34572 matches found
Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...
CVE-2026-82053 Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...
CVE-2026-86600 Workload identity attestation generated before login host validation in Snowflake drivers
In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...
Windows Network Connection Broker Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally...
Windows Network Connection Broker Information Disclosure Vulnerability
Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally...
Windows Remote Access Connection Manager Tampering Vulnerability
Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally...
Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability
Use after free in Windows Internet Connection Sharing ICS allows an authorized attacker to elevate privileges locally...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS
A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer SASL UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of...
389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS
A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer SASL UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of...
BLUE-SPY
BLUE-SPY - Fast Pair 脆弱性調査ツール セキュリティ免責事項と法的警告 ⚠️ 本ソフトウェアは、認可されたセキュリティ研究および倫理的なテストのみを目的としています。⚠️ このツールを、あなたが所有していない、または明示的な書面による許可を得ていないデバイスに対して不正に使用することは 違法 であり、以下の結果を招く可能性があります。 世界各国のコンピュータ詐欺および不正使用防止法（CFAA）および類似の法律に基づく刑事訴追 プライバシー侵害および不正アクセスに対する民事訴訟 盗聴罪 重大な法的・金銭的制裁...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
EUVD-2026-72612
Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent '...
SUSE CVE-2026-18924
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...
SUSE CVE-2026-19931
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...