CVE-2026-127278

A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function sendverificationcode of the file registry-server/app/account/serviceauth.py of the component verify-code Endpoint. Executing a manipulation of the argument phone can lead to improper...

CVE-2026-127278

The software AIP-PUB ACPs-community (up to version 2.2.0 ) is vulnerable to improper authentication within the verify-code Endpoint . Specifically, a manipulation of the phone argument in the send_verification_code function located in registry-server/app/account/service_auth.py allows for remote ...

CVE-2026-127278 AIP-PUB ACPs-community verify-code Endpoint service_auth.py send_verification_code improper authentication

A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function sendverificationcode of the file registry-server/app/account/serviceauth.py of the component verify-code Endpoint. Executing a manipulation of the argument phone can lead to improper...

EUVD-2026-124814

A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function sendverificationcode of the file registry-server/app/account/serviceauth.py of the component verify-code Endpoint. Executing a manipulation of the argument phone can lead to improper...

PT-2026-146105

A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function send verification code of the file registry-server/app/account/service auth.py of the component verify-code Endpoint. Executing a manipulation of the argument phone can lead to improper...

candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...

PoC--CVE-2019-10149_Exim

PoC-CVE-2019-10149Exim MNEMO-CERT has developed a PoC that allows executing commands with elevated privileges by exploiting the vulnerability CVE-2019-10149, which affects different versions of Exim 4.87 - 4.91. To perform local exploitation of this vulnerability it is necessary to define the...

IBM-Security-Verify-oAuth_Token_Steal-CVE-2024-35133

IBM Security Verify Access - Open Redirect during OAuth Flow CVE-2024-35133 Table of Contents 1. Overview 2. Detailed Description 3. Proof of Concept 4. Solution 5. Disclosure Timeline 6. References 7. Credits 8. Legal Notices Overview Revision : 1.0 Impact : By persuading a victim to visit a...

jarm

JARM Please read the initial JARM blog post for more information. JARM is an active Transport Layer Security TLS server fingerprinting tool. JARM fingerprints can be used to: Quickly verify that all servers in a group have the same TLS configuration. Group disparate servers on the internet by...

Security Bulletin: Security vulnerability has been detected in IBM Security Verify Governance Identity Manager Adapters

Summary Security vulnerability has been addressed in IBM Security Verify Governance Identity Manager Adapter for Google Workspace. Vulnerability Details CVEID:CVE-2026-102554 DESCRIPTION: Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Gua...

CVE-2023-28432

CVE-2023-28432 CVE-2023-28432 nuclei templates Dec Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD...

CVE-2023-28432

CVE-2023-28432 Minio is an object storage service written in Go. It implements most of the Amazon S3 cloud storage service interfaces and can be seen as an open-source version of S3, making it very suitable for storing large volumes of unstructured data such as images, videos, log files, backup...

CVE-2026-125335

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify decodes a public key in cryptosignopen without rejecting small-order points or their non-canonical encodings. With S = 0 and a small-order R value, an attacker who can...

CVE-2023-28432

CVE-2023-28432 MiniO verify interface sensitive information disclosure vulnerability CVE-2023-28432 Chinese name: MinIO verify 接口敏感信息泄露漏洞（CVE-2023-28432） Description : MinIO is an open source object storage service that is compatible with the Amazon S3 API and can be used in private or public...

cve-2022-22954

CVE-2022-22954 This package detects a subset of CVE-2022-22954 attempts and exploits, generates a notice, and also includes the exploit URI and the first 4KB of the data that was sent back to the attacker as a response. While detecting this attack is more straightforward from log analysis, this...

CVE-2026-126610

Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database and TlsMode=verify-full, does not hand the database client the CA file that TlsCaFile names when the file's name contains a character outside ASCII on Linux, or above U+00FF on Windows, which allows an attacker wh...

EUVD-2026-123323

Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database, TlsMode=verify-full and no TlsCaFile, does not verify the database server's certificate's issuer or name when the connection is one that MariaDB Connector/C treats as local - Server= set to 127.0.0.1, ::1 or...

ch55x_firmware_extractor

CH55x firmware extractor The CH55x firmware extractor is used to read out firmware from CH55x integrated circuits. There is no in-built support in the devices for directly reading out the firmware through the bootloader. However, there is a functionality to verify the firmware contents 8 bytes at...

CVE-2026-125335

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify decodes a public key in cryptosignopen without rejecting small-order points or their non-canonical encodings. With S = 0 and a small-order R value, an attacker who can...

FortiClient EMS - Authentication Bypass

Detects whether Fortinet hotfix FG-IR-26-099 for CVE-2026-35616 is missing by comparing behavioral responses from a certificate-authenticated endpoint. The template sends X-SSL-CLIENT-VERIFY: SUCCESS without certificate material and checks whether this spoofed header changes server behavior. id:...