CVE-2022-1959

CVE-2022-1959 affects AppLock version 7.9.29, where biometric authentication can be bypassed by an attacker with physical access due to improper fingerprint validation. Multiple connected sources corroborate the flaw in AppLock 7.9.29 and describe the impact as bypassing biometric auth. Reported ...

PT-2022-14219 · Applock · Applock

Name of the Vulnerable Software and Affected Versions: AppLock version 7.9.29 Description: The issue allows an attacker with physical access to the device to bypass biometric authentication due to incorrect implementation of fingerprint validations. Recommendations: For AppLock version 7.9.29,...

curl: CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 bypass if string not 32 chars

Summary: Due to logic flaw in CURLOPTSSHHOSTPUBLICKEYMD5 handling, the host fingerprint validation will be bypassed if the passed a string that is not exactly 32 characters long. Steps To Reproduce: 1. curleasysetoptcurl, CURLOPTSSHHOSTPUBLICKEYMD5, "afe17cd62a0f3b61f1ab9cb22ba269a"; // 31 chars ...

jenkins: Arbitrary file existence check in file fingerprints

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path...

jenkins: Arbitrary file existence check in file fingerprints

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path...

CVE-2021-21606

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path...

CVE-2021-21606

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path...

CVE-2006-3418

Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint line matches its identity key, which allows remote attackers to spoof the fingerprint line, which might be trusted by users or other applications...

CVE-2006-3418

Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint line matches its identity key, which allows remote attackers to spoof the fingerprint line, which might be trusted by users or other applications...