288 matches found
CVE-2024-11301
CVE-2024-11301 affects lunary-ai/lunary prior to 1.6.3. The issue is the absence of a unique constraint on the combination of projectId and slug when creating evaluators, allowing an attacker to overwrite an existing evaluator by submitting a POST with the same slug. This leads to data integrity ...
The vulnerability of the application layer in real-time database content management system SQL Directus, related to bypassing authentication using a user-controlled key, allows attackers to gain access to the user’s account.
The vulnerability of the application layer in real-time content management system SQL Directus relates to bypassing authentication by using a user-controlled key. Exploiting this vulnerability could allow an attacker to gain access to the user account...
CVE-2025-20045
When SIP session Application Level Gateway mode ALG profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached...
CVE-2024-43099
The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into a...
PT-2025-5728 · F5 · Traffic Management Microkernel +1
Name of the Vulnerable Software and Affected Versions: No specific software name is mentioned, but based on the context, it appears to be related to a product from a company like F5, given the mention of terms like "Traffic Management Microkernel TMM" and "Application Level Gateway mode ALG"...
Silicon Simplicity SDK 安全漏洞
Silicon Simplicity SDK is an embedded software development platform from Silicon, Inc. for building IoT products based on our Series 2 and upcoming Series 3 wireless and MCU devices. A security vulnerability exists in the Silicon Simplicity SDK that stems from a misformatted packet that could cau...
PT-2025-3681 · Ember · Ember Znet Stack
Name of the Vulnerable Software and Affected Versions: Ember ZNet stack affected versions not specified Description: A malformed packet can cause a buffer overflow in the NWK/APS layer of the Ember ZNet stack and lead to an assert. Recommendations: At the moment, there is no information about a...
firefox: Alt-Svc ALPN validation failure when redirected
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site...
PT-2025-3682 · Ember · Ember Znet Stack
Name of the Vulnerable Software and Affected Versions: Ember ZNet stack affected versions not specified Description: A malformed packet can cause a buffer overflow in the APS layer of the Ember ZNet stack and lead to an assert. Recommendations: At the moment, there is no information about a newer...
firefox: Alt-Svc ALPN validation failure when redirected
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site...
firefox: Alt-Svc ALPN validation failure when redirected
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site...
firefox: Alt-Svc ALPN validation failure when redirected
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site...
Mozilla Firefox 安全漏洞
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability previously existed in Mozilla Firefox version 134, which stemmed from a failure of ALPN to properly validate certificates when using Alt-Svc if the originating server redirecte...
PT-2025-42742
Name of the Vulnerable Software and Affected Versions Go versions prior to 1.24.9-alt1 Fedora 42 Fedora 43 Description The issue involves a flaw in the crypto/tls component of the Go programming language. Specifically, when the Conn.Handshake process fails during ALPN Application-Layer Protocol...
CVE-2024-53259
CVE-2024-53259 affects the quic-go QUIC implementation. An off-path attacker can inject an ICMP Packet Too Large when IP_PMTUDISC_DO is used, causing the kernel to return a “message too large” error on sendmsg if a QUIC packet exceeds the MTU claimed in the ICMP message. This can disrupt a QUIC c...
The vulnerability of the Application Layer Gateway module in Juniper Networks’ Junos OS network devices of the SRX and MX series allows a attacker to cause service interruptions.
The vulnerability of the Application Layer Gateway module in Juniper Networks’ Junos OS network devices of the SRX and MX series involves an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...
Suricata 安全漏洞
Suricata is a network IDS, IPS and NSM engine from the Open Information Security Foundation. A security vulnerability exists in Suricata versions prior to 7.0.7 that stems from an invalid ALPN in TLS/QUIC traffic when JA4 matching/logging is enabled, which may cause Suricata to abort and panic...
openssl: SSL_select_next_proto buffer overread
A flaw was found in OpenSSL. Affected versions of this package are vulnerable to Information Exposure through the SSLselectnextproto function. This flaw allows an attacker to cause unexpected application behavior or a crash by exploiting the buffer overread condition when the function is called...
CVE-2024-43099
The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into a...
CVE-2024-43099 AutomationDirect DirectLogic H2-DM1E Authentication Bypass by Capture-replay
The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into a...