1044 matches found
CVE-2023-27584
Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation CNCF as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to...
CVE-2023-27584 Dragonfly2 vulnerable to hard coded cyptographic key
Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation CNCF as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to...
CVE-2023-27584
CVE-2023-27584 affects Dragonfly2, an open-source P2P file distribution system. The vulnerability is caused by a hard-coded JWT secret key, "Secret Key", which enables authentication bypass. An attacker can perform actions with admin privileges by crafting a valid JWT token, potentially accessing...
Exploit for CVE-2024-45200
Kart"LAN"Pwn CVE-2024-45200https://nvd.nist.gov/vuln/detai...
Exploit for CVE-2024-45200
Kart"LAN"Pwn CVE-2024-45200https://nvd.nist.gov/vuln/detai...
Gather Kademlia Server Information
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Gather Kademlia Server Information', 'Description' = %q This module uses the Kademlia BOOTSTRAP and PING messages to identify and extract...
MAL-2024-8095 Malicious code in investitsionnaia-platforma-finam-p2p-zil8cb0ii (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0f7ffb84c271562d5d11d1e496b4ab57ad68d9fd2d3196f82b59d0c028cdbf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in investitsionnaia-platforma-finam-p2p-zil8cb0ii
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in finam-p2p-nvsniohj8 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c72a6c8ed38a861980c68e6752dc171adaf30ae4b9080b9aefe4a71b5a5d34eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in finam-p2p-nvsniohj8
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
GO-2022-0456 DoS via malicious p2p message in Go Ethereum in github.com/ethereum/go-ethereum
DoS via malicious p2p message in Go Ethereum in github.com/ethereum/go-ethereum...
ThroughTek P2P SDK Cleartext Transmission of Sensitive Information (CVE-2021-32934)
ThroughTek supplies multiple original equipment manufacturers of IP cameras & recorders with P2P connections as part of its cloud platform. Successful exploitation of this vulnerability could permit unauthorized access to sensitive information, such as camera audio/video feeds. This plugin only...
ThroughTek Kalay P2P SDK Improper Access Control (CVE-2021-28372)
ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek TUTK device given a valid 20-byte uniquely assigned identifier UID. This could result in an attacker hijacking a victim's connection and forcing them into supplying credentials needed to access the...
(Pwn2Own) Wyze Cam v3 TCP Traffic Handling Stack-Based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TUTK P2P library. The issue results from the lack of proper...
CLSA-2024-1715951065 kernel: Fix of 10 CVEs
scsi: lpfc: Fix use-after-free in lpfcunregrpi routine CVE-2021-47198 - fs,hugetlb: fix NULL pointer dereference in hugetlbsfillsuper CVE-2024-0841 - bpf: Fix incorrect verifier pruning due to missing register precision taints CVE-2023-2163 - bpf: Fix hashtab overflow check on 32-bit arches...
RHEL 7 : wpa_supplicant (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - wpasupplicant: local configuration update allows privilege escalation CVE-2016-4477 - wpasupplicant: P2P...
Resource Exhaustion
go-ethereum geth is vulnerable to a Resource Exhaustion. The vulnerability is due to a lack of proper handling of specially crafted p2p messages sent from an attacker node, causing vulnerable nodes to consume excessive amounts of memory...
CVE-2024-32972
go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix has been included in geth version 1.13.15...
CVE-2024-32972 go-ethereum denial of service via malicious p2p message
go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix has been included in geth version 1.13.15...
CVE-2024-32972 go-ethereum denial of service via malicious p2p message
go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix has been included in geth version 1.13.15...