Authentication Bypass | writeups.xyz

Title	Vulnerabilities	Programs	Authors
The Hunt for ALBeast: A Technical Walkthrough	AWS ALB Authentication Bypass Authorization Bypass	AWS	Liad Eliyahu (@Liadeliyahu)
$1600 Bounty on a Main Domain	Session Fixation 2FA / MFA Bypass Information Disclosure Authentication Bypass Open Redirect	Undisclosed	Debug (@Debug50)
Breaking the Barrier: Admin Panel Takeover Worth $3500	Authentication Bypass Password Reset Information Disclosure	Undisclosed	Aditya Sharma (@Assass1nmarcos)
Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!	Confusion Attack RCE XSS Access Control Bypass Authentication Bypass SSRF	Apache HTTP Server ModSecurity Redmine	Orange Tsai (@Orange_8361)
The Butterfly Effect: Turning Overlooked - Misconfigurations into Zero Click Account Takeover	GraphQL IDOR Authentication Bypass Account Takeover	Undisclosed	Oussama Rahali (@Ourahali)
SAML Authentication Bypass Leading to Admin Panel Access	SAML Authentication Bypass	Undisclosed	Ahmed Tarek
Breaking Down Barriers: Exploiting Authenticated IPC Clients	IPC Client D-Bus Shared Object Injection Authentication Bypass	Undisclosed	Ajay S.K
Getting Unauthenticated Remote Code Execution On The Logsign Unified Secops Platform	RCE Authentication Bypass OS Command Injection Security Code Review	Logsign	Yulin Sung Mehmet INCE (@Mdisec)
17 vulnerabilities in Sharp Multi-Function Printers	Printer Hacking RCE Information Disclosure Memory Corruption Buffer Overflow DoS LFI XSS Hardcoded API Keys Default Credentials Missing Authentication Directory Listing Authentication Bypass LDAP	Sharp Toshiba	Pierre Kim (@PierreKimSec)
Looking for vulnerabilities in Strapi (CVE-2024-34065)	Authentication Bypass Open Redirect Security Code Review	Strapi	Mathieu Farrell
Molding Lies Into Reality \|\| Exploiting CVE-2024-4358	RCE Insecure Deserialization Authentication Bypass Security Code Review	Progress (Telerik)	Sina Kheirkhah (@SinSinology)
Cache Me If You Can: Local Privilege Escalation in Zscaler Client Connector (CVE-2023-41973)	Path Traversal Authentication Bypass Arbitrary File Delete DLL Hijacking Local Privilege Escalation Windows	Zscaler	Eugene Lim (@Spaceraccoonsec) Winston Ho
Race Condition Authentication Bypass leads to Full Account Takeover	Race Condition Authentication Bypass Account Takeover	Undisclosed	Keizo (@KeiZo_Zo)
Oauth Misconfiguration Leads to 0-Click ATO	Account Takeover Authentication Bypass OAuth	Undisclosed	Muhammad Mostafa (@0xSekiro)
From Discovery to Disclosure: ReCrystallize Server Vulnerabilities	Default Credentials LFI Authentication Bypass Privilege Escalation Unrestricted File Upload RCE	ReCrystallize Software	Paul Van Der Haas (@PvdH)
Micro Services, Major Headaches: Detecting Vulnerabilities in Erxes' Microservices	RCE Path Traversal Authentication Bypass Arbitrary File Overwrite GraphQL SSRF Security Code Review	Erxes	Paul Gerste
Subdomain Fuzzing worth 35k bounty!	RCE Authentication Bypass SQL Injection	Undisclosed	Abdullah Nawaf / HX007 Orwa Atyat (@GodfatherOrwa)
Angular-ing for AuthZ, Problematic anti-patterns in Single Sign On Systems	SSO Authentication Bypass	Undisclosed	Traceable ASPEN
CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities	Authentication Bypass Security Code Review	JetBrains (TeamCity)	Rapid7
Bypassing a login page and getting full admin access on an internal training platform	Authentication Bypass Broken Access Control HTTP Response Manipulation Directory Listing	Undisclosed	LS (@Loupreme_)
Exploiting embedded mitel phones for unauthenticated remote code execution	RCE Reverse Engineering Buffer Overflow Memory Corruption Authentication Bypass OS Command Injection	Mitel	Kevin Joensen (@Ggisx)
SSD Advisory – TP-LINK NCXXX Authentication Bypass	Authentication Bypass Stack Overflow Memory Corruption Security Code Review	TP-Link	-
Nom for Security: A Proactive Security Review of Nomulus	Insecure Deserialization Verbose Logging Information Disclosure Cryptographic Issues Authentication Bypass	Google (Nomulus)	Sam Erb (@Erbbysam) Justin Taft
Auth Bypass Round Two	SAML SSRF RCE Authentication Bypass Security Code Review	Ivanti	Dylan Pindur
Jumpserver Preauth RCE Exploit Chain	RCE Password Reset Authentication Bypass Path Traversal Cryptographic Issues Security Code Review	JumpServer	Zhiniang Peng (@Edwardzpeng)

Page 1 of 9