CVE-2024-48644

CVE-2024-48644 2024년 9월 CVE 세부 정보 CVE: https://vulners.com/cve/CVE-2024-48644 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-48644 Tenable: https://www.tenable.com/cve/CVE-2024-48644 계정 열거 및 추측 가능한 사용자 계정 요약 Reolink Duo 2 WiFi 카메라펌웨어 버전 v3.0.0.188923031701의 로그인 구성 요소에서 발견된 계정 열거 취약점으로, 원격의 인증되지 않...

securitybot

Securitybot Distributed alerting for the masses! Securitybot is an open-source implementation of a distributed alerting chat bot, as described in Ryan Huber's blog post. Distributed alerting improves the monitoring efficiency of your security team and can help you catch security incidents faster...

securitybot

Securitybot 모두를 위한 분산 알림! Securitybot은 Ryan Huber의 블로그 포스트에서 설명한 분산 알림 채팅 봇의 오픈소스 구현체입니다. 분산 알림은 보안 팀의 모니터링 효율성을 향상시키고 보안 사고를 더 빠르고 효율적으로 포착하는 데 도움을 줍니다. 이 코드에서 Dropbox 특화 요소를 최대한 제거하여 여러분이 자신의 인스턴스를 설정하는 데 어려움이 없도록 했습니다. virtualenv/Docker 컨테이너에 나열된 요구 사항을 설치하고 봇이 알아서 동작하도록 하는 것은 비교적 쉬울 것입니다. 또한...

cve-2026-25676

CVE-2026-25676 연구 M-Track Duo HD 설치 프로그램의 DLL 검색 경로 하이재킹 개요 이 저장소는 M-Track Duo HD 1.0.0 설치 프로그램에 영향을 미치는 DLL 검색 경로 하이재킹 취약점인 CVE-2026-25676과 관련된 초기 연구 및 개념 증명을 포함합니다. 이 프로젝트의 목표는 이 취약점 클래스와 관련된 근본 원인, 영향 및 탐지 기회를 문서화하는 것으로, 적대자 시뮬레이션, 방어적 가시성 및 보안 연구에 중점을 둡니다. 이 작업은 교육 및 방어적 보안 목적으로 작성되었습니다. ⸻ 취약...

CVE-2026-103416

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TL...

CVE-2026-103416

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TL...

CVE-2026-103416

The Eclipse ThreadX NetX Duo version 6.5.1.202602 contains an out-of-bounds write vulnerability in the TLS 1.3 handshake message cache . An attacker can provide a handshake message larger than the allocated cache, causing data to be written into the session control block and overwriting internal ...

EUVD-2026-94228

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TL...

CVE-2026-103416

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TL...

CVE-2026-103416

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TL...

PT-2026-107437

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TL...

duo-agentflow-auditor

Duo AgentFlow Auditor AI 코드 보안 — AI 생성 코드에서 SAST가 놓치는 것을 포착합니다 GitLab Duo Agent Platform 기반 AI 생성 코드의 40-62%에 보안 취약점이 포함되어 있습니다. 기존 SAST는 CVE를 탐지합니다. 우리는 SAST가 놓치는 것 — 프롬프트 인젝션, LLM 출력 실행, 안전하지 않은 ML 역직렬화를 탐지합니다. 시작하기 · 아키텍처 · 탐지 규칙 · 설정 가이드 · 구현 문제점 AI는 코드 생성을 가속화하지만 새로운 보안 병목 현상을 만듭니다: 문제| 영향...

GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory. The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own...

CVE-2026-90970

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

EUVD-2026-91651

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-102761

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...

CVE-2026-102762

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbou...

CVE-2026-102718

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...