1244 matches found
CTT-enhanced-Apache-mod_auth_digest-timing-attack-exploit
CTT-enhanced-Apache-modauthdigest-timing-attack-exploit CTT-Enhanced Apache modauthdigest Timing Attack — CVE-2026-33006 Remote Digest Authentication Bypass → 33-Layer Temporal Timing Attack Original vulnerability: Apache HTTP Server 2.4.66 modauthdigest timing leak CTVSS Original: 4.8 Medium...
PoC_CVE-2019-0217
This repository contains a proof of concept exploit for CVE-2019-0217, along with a Dockerfile to set up a web server vulnerable to the CVE. CVE Description In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in modauthdigest when running in a threaded server could allow a user...
CVE-2026-21010-VoIP-SIP-Digest-Authentication-Replay
CVE-2026-21010 – VoIP SIP Digest Authentication Replay Program Code Python SIP sim sipserversim.py - SIP server that accepts replayed authenticated requests from flask import Flask, request app = Flaskname Simulated nonce storage: doesn't track used nonces usednonces = set @app.route'/call',...
cve-2026-43512-poc
CVE-2026-43512 — Apache Tomcat DIGEST Authentication Bypass Exploitability analysis result: the root cause is confirmed. End-to-end exploitation is not reproducible against a standard UserDatabaseRealm deployment. See Analysis for details. Table of Contents Overview Affected Versions Root Cause...
CLEANSTART-2026-LN18272 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes
CVE-2026-10050 affects multiple packages. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. See references for individual vulnerability details...
MiracleLinux 9 : curl-7.76.1-40.el9_8.8 (AXSA:2026-2080:08)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2080:08 advisory. curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure via incorrect Digest...
Astra Linux – Vulnerability in Tomcat9
DEPRECATED: There is a vulnerability related to authentication bypass in digest authentication in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and versions prior to 7.0.0...
jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision
A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...
CLEANSTART-2026-KO81202 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes
Security vulnerability affects the kafka package. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gstreamer1-plugins-base (UTSA-2026-130054)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130054 advisory. A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header tha...
Rocky Linux 9 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (crlsa-2026_80511)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680511 advisory. curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure via incorrect Digest...
CVE-2026-88158
Out-of-bounds read in Microsoft Digest Authentication allows an authorized attacker to disclose information locally...
CVE-2026-88158
An out-of-bounds read vulnerability exists in Microsoft Digest Authentication . This flaw allows an authorized attacker to disclose information locally . The vulnerability is characterized by a MEDIUM severity (CVSS 3.1 score of 5.5) and involves an attack vector originating from the local system...
Microsoft Digest Authentication Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Digest Authentication allows an authorized attacker to disclose information locally...
RLSA-2026:80511 Moderate: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure...
curl security update
An update is available for curl. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...
PT-2026-112968
Name of the Vulnerable Software and Affected Versions Microsoft Digest Authentication affected versions not specified Description An out-of-bounds read in Microsoft Digest Authentication allows an authorized attacker to disclose sensitive information locally, which can affect the system...
Microsoft Windows: CVE-2026-88158: Microsoft Digest Authentication Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Digest Authentication allows an authorized attacker to disclose information locally...
CVE-2026-88158: Out-of-bounds Read
Out-of-bounds read in Microsoft Digest Authentication allows an authorized attacker to disclose information locally...
curl: curl: Information disclosure via incorrect Digest authentication header reuse
A flaw was found in curl. When libcurl performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This...