Everything SecOps Signal has reported about CVSS 9.3: 3 stories, newest first. Part of our Vulnerabilities coverage.
Unauthenticated attackers can forge administrative session tokens using a hardcoded secret in DataBuff ai-apm-web versions up to 0.1.10, granting full access to protected API routes.
A critical vulnerability in Diaple Stela allows attackers to bypass authentication by manipulating a client-side cookie, granting full administrative control to systems running versions prior to 1.60.1.
Unauthenticated users can exploit a flaw in Enswitch versions 3.13 through 4.4 to change passwords and seize administrator access by omitting reset parameters.