cve-2019-0708

CVE-2019-0708 This module checks a range of hosts for the CVE-2019-0708 vulnerability by binding the MST120 channel outside of its normal slot and sending DoS packets. I just modified the initial metasploit module for this vuln to produce a denial of service attack...

LdapRelayScan

LDAP Relay Scan A tool to check Domain Controllers for LDAP server protections regarding the relay of NTLM authentication. If you're interested in the specifics of the error-based enumeration, see below. For details regarding what can be done when you identify a lack of LDAP protections, see the...

CVE-2026-108266 Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

Astra Linux – Vulnerability in dovecot

The attacker can use a specially crafted Base64 exchange between Dovecot and the client to forge SCRAM TLS channel bindings. This requires that the attacker be able to position themselves between Dovecot and the client connection. If successful, the attacker can eavesdrop on communications betwee...

Security Bulletin: Vulnerability in pgjdbc affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in pgjdbc has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabilit...

org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A remote attacker who can intercept a TLS Transport Layer Security connection can silently downgrade connections configured to require channel binding from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256. This downgrade bypasses the...

com.ongres.scram/scram-client: com.ongres.scram/scram-common: SCRAM Libraries: Authentication downgrade via TLS man-in-the-middle attack

A flaw was found in the SCRAM Salted Challenge Response Authentication Mechanism client and common libraries. An attacker performing a man-in-the-middle MITM attack on a Transport Layer Security TLS connection can silently downgrade the authentication process. This vulnerability allows the attack...

org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A remote attacker who can intercept a TLS Transport Layer Security connection can silently downgrade connections configured to require channel binding from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256. This downgrade bypasses the...

com.ongres.scram/scram-client: com.ongres.scram/scram-common: SCRAM Libraries: Authentication downgrade via TLS man-in-the-middle attack

A flaw was found in the SCRAM Salted Challenge Response Authentication Mechanism client and common libraries. An attacker performing a man-in-the-middle MITM attack on a Transport Layer Security TLS connection can silently downgrade the authentication process. This vulnerability allows the attack...

MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Bamboo Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 10.2.2, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:4.0/AV:N/AC:H/AT: P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N...

CVE-2026-48076

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

CVE-2026-48076

OpenReception’s bootstrap booking flow (versions ≤1.0.1) is vulnerable to an unauthenticated booking against private channels due to a missing channel binding in the booking token. The 3-step flow: bootstrap-challenge (PoW), bootstrap-verify (issues a booking access token), and create-new-client ...

CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

EUVD-2026-54145

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Jira Software Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 9.12.37, 10.3.23, and 11.3.8 of Jira Software Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:4.0/AV:N/AC:H/AT: P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N...

MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Jira Service Management Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 10.3.23 and 11.3.8 of Jira Service Management Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N...

CVE-2026-53712

A flaw was found in the SCRAM Salted Challenge Response Authentication Mechanism client and common libraries. An attacker performing a man-in-the-middle MITM attack on a Transport Layer Security TLS connection can silently downgrade the authentication process. This vulnerability allows the attack...

MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Crowd Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 6.2.0, 6.3.0, 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:4.0/AV:N/AC:H/AT: P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N...