Use of GET Request Method With Sensitive Query Strings

Overview Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings in the handleOperatorCreateAPIKey process. An attacker can obtain sensitive API keys by accessing browser history, reverse-proxy logs, or Referer headers, which may expose the raw...

Use of GET Request Method With Sensitive Query Strings

Overview Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings in the handleOperatorCreateAPIKey process. An attacker can obtain sensitive API keys by accessing browser history, reverse-proxy logs, or Referer headers, which may expose the raw...

GHSA-RQFJ-VV8R-XHQC nebula-mesh: Session and OIDC state cookies lack the Secure attribute

internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration discloses the session. Affected All released...

Sensitive Cookie in HTTPS Session Without "Secure" Attribute

Overview Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without "Secure" Attribute due to the lack of the Secure attribute on session and OIDC state cookies in the authentication process. An attacker can recover session cookies and impersonate a user or enab...

Improper Clearing of Heap Memory Before Release ('Heap Inspection')

Overview Affected versions of this package are vulnerable to Improper Clearing of Heap Memory Before Release 'Heap Inspection' due to the improper clearing of decrypted CA private keys from memory after use in the CAManager process. An attacker can access sensitive cryptographic material by...

CVE-2023-43688

An issue was discovered in Malwarebytes 4.x and 5.x and Nebula 2020-10-21 and later. There is a Heap buffer overflow in various buffer encryption utilities...

CVE-2023-43688

An issue was discovered in Malwarebytes 4.x and 5.x and Nebula 2020-10-21 and later. There is a Heap buffer overflow in various buffer encryption utilities...

CVE-2023-43686

An issue was discovered in Malwarebytes 4.x and 5.x and Nebula 2020-10-21 and later. A large number of Firefox preference files can cause the parser to ignore other browser configuration files, leading to a denial of service...

CVE-2023-43688

An issue was discovered in Malwarebytes 4.x and 5.x and Nebula 2020-10-21 and later. There is a Heap buffer overflow in various buffer encryption utilities...

CVE-2023-43686

An issue was discovered in Malwarebytes 4.x and 5.x and Nebula 2020-10-21 and later. A large number of Firefox preference files can cause the parser to ignore other browser configuration files, leading to a denial of service...

PT-2026-48155

An issue was discovered in Malwarebytes 4.x and 5.x and Nebula 2020-10-21 and later. A large number of Firefox preference files can cause the parser to ignore other browser configuration files, leading to a denial of service...

CVE-2023-43688: Heap-based Buffer Overflow

An issue was discovered in Malwarebytes 4.x and 5.x and Nebula 2020-10-21 and later. There is a Heap buffer overflow in various buffer encryption utilities...

CVE-2023-43686

A vulnerability exists in Malwarebytes 4.x and 5.x (as well as Nebula 2020-10-21 and later ). The root cause is that a large number of Firefox preference files can cause the parser to ignore other browser configuration files. This flaw can lead to a denial of service (DoS) . Exploitation details ...

CVE-2023-43688

An issue was discovered in Malwarebytes 4.x and 5.x and Nebula 2020-10-21 and later. There is a Heap buffer overflow in various buffer encryption utilities...

CVE-2023-43686

An issue was discovered in Malwarebytes 4.x and 5.x and Nebula 2020-10-21 and later. A large number of Firefox preference files can cause the parser to ignore other browser configuration files, leading to a denial of service...

CVE-2023-43688

A Heap buffer overflow vulnerability exists in Malwarebytes versions 4.x and 5.x , as well as Nebula versions from 2020-10-21 and later . The flaw originates within various buffer encryption utilities . While specific exploit details are not provided, the vulnerability poses a high risk to availa...

PT-2026-48156

An issue was discovered in Malwarebytes 4.x and 5.x and Nebula 2020-10-21 and later. There is a Heap buffer overflow in various buffer encryption utilities...

Malwarebytes EDR 异常处理不当漏洞

Malwarebytes is an application software developed by the American company Malwarebytes, which provides anti-malware capabilities for devices. This software is designed to protect against viruses, spyware, Trojan horses, worms, dialers, and other malicious software. Versions of Malwarebytes 4.x an...

Malwarebytes EDR 缓冲区错误漏洞

Malwarebytes is an application software developed by the American company Malwarebytes, which provides anti-malware capabilities for devices. This software is designed to protect against viruses, spyware, Trojan horses, worms, dialers, and other malicious software. Versions of Malwarebytes 4.x an...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the handleGetAuditLog function. An attacker can access sensitive audit log information, including cross-tenant actor names, host and operator IDs, action timestamps, and masked IP entries, by using any operato...