CVE-2024-21507

CVE-2024-21507 affects the mysql2 npm package: all versions before 3.9.3 are vulnerable due to improper input validation in the keyFromFields function, allowing cache poisoning via a colon (:) inside an attacker-crafted key value. Impact is described as confidentiality/integrity concerns in vario...

PT-2023-22241 · Toyota · Toyota Rav4

Name of the Vulnerable Software and Affected Versions: Toyota RAV4 2021 vehicles Description: The issue allows physically proximate attackers to drive a vehicle by accessing the control CAN bus after pulling the bumper away and reaching the headlight connector, and then sending forged "Key is...

SUSE CVE-2016-8614

A flaw was found in Ansible before version 2.2.0. The aptkey module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key...

SUSE CVE-2018-12356

An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extension script...

Remote Control Collection Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Remote Control Collection RCE', 'Description' = %q This module utilizes the Remote Control Server's, part of the Remote Control Collection by...

PT-2022-24845 · Unknown · Matrix-Rust-Sdk

Name of the Vulnerable Software and Affected Versions: matrix-rust-sdk versions prior to 0.6 Description: The issue arises when a user requests a room key from their devices. The software correctly remembers the request but fails to check the origin of the forwarded room key, allowing homeservers...

CVE-2022-34464

CVE-2022-34464 affects Siemens SICAM GridEdge (Classic) and GridEdge Essential variants, where an improperly protected file used to import SSH keys can be written by a user with host filesystem access. Affected versions include SICAM GridEdge GridEdge Essential Intel/ARM (all versions before v2.7...

Siemens SICAM GridEdge

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SICAM GridEdge Vulnerability: Exposure of Resource to Wrong Sphere 2. RISK EVALUATION The SICAM GridEdge software contains an improper access control vulnerability, which could allow...

CVE-2019-2102

In the Bluetooth Low Energy BLE specification, there is a provided example Long Term Key LTK. If a BLE device were to use this as a hardcoded LTK, it is theoretically possible for a proximate attacker to remotely inject keystrokes on a paired Android host due to improperly used crypto. User...

DEBIAN-CVE-2016-8614

A flaw was found in Ansible before version 2.2.0. The aptkey module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key...

DEBIAN-CVE-2018-12356

An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extension script...

i18next cross-site scripting vulnerability (CNVD-2018-14353)

i18next is a translation loading framework written in JavaScript. A cross-site scripting vulnerability exists in i18next 1.10.2 and earlier versions. A remote attacker can exploit this vulnerability by injecting script into the browser with the help of dictionary key names...

USB Device Wireless Key Injection or DoS (MouseJack)

The remote Windows host has used a wireless USB keyboard device that is potentially affected by a key injection or denial of service vulnerability that allows a physically local attacker to send keystrokes to the host. Note that Nessus cannot determine when the USB device was last used on the...

Logitech Unifying Receiver Key Injection (MouseJack)

The remote Windows host has used a Logitech Unifying Receiver wireless USB device with firmware version 12.01 or 12.03. It is potentially affected by a wireless key injection vulnerability that allows a physically local attacker to send keystrokes to the host. Note that Nessus cannot determine wh...

Cross site request forgery (csrf)

The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to execute arbitrary code via a crafted remotetask request, related to injecting an ssh public key...

Google Compute Engine Lateral Compromise

A user who creates a GCE VM with compute-rw privileges, who subsequently has that single VM compromised, can lead to a global compromise of all VMs inside of the account. VMs created in the web UI, by default, come with compute-rw privileges. Google’s account manager fetches ssh keys from the...

ThinkSAAS SQL注入#6

简要描述： ThinkSAAS SQL注入6 详细说明： thinksaas在添加标签处，由于不完全的过滤，以及特殊的构造拼接导致sql注入。 在/app/tag/action/add.php文件： case "do": $objname = t$POST'objname'; $idname = t$POST'idname'; $objid = intval$POST'objid'; $tags = t$POST'tags'; $new'tag'-addTag$objname,$idname,$objid,$tags; tsNotice'标签添加成功！'; break;...

RTS CryptoBuddy Multiple Encryption Implementation Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 RTS CryptoBuddy Multiple Encryption Implementation Vulnerabilities Advisory Information Severity: High Risk Vendor: Research Triangle Software, Inc. Homepage: http://www.rtsz.com/ Advisory reported to vendor: February 2, 2003 Author: Michael Whitehead...