CVE-2024-8891

An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware version 1.0.4...

PT-2024-12161 · Unknown · Technitium

Name of the Vulnerable Software and Affected Versions: Technitium version 11.0.2 Description: An issue was discovered in the DNS resolving software, which triggers a resolver to ignore valid responses, thus causing a denial of service for normal resolution. The effects of an exploit would be...

CVE-2023-30464

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack...

Technitium DNS Server 安全漏洞

Technitium DNS Server is an open source authoritative and recursive DNS server from the Technitium team. It can be used to self-host DNS servers for privacy and security. A security vulnerability exists in Technitium DNS Server version 11.0.2, which stems from the resolver ignoring valid response...

CIRCUTOR Q-SMT 安全漏洞

CIRCUTOR Q-SMT is an industrial hardware device from CIRCUTOR, Inc. A security vulnerability exists in CIRCUTOR Q-SMT version 1.0.4, which stems from an attacker's ability to construct a dictionary of potential users and inspect server responses without knowing the current user in the web...

CVE-2023-30464

CVE-2023-30464 affects CoreDNS up to version 1.10.1, where the DNS cache can be poisoned and fake responses injected via a birthday attack. The root cause details are not fully disclosed in the provided documents, but multiple sources consistently describe a CoreDNS DNS cache poisoning vector via...

PT-2024-12162 · Coredns · Coredns

Name of the Vulnerable Software and Affected Versions: CoreDNS versions through 1.10.1 Description: An issue was discovered in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could forge...

Improper Certificate Validation

libcurl.so is vulnerable to Improper Certificate Validation. The vulnerability is caused due to improper handling of OCSP responses, allowing an attacker to exploit the failure to correctly handle certain OCSP response statuses, such as "unauthorized," and mislead the system into accepting an...

Ubuntu: Security Advisory (USN-7012-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-7012-1: curl vulnerability

Hiroki Kurosawa discovered that curl incorrectly handled certain OCSP responses. This could result in bad certificates not being checked properly, contrary to expectations...

CVE-2024-45368 AutomationDirect DirectLogic H2-DM1E Session Fixation

The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed anomaly in the H2-DM1E PLC's protocol execution, namely its acceptance of multiple distinct packets as valid authentication responses. This...

CVE-2024-34336

User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the server responses of the forgot password functionality...

CVE-2024-34336

User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the server responses of the forgot password functionality...

CVE-2024-34336

User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the server responses of the forgot password functionality...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through the incorrect XPath selector due to improper verification of the SAML Response signature. An attacker with access to any signed SAML document can forge a SAML Response/Assertion...

OpenSC 安全漏洞

OpenSC is an open source smart card tool and middleware from OpenSC Open Source. A security vulnerability exists in OpenSC, which stems from the presence of a heap-based buffer overflow vulnerability, where a well-designed USB device or smart card responding maliciously to APDUs could result in...

NewStart CGSL MAIN 6.02 : python-requests Vulnerability (NS-SA-2024-0058)

The remote NewStart CGSL host, running version MAIN 6.02, has python-requests packages installed that are affected by a vulnerability: - A flaw was found in the way python-requests set the domain cookie parameter for certain HTTP responses. A remote attacker could use this flaw to modify a cookie...

AZL-48817 CVE-2024-45620 affecting package opensc 0.23.0-5

A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accesse...

DEBIAN-CVE-2024-45620

A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accesse...

DEBIAN-CVE-2024-45617

A vulnerability was found in OpenSC, OpenSC tools, PKCS11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to...