MTN Group: Yet Another OTP code Leaked in the API Response

The OTP code was leaked in the API response, which compromised the purpose of its implementation. The application requested a phone number for authentication and sent an OTP code to the user, but the OTP was returned in the API response, exposing it to potential misuse...

Where to find Talos at BlackHat 2024

With Black Hat just a week away, Cisco Talos is gearing up for another year of heading to Las Vegas to share in some of the latest major cybersecurity announcements, research and news. This year marks the 10th anniversary of Cisco Talos, as the Talos brand was officially launched in August 2014 a...

CVE-2024-7337

A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200L 9.3.5u.6146B20201023. Affected by this issue is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument httphost leads to buffer overflow. The attack may be launched remotely. T...

CVE-2024-7330 YouDianCMS ydLib.php curl_exec server-side request forgery

A vulnerability has been found in YouDianCMS 7 and classified as critical. Affected by this vulnerability is the function curlexec of the file /App/Core/Extend/Function/ydLib.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The...

MTN Group: OTP code Leaked in API Response

The application allowed users to sign up for device insurance. When getting a quote, an OTP code was sent to the user's phone number for authentication, but the same OTP code was also returned in the API response...

CVE-2024-38431

Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy...

CVE-2024-38431

Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy...

CVE-2024-38431 Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy

Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy...

CVE-2024-38431 Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy

Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy...

CVE-2024-38431

CVE-2024-38431 relates to Matrix Tafnit v8 and CWE-204: Observable Response Discrepancy. The available documents identify Matrix Tafnit version 8 as affected, with the underlying issue described as an observable response discrepancy. Exploitation status is not documented in the provided sources. ...

HTTP Request/Response Smuggling

Twisted is vulnerable to HTTP Request/Response Smuggling. The vulnerability is due to the HTTP 1.0 and 1.1 server provided by twisted.web which can process pipelined HTTP requests out-of-order...

Zomato: OTP Bypass via Response Manipulation

OTP One-Time Password bypass via response manipulation is a technique where an attacker intercepts and alters the server's response to bypass the OTP verification step. Response Manipulation: The attacker manipulates the server's response. For example, they might change a response indicating OTP...

CVE-2024-7217

TOTOLINK CA300-PoE 6.2c.884 is affected by CVE-2024-7217. The vulnerability resides in the loginauth function of /cgi-bin/cstecgi.cgi, where manipulation of the password argument causes a buffer overflow. Exploitation can be performed remotely, and public disclosures exist. Affected software/vers...

PT-2024-38422 · Logsign · Logsign Unified Secops Platform

Name of the Vulnerable Software and Affected Versions: Logsign Unified SecOps Platform affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of Logsign Unified SecOps Platform. Authentication is required to...

Matrix Tafnit 安全漏洞

Matrix Tafnit is an enterprise resource planning solution from Matrix. A security vulnerability exists in Matrix Tafnit version v8 that stems from observable response differences...

PT-2024-28000 · Unknown · Matrix Tafnit

Name of the Vulnerable Software and Affected Versions: Matrix Tafnit version 8 Description: The issue is related to Observable Response Discrepancy, identified as CWE-204. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where...

CVE-2024-41671 twisted.web has disordered HTTP pipeline response

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1...

CVE-2024-7188 Bylancer Quicklancer GET Parameter listing sql injection

A vulnerability was found in Bylancer Quicklancer 2.4. It has been rated as critical. This issue affects some unknown processing of the file /listing of the component GET Parameter Handler. The manipulation of the argument range2 leads to sql injection. The attack may be initiated remotely. The...

CVE-2024-7184 TOTOLINK A3600R cstecgi.cgi setUrlFilterRules buffer overflow

A vulnerability has been found in TOTOLINK A3600R 4.1.2cu.5182B20201102 and classified as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument url leads to buffer overflow. The attack can be launched remotely...

CVE-2024-7181 TOTOLINK A3600R cstecgi.cgi setTelnetCfg command injection

A vulnerability classified as critical was found in TOTOLINK A3600R 4.1.2cu.5182B20201102. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument telnetenabled leads to command injection. The attack can be initiated remotely. The...