115 matches found
cert-pinning-flaw-poc
인증서 핀 고정 결함 POC CVE-2016-2402 및 유사 결함을 테스트하기 위한 간단한 POC 스크립트입니다. 자세한 내용은 내 블로그 게시물을 읽어보세요. 이 유틸리티는 특정 도메인에 대해 클라이언트에 악성 인증서 체인을 제공하는 HTTPS 서버를 설정합니다. 취약한 인증서 핀 고정 구현이 있는 앱의 트래픽이 이 서버로 리다이렉트되면 핀 고정 제어가 우회되며 서버 콘솔에서 GET 또는 POST 요청을 볼 수 있습니다. 기본적으로 하드코딩된 CA 인증서와 키CACERT.pem 및 CAKEY.pem 파일를 사용합니다. 이를...
certPinningVulnerableOkHttp
OkHttp simple-client 앱, CVE-2016-2402 취약점 포함 이 저장소는 okhttp 프로젝트의 기본 simple-client를 포크한 것입니다. Simple-client는 https://api.github.com에 GET 요청을 보내 okhttp 기여자들의 이름을 가져오는 Java 앱입니다. 이 포크는 네트워킹 연결에 OkHttp 3.0.1을 사용하고 인증서 고정certificate pinning도 사용하도록 수정되었습니다. OkHttp 3.0.1은 CVE-2016-2402에 취약합니다. 이 앱은 그 결함...
cve-2024-8069-exp-Citrix-Virtual-Apps-XEN
CVE-2024-8068 and CVE-2024-8069 Citrix Virtual Apps 및 데스크톱XEN 비인증 원격 코드 실행 취약점 자세한 기술 정보는 블로그 게시물을 참조하세요. https://github.com/user-attachments/assets/563fd110-5321-49f7-8dc3-48eb0a53e0f9 취약점 악용 데모 python exploit-citrix-xen.py --target 192.168.1.120 --port 80 --cmd "whoami" CVE-xxxx-xxxxx.py Citrix...
CVE-2022-2402
creationtimestamp| type| source ---|---|--- 2026-07-29 12:00:57+00:00| seen| https://t.me/CVEhub/3830 2026-07-30 00:01:36+00:00| seen| https://t.me/CVEhub/3830 2026-08-01 01:00:05+00:00| published-proof-of-concept| https://t.me/CVEhub/3830 2026-08-02 00:01:22+00:00| published-proof-of-concept|...
CVE-2026-2402
creationtimestamp| type| source ---|---|--- 2026-07-09 16:15:21+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-190-02...
MiracleLinux 8 : ruby:2.6 (AXSA:2021-2402:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2402:01 advisory. rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code CVE-2019-3881 ruby: NUL injection vulnerability o...
Citrix Workspace app for Windows Security Bulletin CVE-2025-4879
Severity - High Description of Problem A vulnerability has been discovered that impacts the Citrix Workspace app for Windows. Affected Versions The vulnerability affects the following supported versions of the Citrix Workspace app for Windows Current Release CR Citrix Workspace app for Windows...
CVE-2024-2402
The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-2402
The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchterm parameter in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
2402 LTSR target device stuck initializing while checking the status of Hybrid joined machines
...
PVS configuration wizard error - Unable to communicate with license server
When upgrading the PVS farm to PVS 2402, PVS configuration wizard could not progress further if "Validate license server communication" was checked, displaying an error "Unable to communicate with the license server, or the license server version is not compatible with this version of Citrix...
Black area's when launching Horizon app on VDA 2402 CU1
After upgrading our VDA to 2402 cu1 we are presented with black artifacts on launch of Horizon app...
On Prem || FAS 2402 LTSR || FAS with intune certificate
Impacts and limitations of FAS with Intune certificate...
CVE-2025-2402
A hard-coded, non-random password for the object store minio of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the password to read and manipulate swapped jobs or read and manipulate in- and output data of active jobs. It...
CVE-2025-2402
creationtimestamp| type| source ---|---|--- 2025-03-31 06:30:59+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/9593 2025-03-31 06:59:08+00:00| seen| https://bsky.app/profile/potato.software/post/3llnruhrno32t 2025-03-31 10:49:40+00:00| seen| https://t.me/cvedetector/21565 2026-03-25...
CVE-2025-2402
CVE-2025-2402 affects KNIME Business Hub. A hard-coded, non-random password for the object store (MinIO) in all versions except the listed fixes enables an unauthenticated attacker to read/manipulate swapped jobs or in/out data of active jobs, and can cause a denial-of-service by writing large da...
Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities
Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...
CVE-2024-25634
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The attacker can use a specially crafted request to receive the e-mail log sent by other events. Version 2.0-M4-2402 fixes this issue...
EPA Client Removed When Workspace App is Upgraded from 2402 to 2402 CU1
Endpoints have Workspace app 2402 installed along with EPA Client Endpoints have been upgraded to Workspace app 2402 CU1 After upgrade, the EPA client has been removed...