Lucene search
+L

3657 matches found

OSV
OSV
added 2022/12/31 1:15 a.m.14 views

CVE-2022-48195

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

9.8CVSS5.8AI score0.0089EPSS
SaveExploits0References1
NVD
NVD
added 2022/12/31 1:15 a.m.27 views

CVE-2022-48195

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

9.8CVSS0.0089EPSS
SaveExploits0References1
Prion
Prion
added 2022/12/31 1:15 a.m.20 views

Authentication flaw

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

7.5CVSS9.4AI score0.0089EPSS
SaveExploits0References1Affected Software1
Positive Technologies
Positive Technologies
added 2022/12/31 12:00 a.m.9 views

PT-2022-28120 · Mellium · Mellium.Im/Sasl

Name of the Vulnerable Software and Affected Versions: Mellium mellium.im/sasl versions prior to 0.3.1 Description: An issue was discovered in Mellium mellium.im/sasl when performing SCRAM-based SASL authentication. If the remote end advertises support for channel binding, no random nonce is...

9.8CVSS9.4AI score0.0089EPSS
SaveExploits0References10
Cvelist
Cvelist
added 2022/12/31 12:00 a.m.50 views

CVE-2022-48195

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

9.8AI score0.0089EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2022/12/31 12:00 a.m.19 views

Mellium 授权问题漏洞

Mellium is to provide functionality from the Extensible Messaging and Presence Protocol. A security vulnerability exists in Mellium versions prior to v0.3.0 that stems from the fact that when performing SCRAM-based SASL authentication, if the remote end announcement supports channel binding, it...

9.8CVSS8.3AI score0.0089EPSS
SaveExploits0References3
CVE
CVE
added 2022/12/31 12:00 a.m.102 views

CVE-2022-48195

The CVE-2022-48195 issue affects Mellium mellium.im/sasl prior to v0.3.1. During SCRAM-based SASL authentication, if the remote end advertises channel binding, the implementation fails to generate a random nonce (the nonce becomes empty). This can cause authentication to fail, and in configuratio...

9.8CVSS9.4AI score0.0089EPSS
SaveExploits0References1Affected Software1
CISA
CISA
added 2022/12/13 12:00 a.m.19 views

CISA Adds Five Known Exploited Vulnerabilities to Catalog

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose a significant risk to the federal enterprise. Note: To view newly added...

1.6AI score
SaveExploits0References5
OSV
OSV
added 2022/12/05 4:15 a.m.13 views

CVE-2022-43484

TERASOLUNA Global Framework 1.0.0 Public review version and TERASOLUNA Server Framework for Java Rich 2.0.0.2 to 2.0.5.1 are vulnerable to a ClassLoader manipulation vulnerability due to using the old version of Spring Framework which contains the vulnerability.The vulnerability is caused by an...

7.8CVSS5.9AI score0.00419EPSS
SaveExploits1References3
Spring Security Advisories
Spring Security Advisories
added 2022/12/02 11:26 p.m.80 views

Spring WS Samples upgraded for Spring Boot 3.0!

With the recent announcement of Spring Boot 3.0 going GA, some of you may be interested in upgrading your Spring Web Services-based applications to take full advantage of this. The Spring WS team has upgraded our set of sample apps to help you carry that out. The main branch now tracks the versio...

0.2AI score
SaveExploits0
OSV
OSV
added 2022/12/02 6:15 p.m.12 views

CVE-2022-45657

Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function...

7.5CVSS6.2AI score0.00824EPSS
SaveExploits1References1
CNNVD
CNNVD
added 2022/12/02 12:00 a.m.11 views

Tenda AC6 安全漏洞

Tenda AC6 is a wireless router from Tenda, China. A security vulnerability exists in Tenda AC6V1.0 V15.03.05.19, which originates from a buffer overflow vulnerability via the list parameter in the fromSetIpMacBind function...

7.5CVSS7.7AI score0.00824EPSS
SaveExploits1References2
Tenable Nessus
Tenable Nessus
added 2022/12/01 12:00 a.m.35 views

FreeBSD : rpm4 -- Multiple Vulnerabilities (0c52abde-717b-11ed-98ca-40b034429ecf)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0c52abde-717b-11ed-98ca-40b034429ecf advisory. - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a...

6.7CVSS6.3AI score0.00513EPSS
SaveExploits2References4
CNNVD
CNNVD
added 2022/11/29 12:00 a.m.12 views

Airtable.js 安全漏洞

Airtable.js is Airtable open source an Airtable javascript client . Provides a simple way to access the data . A misconfiguration vulnerability exists in Airtable.js versions prior to 0.11.6 that stems from a misconfiguration in a script that binds environment variables to the build target of a...

7.6CVSS6.5AI score0.00464EPSS
SaveExploits0References4
OSV
OSV
added 2022/11/28 10:15 p.m.10 views

CVE-2022-24190

The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The usertoken header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture frame, then send a POST request to acce...

7.5CVSS5.8AI score0.0068EPSS
SaveExploits1References1
NVD
NVD
added 2022/11/28 10:15 p.m.34 views

CVE-2022-24190

The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The usertoken header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture frame, then send a POST request to acce...

7.5CVSS0.0068EPSS
SaveExploits1References1
Vulnrichment
Vulnrichment
added 2022/11/28 12:00 a.m.12 views

CVE-2022-24190

The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The usertoken header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture frame, then send a POST request to acce...

7.7AI score0.0068EPSS
SaveExploits1References1
CNNVD
CNNVD
added 2022/11/28 12:00 a.m.13 views

Shenzhen Fujia Technology OurPhoto 安全漏洞

Shenzhen Fujia Technology OurPhoto is a cloud photo frame software from Shenzhen Fujia Technology, China. It allows you to share photos and video files directly on your cell phone. A security vulnerability exists in Shenzhen Fujia Technology OurPhoto version 1.4.1, which stems from the fact that...

7.5CVSS7.4AI score0.0068EPSS
SaveExploits1References3
Cvelist
Cvelist
added 2022/11/28 12:00 a.m.43 views

CVE-2022-24190

The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The usertoken header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture frame, then send a POST request to acce...

7.8AI score0.0068EPSS
SaveExploits1References1
IBM Security Bulletins
IBM Security Bulletins
added 2022/11/22 8:08 a.m.72 views

Security Bulletin: Multiple vulnerabilities in Data-Binding for Jackson shipped with IBM Operations Analytics - Log Analysis

Summary There are multiple vulnerabilities in various versions of Data-Binding functionality for Jackson that affect IBM Operations Analytics - Log Analysis. It has been fixed. The vulnerabilities are listed in the Vulnerability Details section below. Vulnerability Details CVEID:CVE-2020-25649...

9.8CVSS10AI score0.45205EPSS
SaveExploits28Affected Software1
Rows per page
Query Builder