322 matches found
TurboMeeting - Post-Authentication Command Injection
The Certificate Signing Request CSR feature in the admin portal of the application is vulnerable to command injection. This vulnerability could allow authenticated admin users to execute arbitrary commands on the underlying server by injecting malicious input into the CSR generation process. The...
CVE-2026-19706 Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap
During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file ports 22623/22624, extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the...
CVE-2026-19706 Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap
During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file ports 22623/22624, extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the...
EUVD-2026-120121
During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file ports 22623/22624, extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the...
CVE-2026-19706
During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file ports 22623/22624, extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the...
CVE-2026-39431
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers without administrator-level access to execute arbitrary commands on the device as root. This is due to insufficient inpu...
CVE-2026-39431: n/a: On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service…
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers without administrator-level access to execute arbitrary commands on the device as root. This is due to insufficient inpu...
PT-2026-136976
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers without administrator-level access to execute arbitrary commands on the device as root. This is due to insufficient inpu...
EUVD-2026-116924
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers without administrator-level access to execute arbitrary commands on the device as root. This is due to insufficient inpu...
CVE-2026-39431
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers without administrator-level access to execute arbitrary commands on the device as root. This is due to insufficient inpu...
CVE-2026-39431
The HP Poly EagleEye Cube USB 1.3.1-001267 devices are vulnerable to command injection due to insufficient input validation in an API function of a management service accessible via USB . An attacker without administrator-level access can exploit this to control part of the CSR certificate genera...
BIT-OPENBAO-2026-115369 OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowedipsanscidr restriction on IP SANs taken from a CSR when usecsrsans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/ and obtain CA-signed certificates for unauthoriz...
Cambium cnMatrix EX3024F — SSL CSR Command Injection (Root RCE) — Detect
Fingerprint / reachability check for Cambium cnMatrix EX3024F — SSL CSR Command Injection Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Cambium cnMatrix EX3024F — SSL CSR Command Injection Root RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclie...
Cambium cnMatrix SSL CSR command injection root RCE
Authenticated admin session; COMMONNAME field injected as ";CMD;echo " executed during CSR generation. """Cambium cnMatrix SSL CSR COMMONNAME command injection root RCE.""" from future import annotations import re from urllib.parse import urlencode, unquote from kittysploit import from...
CVE-2026-115369
The OpenBao software (versions 2.5.0 before 2.6.2) contains a vulnerability where it fails to enforce the allowed_ip_sans_cidr restriction on IP SANs. When use_csr_sans is enabled, authenticated callers with sign permission can submit a Certificate Signing Request (CSR) containing an out-of-range...
CVE-2026-115369 OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowedipsanscidr restriction on IP SANs taken from a CSR when usecsrsans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/ and obtain CA-signed certificates for unauthoriz...
CVE-2026-115369 OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowedipsanscidr restriction on IP SANs taken from a CSR when usecsrsans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/ and obtain CA-signed certificates for unauthoriz...
CVE-2026-115369 OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowedipsanscidr restriction on IP SANs taken from a CSR when usecsrsans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/ and obtain CA-signed certificates for unauthoriz...
CLEANSTART-2026-SF17865 Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response
CVE-2026-75805 affects multiple packages. Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. See references for individual vulnerability details...
SUSE CVE-2026-75805
Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...