CVE-2024-45597 Pluto's http.request allows CR and LF in header values

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table...

CVE-2024-45032

A vulnerability has been identified in Industrial Edge Management Pro All versions V1.9.5, Industrial Edge Management Virtual All versions V2.3.1-1. Affected components do not properly validate the device tokens. This could allow an unauthenticated remote attacker to impersonate other devices...

CVE-2024-45032

A vulnerability has been identified in Industrial Edge Management Pro All versions V1.9.5, Industrial Edge Management Virtual All versions V2.3.1-1. Affected components do not properly validate the device tokens. This could allow an unauthenticated remote attacker to impersonate other devices...

CVE-2024-7698

A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks...

CVE-2024-7698

A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks...

CVE-2024-7698

CVE-2024-7698 affects Phoenix Contact FL/TC MGUARD devices (MGUARD routers). A low-privilege remote attacker can obtain CSRF tokens from higher-privileged users, enabling potential CSRF abuse. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N with a base score of 5.7 (MEDIUM). No explici...

CVE-2024-7698 Phoenix Contact: Access to CSRF tokens of higher privileged users in MGUARD products

A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks...

CVE-2024-7698 Phoenix Contact: Access to CSRF tokens of higher privileged users in MGUARD products

A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks...

CVE-2024-38270

An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80AAZI.0C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid...

CVE-2024-38270

An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80AAZI.0C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid...

Siemens Industrial Edge Management 安全漏洞

Siemens Industrial Edge Management is a platform from Siemens, Germany, for hosting applications from different vendors on a computing platform close to the shop floor. An authorization bypass vulnerability exists in Siemens Industrial Edge Management, which stems from the affected component's...

Zyxel GS1900 安全特征问题漏洞

The Zyxel GS1900 is a managed switch from China Hopkins Zyxel. A security signature issue vulnerability exists in the Zyxel GS1900-10HP V2.80AAZI.0C0 version, which stems from improper use of a random function with low entropy when generating Web authentication tokens...

PT-2024-31699 · Pluto · Pluto

Name of the Vulnerable Software and Affected Versions: Pluto affected versions not specified Description: The issue affects scripts that pass user-controlled values to http.request header values. An attacker could exploit this to send arbitrary requests, potentially leveraging authentication toke...

PT-2024-38518 · Phoenix Contact · Fl Mguard 2102 +46

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A low privileged remote attacker can get access to CSRF tokens of higher privileged users, which can be abused to mount CSRF attacks. Recommendations: A...

CVE-2024-45041

CVE-2024-45041 affects the External Secrets Operator. A deployment named default-external-secrets-cert-controller is bound to a ClusterRole that grants Harper access: it can perform get/list on secrets resources and patch/update on validatingwebhookconfigurations. This RBAC configuration can be a...

PT-2024-27909 · Zyxel · Zyxel Gs1900-10Hp

Name of the Vulnerable Software and Affected Versions: Zyxel GS1900-10HP firmware version V2.80AAZI.0C0 Description: An insufficient entropy vulnerability exists due to the improper use of a randomness function with low entropy for web authentication tokens generation. This could allow a LAN-base...

External Secrets 安全漏洞

External Secrets is a Kubernetes-related application open-sourced by External Secrets. A security vulnerability exists in External Secrets versions prior to 0.10.2, which stems from the ability to retrieve or gain access to all secrets across a cluster by abusing deployed SA tokens for elevated...

CVE-2024-42021

An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials...

CVE-2024-42021

An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials...

YubiKey Side-Channel Attack

There is a side-channel attack against YubiKey access tokens that allows someone to clone a device. Its a complicated attack, requiring the victims username and password, and physical access to their YubiKey--as well as some technical expertise and equipment. Still, nice piece of security analysi...