's synced passkey flows to hijack accounts.
Second N-able patch closes N-central hole after attackers slip past first
Attackers used an authentication bypass in N-able N-central to reach managed endpoints, and the vendor's first fix did not block…
Image uploads can leak Rails master keys through critical Active Storage bug
A CVSS 9.5 Rails Active Storage flaw lets unauthenticated attackers read arbitrary server files through crafted image uploads.