Embedthis Software GoAhead Request Replay Attack Vulnerability

Embedthis Software GoAhead is an embedded Web server from Embedthis Software, USA. A request replay attack vulnerability exists in Embedthis Software GoAhead versions prior to 5.1.2, which stems from GoAhead's failure to properly handle nonce values during Digest authentication, and can be...

CVE-2020-15688

The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel...

CVE-2020-15688

The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel...

PT-2020-14585 · Goahead · Goahead Web Server

Name of the Vulnerable Software and Affected Versions: GoAhead web server versions prior to 5.1.2 Description: The issue concerns the HTTP Digest Authentication in the GoAhead web server, which does not fully protect against replay attacks. This allows an unauthenticated remote attacker to bypass...

openstack-keystone: failure to check signature TTL of the EC2 credential auth method

A flaw was found in Keystone, where the restriction was not checked for the Signature Version 4 V4 process of AWS signatures issued within a limited time window. This flaw allows an attacker to capture an auth header and reuse it, potentially maintaining indefinite access...

Authentication flaw

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. An error in the challenge-response procedure could allow an attacker to replay authentication traffic and gain access to protected areas of the web application...

CVE-2020-10045

The CVE affects Siemens SICAM MMU (all versions before 2.05), SICAM SGU (all versions), and SICAM T (all versions before 2.18). Root cause is an error in the challenge-response procedure allowing replay of authentication traffic to reach protected web areas, effectively enabling an authentication...

CVE-2020-10045

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. An error in the challenge-response procedure could allow an attacker to replay authentication traffic and gain access to protected areas of the web application...

CVE-2020-4042

Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge...

UBUNTU-CVE-2020-4042

Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge...

CVE-2020-9414

The MFT admin service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contains a vulnerability that theoretically allows an authenticated user with specific permissions to obtain the session identifier of another user...

CVE-2020-9438

Tinxy Door Lock with firmware before 3.2 allow attackers to unlock a door by replaying an Unlock request that occurred when the attacker was previously authorized. In other words, door-access revocation is mishandled...

CVE-2020-9438

Tinxy Door Lock with firmware before 3.2 allow attackers to unlock a door by replaying an Unlock request that occurred when the attacker was previously authorized. In other words, door-access revocation is mishandled...

Shopify: Low Privileged user can add or remove cash to/from sales register

Low privileged user having no access to Shopify POS and very low permission set is not allowed to add cash to the sales register or remove cash from the sales register. But missing server-side permission checks on the vulnerable request allows a low privileged user to do this. A low privileged ca...

Squid Code Execution Vulnerability

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in versions of Squid prior to 5.0.2. An attacker can exploit the vulnerability by...

Design/Logic Flaw

An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter a short integer. Remote code execution may occur if...

CVE-2020-11945

An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter a short integer. Remote code execution may occur if...

Replay Attack

pki is vulnerable to replay attack. The certificate authority allowed the one-time PIN used in SCEP requests to be re-used. An attacker possessing a valid SCEP enrollment one-time PIN could use it to generate an unlimited number of certificates...

Replay Attack

SeaMonkey is vulnerable to a Replay Attack. A flaw was found in the SeaMonkey NT Lan Manager NTLM authentication protocol implementation. If an attacker could trick a local user that has NTLM credentials into visiting a specially-crafted web page, they couldsend arbitrary requests, authenticated...

Replay Attack

github.com/ory/hydra is vulnerable to replay attack. During the client authentication using the method privatekeyjwt, Hydra does not check the uniqueness of jti token a unique identifier for the token to prevent the reuse of the token more than one time unless there are conditions for reuse betwe...