Microsoft Warns of Widescale Credential Stealing Attacks by Russian Hackers

Microsoft has disclosed that it's detected a spike in credential-stealing attacks conducted by the Russian state-affiliated hacker group known as Midnight Blizzard. The intrusions, which make use of residential proxy services to obfuscate the source IP address of the attacks, target governments, ...

CVE-2023-33621

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay...

CVE-2023-33621

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay...

CVE-2023-33621

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay...

Authentication flaw

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay...

GL.iNet GL-AR750S-Ext 安全漏洞

The GL.iNet GL-AR750S-Ext is a wireless router from China's Guanglian Zhitong GL.iNet. A security vulnerability exists in the GL.iNet GL-AR750S-Ext version 3.215, which originates from the insertion of an administrator authentication token into a GET request when downloading the OpenVPN server...

CVE-2023-33621

CVE-2023-33621 concerns GL.iNET GL-AR750S-Ext firmware v3.215. The OpenVPN Server config file download issue causes the admin authentication token to be inserted into a GET request, leaving the token in browser history or access logs. This could allow a session-replay based bypass of authenticati...

CVE-2023-33621

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay...

PT-2023-24408 · Gl.Inet · Gl-Ar750S-Ext

Name of the Vulnerable Software and Affected Versions: GL.iNET GL-AR750S-Ext firmware version 3.215 Description: The issue concerns the insertion of the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. This token is then left in the browser history ...

CVE-2023-33621: Authentication Bypass by Capture-replay

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay...

CVE-2023-33621

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay...

CVE-2022-29334

An issue in H v1.0 allows attackers to bypass authentication via a session replay attack...

CVE-2022-29334

An issue in H v1.0 allows attackers to bypass authentication via a session replay attack...

CVE-2022-29334

An issue in H v1.0 allows attackers to bypass authentication via a session replay attack...

Authentication flaw

An issue in H v1.0 allows attackers to bypass authentication via a session replay attack...

CVE-2022-29334

An issue in H v1.0 allows attackers to bypass authentication via a session replay attack...

CVE-2022-29334

CVE-2022-29334 describes an authentication bypass in the H v1.0 platform via a session replay attack. The affected component is the H authentication/session handling (H v1.0). The publicly documented impact is bypass of authentication through replayed sessions, with high-severity implications ind...

PT-2022-19550 · H · H

Name of the Vulnerable Software and Affected Versions: H version 1.0 Description: The issue allows attackers to bypass authentication via a session replay attack. Recommendations: For H version 1.0, consider implementing additional authentication measures to prevent session replay attacks until a...

CVE-2022-29334: Authentication Bypass by Capture-replay

An issue in H v1.0 allows attackers to bypass authentication via a session replay attack...

H 授权问题漏洞

H is a powerful asset collection and management platform. It is mainly used for src information collection and red and blue confrontation asset collection use. A security vulnerability exists in H v1.0, which can be exploited by an attacker to bypass authentication by performing a session replay...