Lucene search
+L

3663 matches found

OSV
OSV
added 2023/01/18 6:06 p.m.27 views

GO-2023-1268 Authentication failure in mellium.im/sasl

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

9.8CVSS9.4AI score0.0089EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2023/01/17 12:00 a.m.8 views

PT-2023-34403 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.163 Description: The issue is related to the handling of network packets, specifically the association of a socket buffer skb with a device during transmission tx. The actual impact and potential for attac...

7.4AI score
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 2023/01/12 9:59 p.m.59 views

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a data binding rules security weakness in Spring Framework (CVE-2022-22968)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a Spring framework data binding rules vulnerability, where case sensitive patterns for disallowedFields cause weaker than expected security CVE-2022-22968. Spring Framework is used by some of the java...

5.3CVSS5.6AI score0.05666EPSS
SaveExploits2Affected Software1
Veracode
Veracode
added 2023/01/10 7:21 a.m.37 views

Authentication Bypass

github.com/mellium/sasl is vulnerable to authentication bypass. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty causing authentication to fail in the best case, which may lead to...

9.8CVSS9.1AI score0.0089EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2022/12/31 3:30 a.m.46 views

mellium.im/sasl authentication failure due to insufficient nonce randomness

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

9.8CVSS9AI score0.0089EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2022/12/31 3:30 a.m.81 views

GHSA-GVFJ-FXX3-J323 mellium.im/sasl authentication failure due to insufficient nonce randomness

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

9.8CVSS9.4AI score0.0089EPSS
SaveExploits0References6
OSV
OSV
added 2022/12/31 1:15 a.m.14 views

CVE-2022-48195

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

9.8CVSS5.8AI score0.0089EPSS
SaveExploits0References1
NVD
NVD
added 2022/12/31 1:15 a.m.27 views

CVE-2022-48195

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

9.8CVSS0.0089EPSS
SaveExploits0References1
Prion
Prion
added 2022/12/31 1:15 a.m.20 views

Authentication flaw

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

7.5CVSS9.4AI score0.0089EPSS
SaveExploits0References1Affected Software1
Positive Technologies
Positive Technologies
added 2022/12/31 12:00 a.m.9 views

PT-2022-28120 · Mellium · Mellium.Im/Sasl

Name of the Vulnerable Software and Affected Versions: Mellium mellium.im/sasl versions prior to 0.3.1 Description: An issue was discovered in Mellium mellium.im/sasl when performing SCRAM-based SASL authentication. If the remote end advertises support for channel binding, no random nonce is...

9.8CVSS9.4AI score0.0089EPSS
SaveExploits0References10
Cvelist
Cvelist
added 2022/12/31 12:00 a.m.50 views

CVE-2022-48195

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

9.8AI score0.0089EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2022/12/31 12:00 a.m.19 views

Mellium 授权问题漏洞

Mellium is to provide functionality from the Extensible Messaging and Presence Protocol. A security vulnerability exists in Mellium versions prior to v0.3.0 that stems from the fact that when performing SCRAM-based SASL authentication, if the remote end announcement supports channel binding, it...

9.8CVSS8.3AI score0.0089EPSS
SaveExploits0References3
CVE
CVE
added 2022/12/31 12:00 a.m.102 views

CVE-2022-48195

The CVE-2022-48195 issue affects Mellium mellium.im/sasl prior to v0.3.1. During SCRAM-based SASL authentication, if the remote end advertises channel binding, the implementation fails to generate a random nonce (the nonce becomes empty). This can cause authentication to fail, and in configuratio...

9.8CVSS9.4AI score0.0089EPSS
SaveExploits0References1Affected Software1
CISA
CISA
added 2022/12/13 12:00 a.m.19 views

CISA Adds Five Known Exploited Vulnerabilities to Catalog

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose a significant risk to the federal enterprise. Note: To view newly added...

1.6AI score
SaveExploits0References5
OSV
OSV
added 2022/12/05 4:15 a.m.13 views

CVE-2022-43484

TERASOLUNA Global Framework 1.0.0 Public review version and TERASOLUNA Server Framework for Java Rich 2.0.0.2 to 2.0.5.1 are vulnerable to a ClassLoader manipulation vulnerability due to using the old version of Spring Framework which contains the vulnerability.The vulnerability is caused by an...

7.8CVSS5.9AI score0.00419EPSS
SaveExploits1References3
Spring Security Advisories
Spring Security Advisories
added 2022/12/02 11:26 p.m.80 views

Spring WS Samples upgraded for Spring Boot 3.0!

With the recent announcement of Spring Boot 3.0 going GA, some of you may be interested in upgrading your Spring Web Services-based applications to take full advantage of this. The Spring WS team has upgraded our set of sample apps to help you carry that out. The main branch now tracks the versio...

0.2AI score
SaveExploits0
OSV
OSV
added 2022/12/02 6:15 p.m.12 views

CVE-2022-45657

Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function...

7.5CVSS6.2AI score0.00824EPSS
SaveExploits1References1
CNNVD
CNNVD
added 2022/12/02 12:00 a.m.11 views

Tenda AC6 安全漏洞

Tenda AC6 is a wireless router from Tenda, China. A security vulnerability exists in Tenda AC6V1.0 V15.03.05.19, which originates from a buffer overflow vulnerability via the list parameter in the fromSetIpMacBind function...

7.5CVSS7.7AI score0.00824EPSS
SaveExploits1References2
Tenable Nessus
Tenable Nessus
added 2022/12/01 12:00 a.m.35 views

FreeBSD : rpm4 -- Multiple Vulnerabilities (0c52abde-717b-11ed-98ca-40b034429ecf)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0c52abde-717b-11ed-98ca-40b034429ecf advisory. - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a...

6.7CVSS6.3AI score0.00513EPSS
SaveExploits2References4
CNNVD
CNNVD
added 2022/11/29 12:00 a.m.12 views

Airtable.js 安全漏洞

Airtable.js is Airtable open source an Airtable javascript client . Provides a simple way to access the data . A misconfiguration vulnerability exists in Airtable.js versions prior to 0.11.6 that stems from a misconfiguration in a script that binds environment variables to the build target of a...

7.6CVSS6.5AI score0.00464EPSS
SaveExploits0References4
Rows per page
Query Builder