223 matches found
CVE-2024-6303 Missing Authorization in Conduit
Missing authorization in Client-Server API in Conduit =0.7.0, allowing for any alias to be removed and added to another room, which can be used for privilege escalation by moving the admins alias to a room which they control, allowing them to run commands resetting passwords, siging json with the...
CVE-2024-6303 Missing Authorization in Conduit
Missing authorization in Client-Server API in Conduit =0.7.0, allowing for any alias to be removed and added to another room, which can be used for privilege escalation by moving the admins alias to a room which they control, allowing them to run commands resetting passwords, siging json with the...
CVE-2024-6303
Missing authorization in Client-Server API in Conduit =0.7.0, allowing for any alias to be removed and added to another room, which can be used for privilege escalation by moving the admins alias to a room which they control, allowing them to run commands resetting passwords, siging json with the...
CVE-2024-6303
CVE-2024-6303 describes a missing authorization flaw in Conduit before or equal to version 0.7.0 in the Client-Server API. The vulnerability allows an attacker to remove and add any alias to a room, enabling privilege escalation by moving the #admins alias to a room under attacker control. This c...
CVE-2024-6303 Missing Authorization in Conduit
Missing authorization in Client-Server API in Conduit =0.7.0, allowing for any alias to be removed and added to another room, which can be used for privilege escalation by moving the admins alias to a room which they control, allowing them to run commands resetting passwords, siging json with the...
CVE-2024-6300 Incomplete Cleanup in Conduit
Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction...
CVE-2024-6300
Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction...
CVE-2024-6300 Incomplete Cleanup in Conduit
Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction...
CVE-2024-6300
CVE-2024-6300 affects Conduit. Description and multiple connected sources confirm an incomplete cleanup during redactions, enabling an attacker to check whether certain strings were present in a PDU before redaction. Reported in multiple CVE feeds and vendor advisories; some references note histo...
CVE-2024-6300 Incomplete Cleanup in Conduit
Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction...
MAL-2024-2298 Malicious code in en-conduit-electron-worker (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in en-conduit-electron-worker (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in en-conduit-electron-renderer (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2297 Malicious code in en-conduit-electron-renderer (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2296 Malicious code in en-conduit-electron-auth (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in en-conduit-electron-auth (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2295 Malicious code in en-conduit-electron (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in en-conduit-electron (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2024-6299: Use of a Key Past its Expiration Date
Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the remote server, as well as PDUs with timestamps past the expiry date...
CVE-2024-6300: Incomplete Cleanup
Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction...