GO-2024-3036 cortex establishes TLS connections with `InsecureSkipVerify` set to `true` in github.com/cortexproject/cortex

cortex establishes TLS connections with InsecureSkipVerify set to true in github.com/cortexproject/cortex...

Improper Certificate Validation

github.com/mickael-kerjean/filestash is Improper Certificate Validation. The vulnerability is due to the InsecureSkipVerify flag being set to true, which instructs the client to bypass the validation of the server's TLS certificate, exposing the connection to man-in-the-middle attacks. Attackers...

PT-2024-29341 · Cortex · Cortex

Name of the Vulnerable Software and Affected Versions: cortex version 0.42.1 Description: A TLS certificate verification issue allows attackers to obtain sensitive information via the makeOperatorRequest function. This is due to cortex establishing TLS connections with the InsecureSkipVerify...

Control Web Panel 7 (CWP7) 0.9.8.1147 Remote Code Execution

// Exploit Title: Control Web Panel 7 CWP7 v0.9.8.1147 - Remote Code Execution RCE // Date: 2023-02-02 // Exploit Author: Mayank Deshmukh // Vendor Homepage: https://centos-webpanel.com/ // Affected Versions: version 0.9.8.1147 // Tested on: Kali Linux // CVE : CVE-2022-44877 // Github POC:...

golang: crypto/tls: certificate of wrong type is causing TLS client to panic

A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists or can be issued, or the client is configured with...

NetGain EM Plus 10.1.68 - Remote Command Execution

/ Exploit Title: NetGain EM Plus = v10.1.68 - Unauthorized Local File Inclusion Date: 15 September 2019 Exploit Author: azams / @TheRealAzams Vendor Homepage: http://netgain-systems.com Software Link: http://www.netgain-systems.com/free/ Version: v10.1.68 Tested on: Linux Install golang:...

Man-in-the-Middle (MitM)

github.com/heroku/force is vulnerable to man-in-the-middle attack. The attack is possible because it uses hard-coded root certificates and InsecureSkipVerify function of force.go...