CVE-2024-32482 Tillitis TKey Signer possible RAM disclosure vulnerability

The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom client application and to touch the...

CVE-2024-32482

The CVE-2024-32482 concerns the Tillitis TKey Signer device application (ed25519 signer). A vulnerability can disclose portions of the TKey’s data in RAM over the USB interface when the device is touched and a custom client is used. No secret is disclosed. Exploitation requires local access via U...

CVE-2024-2446

Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an authenticated attacker to crash the client applications of other users via large, crafted messages...

CVE-2024-2446

Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an authenticated attacker to crash the client applications of other users via large, crafted messages...

Dell SupportAssist for Business PCs Local Authentication Bypass Vulnerability

Dell SupportAssist for Business PCs is a client application for business computers from Dell USA. The program provides automated, proactive and predictive techniques for troubleshooting and more. A local authentication bypass vulnerability exists in Dell SupportAssist for Business PCs version...

Any authenticated user may obtain private message details from other users on the same instance

Summary Users can report private messages, even when they're neither sender nor recipient of the message. The API response to creating a private message report contains the private message itself, which means any user can just iterate over message ids to loudly obtain all private messages of an...

GitLab 7.7 < 14.1.7 / 14.2 < 14.2.5 / 14.3 < 14.3.1 (CVE-2021-39881)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick...

Design/Logic Flaw

The Android Client application, when enrolled with the define method 1the user manually inserts the server ip address, use HTTP protocol to retrieve sensitive information ip address and credentials to connect to a remote MQTT broker entity instead of HTTPS and this feature is not configurable by...

CVE-2023-46102

The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI device. The protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric...

CVE-2023-46102

The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI device. The protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric...

CVE-2023-46102

CVE-2023-46102 describes a vulnerability in the Android Client (enrolled to AppHub) that communicates with an MQTT broker for remote management of the HMI device. The protocol is built on top of MQTT and uses a hard-coded DES symmetric key, which can be recovered by reversing the Android Client a...

CVE-2023-45851

The CVE-2023-45851 entry describes an issue in the Android Client (enrolled to the AppHub server) where the client connects to an MQTT broker without enforcing server authentication. This allows an attacker to persuade the Android Client to connect to a malicious MQTT broker, enabling the attacke...

CVE-2023-45321

The CVE-2023-45321 issue affects the Android Client application when enrolled with define method 1, where the app retrieves sensitive data (IP address and credentials to the MQTT broker) over HTTP instead of HTTPS. The behavior is not configurable by the user and results from plain HTTP transmiss...

CVE-2023-45321

The Android Client application, when enrolled with the define method 1 the user manually inserts the server ip address, use HTTP protocol to retrieve sensitive information ip address and credentials to connect to a remote MQTT broker entity instead of HTTPS and this feature is not configurable by...

CVE-2023-45321

The Android Client application, when enrolled with the define method 1 the user manually inserts the server ip address, use HTTP protocol to retrieve sensitive information ip address and credentials to connect to a remote MQTT broker entity instead of HTTPS and this feature is not configurable by...

CVE-2023-45220

CVE-2023-45220 concerns the Android Client when enrolled via define method 1 (manual server IP entry). The vulnerability arises because it uses HTTP to retrieve sensitive information (IP address and credentials to connect to a remote MQTT broker) instead of HTTPS, and this behavior is not configu...

CVE-2023-45220

The Android Client application, when enrolled with the define method 1the user manually inserts the server ip address, use HTTP protocol to retrieve sensitive information ip address and credentials to connect to a remote MQTT broker entity instead of HTTPS and this feature is not configurable by...

CVE-2023-45220

The Android Client application, when enrolled with the define method 1the user manually inserts the server ip address, use HTTP protocol to retrieve sensitive information ip address and credentials to connect to a remote MQTT broker entity instead of HTTPS and this feature is not configurable by...

CVE-2023-41372

The vulnerability allows an unprivileged untrusted third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcode...

CVE-2023-41372

The CVE-2023-41372 issue affects the Android Client application. It allows an unprivileged third‑party app to arbitrarily modify the client’s server settings, causing the device to connect to an attacker‑controlled malicious server. Root cause: forging a valid broadcast intent encrypted with a ha...