CVE-2023-2538 TLS Private Key Accessible to External Parties

A CWE-552 "Files or Directories Accessible to External Parties” in the web interface of the Tyan S5552 BMC version 3.00 allows an unauthenticated remote attacker to retrieve the private key of the TLS certificate in use by the BMC via forced browsing. This can then be abused to perform...

Nokia ASIKA 7.13.52 - Hard-coded private key disclosure Exploit

// Exploit Title: Nokia ASIKA 7.13.52 - Hard-coded private key disclosure // Exploit Author: Amirhossein Bahramizadeh // Category : Hardware // Vendor Homepage: https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-25187/ // Version: 7.13.52 REQUIRED // Tested on:...

Silver vulnerable to MitM attack against implants due to a cryptography vulnerability

Summary The current cryptography implementation in Sliver up to version 1.5.39 allows a MitM with access to the corresponding implant binary to execute arbitrary codes on implanted devices via intercepted and crafted responses. Reserved CVE ID: CVE-2023-34758 Details Please see the PoC repo. PoC...

GHSA-8JXM-XP43-QH3Q Silver vulnerable to MitM attack against implants due to a cryptography vulnerability

Summary The current cryptography implementation in Sliver up to version 1.5.39 allows a MitM with access to the corresponding implant binary to execute arbitrary codes on implanted devices via intercepted and crafted responses. Reserved CVE ID: CVE-2023-34758 Details Please see the PoC repo. PoC...

Nokia ASIKA 7.13.52 Private Key Disclosure

// Exploit Title: Nokia ASIKA 7.13.52 - Hard-coded private key disclosure // Date: 2023-06-20 // Exploit Author: Amirhossein Bahramizadeh // Category : Hardware // Vendor Homepage: https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-25187/ // Version: 7.13.52...

PT-2023-25003 · Sliver · Sliver

Name of the Vulnerable Software and Affected Versions: Sliver versions 1.5.x through 1.5.39 Description: The issue is related to an improper cryptographic implementation, allowing attackers to execute a man-in-the-middle attack via intercepted and crafted responses. This enables attackers to...

CVE-2023-25187

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change factory-time installed default SSH public/private key values that are specific to a network operator. As a result, the CSP internal BTS network SSH server disable...

Default credentials

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change factory-time installed default SSH public/private key values that are specific to a network operator. As a result, the CSP internal BTS network SSH server disable...

CVE-2023-25187

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change factory-time installed default SSH public/private key values that are specific to a network operator. As a result, the CSP internal BTS network SSH server disable...

CVE-2023-25187

An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change factory-time installed default SSH public/private key values that are specific to a network operator. As a result, the CSP internal BTS network SSH server disable...

CVE-2023-25187

CVE-2023-25187 affects Nokia Airscale ASIKA Single RAN devices pre-21B. The issue stems from factory-time default SSH keys tied to the operator not being changed during commissioning, allowing potential MITM of the BTS service user accessed during troubleshooting when SSH is enabled. Several sour...

PT-2023-19968 · Nokia · Nokia Airscale Asika Single Ran

Name of the Vulnerable Software and Affected Versions: NOKIA Airscale ASIKA Single RAN devices versions prior to 21B Description: An issue was discovered where Nokia Single RAN commissioning procedures do not change the default SSH public/private key values that are specific to a network operator...

Nextcloud: Issuer not verified from obtained token in user_oidc

The issuer verification in the useroidc app of Nextcloud did not properly validate the issuer of the obtained token, potentially allowing for a Man-in-the-Middle attack...

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection

curl 7.63.0 to and including 7.75.0 includes a vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived...

EulerOS 2.0 SP5 : tpm2-tss (EulerOS-SA-2023-2178)

According to the versions of the tpm2-tss package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - tpm2-tss is an open source software implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software Stack TSS2. In...

Huawei EulerOS: Security Advisory for tpm2-tss (EulerOS-SA-2023-2062)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 2.11.1 : tpm2-tss (EulerOS-SA-2023-2062)

According to the versions of the tpm2-tss package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - tpm2-tss is an open source software implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software Sta...

EulerOS Virtualization 2.9.0 : tpm2-tss (EulerOS-SA-2023-2029)

According to the versions of the tpm2-tss package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - tpm2-tss is an open source software implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software Sta...

EulerOS Virtualization 2.9.1 : tpm2-tss (EulerOS-SA-2023-2008)

According to the versions of the tpm2-tss package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - tpm2-tss is an open source software implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software Sta...

CVE-2023-28348

An issue was discovered in Faronics Insight 10.0.19045 on Windows. A suitably positioned attacker could perform a man-in-the-middle attack on either a connected student or teacher, enabling them to intercept student keystrokes or modify executable files being sent from teachers to students...