82 matches found
Microsoft Windows NTLM 安全漏洞
Microsoft Windows is a set of operating systems for personal devices from the U.S. Microsoft Windows NTLM has a spoofing vulnerability that could be exploited by an attacker to compromise the confidentiality of the system...
PT-2022-3530 · Schneider Electric · Ecostruxure Cybersecurity Admin Expert
Name of the Vulnerable Software and Affected Versions: EcoStruxure Cybersecurity Admin Expert CAE versions prior to 2.2 Description: A vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local...
The vulnerability of the Apache APISIX cloud API gateway, related to bypassing authentication through spoofing, allows attackers to execute arbitrary code.
The vulnerability of the Apache APISIX cloud API gateway involves bypassing authentication through spoofing. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server packages allows attackers to perform spear-phishing attacks.
The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server relates to the ability to bypass authentication through spoofing. Exploiting this vulnerability allows a malicious actor to carry out spoofing attacks...
The vulnerability of the Kalay P2P SDK, related to bypassing authentication through spoofing, allows a perpetrator to compromise IoT devices and gain unauthorized access to protected information.
The vulnerability of the Kalay P2P SDK lies in the ability to bypass authentication through spoofing. Exploiting this vulnerability allows a malicious actor to compromise IoT devices and gain unauthorized access to protected information...
DEBIAN-CVE-2021-36367
PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt that the attacker can use to capture credential data, and use...
UBUNTU-CVE-2021-36367
PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt that the attacker can use to capture credential data, and use...
Advisory ROSA-SA-2021-1836
Software: freeradius 3.0.13 OS: Cobalt 7.9 CVE-ID: CVE-2019-11234 CVE-Crit: CRITICAL CVE-DESC: FreeRADIUS before 3.0.19 does not prevent the use of reflection for authentication spoofing, also known as the "Dragonblood" issue, similar to CVE-2019-9497. CVE-STATUS: default CVE-REV: Default CVE-ID:...
fs.com S3900-24T4S Cross-Site Request Forgery Vulnerability
The fs.com S3900-24T4S is a Gigabit stackable switch from China's Feixiang Innovation fs. fs S3900-24T4S switch is equipped with 24 10/100/1000Base-T ports, 4 10G SFP+ uplink ports, supports up to 6 switches stacking, and is easy to operate with highly secure service processing capability, flexib...
[SECURITY] [DSA 4562-1] chromium security update
-------------------------------------------------------------------------- Debian Security Advisory DSA-4562-1 [email protected] https://www.debian.org/security/ Michael Gilbert November 10, 2019 https://www.debian.org/security/faq -...
chromium-browser: HTTP authentication spoof
Incorrect data validation in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...
NewStart CGSL CORE 5.04 / MAIN 5.04 : freeradius Multiple Vulnerabilities (NS-SA-2019-0079)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has freeradius packages installed that are affected by multiple vulnerabilities: - FreeRADIUS before 3.0.19 mishandles the each participant verifies that the received scalar is within a range, and that the received group elemen...
NewStart CGSL CORE 5.05 / MAIN 5.05 : freeradius Multiple Vulnerabilities (NS-SA-2019-0083)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has freeradius packages installed that are affected by multiple vulnerabilities: - FreeRADIUS before 3.0.19 mishandles the each participant verifies that the received scalar is within a range, and that the received group elemen...
The vulnerability of the JavaScript script handler in the Microsoft Office software allows a hacker to read or write arbitrary data.
The vulnerability of Microsoft Office’s JavaScript script handlers relates to the ability to bypass authentication through spoofing. Exploiting this vulnerability allows an attacker to read or write arbitrary data...
Amazon Linux 2 : freeradius (ALAS-2019-1218)
FreeRADIUS mishandles the 'each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used' protection mechanism, aka a 'Dragonblood' issue, a similar issue to CVE-2019-9498 and CVE-2019-9499 .CVE-2019-11235...
Authentication Bypass
FreeRADIUS is vulnerable to authentication bypass. Remote unauthenticated attackers could exploit a flaw since the application does not prevent the use of reflection for authentication spoofing, aka a "Dragonblood" issue...
freeradius: eap-pwd: fake authentication using reflection
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497...
CVE-2019-11234
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497...