python: TLS handshake bypass

Python ssl.SSLSocket is vulnerable to a bypass of the TLS handshake in certain instances for HTTPS servers and other server-side protocols that use TLS client authentication such as mTLS. This issue may result in a breach of integrity as its possible to modify or delete resources that are...

South River Technologies Titan MFT and Titan SFTP Authorization Issues Vulnerability

South River Technologies Titan MFT and South River Technologies Titan SFTP are both products of South River Technologies.South River Technologies Titan MFT is a popular file transfer solution for managing and encrypting file transfers.South River Technologies Titan SFTP is a solution for A securi...

python: TLS handshake bypass

Python ssl.SSLSocket is vulnerable to a bypass of the TLS handshake in certain instances for HTTPS servers and other server-side protocols that use TLS client authentication such as mTLS. This issue may result in a breach of integrity as its possible to modify or delete resources that are...

ALPINE-CVE-2023-40217

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is...

OPTO 22 SNAP PAC S1 安全漏洞

The OPTO 22 SNAP PAC S1 is a controller from OPTO 22 USA. A security vulnerability exists in the OPTO 22 SNAP PAC S1 R10.3b firmware version that stems from an improperly restricted built-in web server authentication attempt that does not mandate a complex password, which could lead to brute forc...

4D SAS 4D Server 授权问题漏洞

4D SAS 4D Server is a rapid development platform for business applications from 4D. A security vulnerability exists in the 4D SAS 4D Server Application that stems from the presence of an authentication vulnerability...

CVE-2023-24476

An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid...

Code injection

An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid...

CVE-2023-24476 PTC Vuforia Studio Improper Authorization

An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid...

CVE-2023-27747

BlackVue DR750-2CH LTE v.1.0122022.10.26 does not employ authentication in its web server. This vulnerability allows attackers to access sensitive information such as configurations and recordings...

CVE-2023-23761 Improper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gists

An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by authenticating through an SSH certificate authority. To do so, a user had to know the secret gist's URL. This vulnerability affected all...

curl: CVE-2023-27535: FTP too eager connection reuse

A vulnerability existed in libcurl FTPS protocol that allowed the reuse of a connection even if different credentials were specified for different connections, resulting in the use of cached credentials for the wrong content. The vulnerability was caused by the failure to refuse caching when...

SUSE CVE-2018-15599

The recvmsguserauthrequest function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSHMSGUSERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase...

SUSE CVE-2021-38373

In KDE KMail 19.12.3 aka 5.13.3, the SMTP STARTTLS option is not honored and cleartext messages are sent unless "Server requires authentication" is checked...

PT-2023-19644 · Switch · Switch

Name of the Vulnerable Software and Affected Versions: Switch affected versions not specified Description: The issue concerns an unspecified endpoint in the switch's web server that fails to properly authenticate user identity. This may allow an attacker to download a configuration page containin...

Netgear ProSAFE FS726TP 安全漏洞

The NETGEAR ProSAFE FS726TP is a smart switch. A security vulnerability exists in the NETGEAR ProSAFE FS726TP that originates when an unspecified endpoint in the switch's web server fails to properly authenticate a user's identity, allowing configuration pages with passwords to be downloaded to t...

DEBIAN-CVE-2022-3786

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate...

CVE-2022-3786

OpenSSL CVE-2022-3602 and CVE-2022-3786 describe buffer overflows in X.509 name-constraint processing triggered by crafted email addresses in certificates, potentially crashing the TLS client/server and, in some scenarios, enabling remote code execution. Documents confirm the issues affect OpenSS...

Trend Micro Apex One Server Authentication Bypass (CVE-2022-40144)

Binary data trendmicroapexonecve-2022-40144.nbin...

OESA-2022-1771 mc security update

GNU Midnight Commander is a visual file manager, licensed under GNU General Public License and therefore qualifies as Free Software. It's a feature rich full-screen text mode application that allows you to copy, move and delete files and whole directory trees, search for files and run commands in...