Local Networks Go Global When Domain Names Collide

The proliferation of new top-level domains TLDs has exacerbated a well-known security weakness: Many organizations set up their internal Microsoft authentication systems years ago using domain names in TLDs that didnt exist at the time. Meaning, they are continuously sending their Windows usernam...

Open edX openedx-translations 安全漏洞

openedx-translations is an Open edX open source library. A security vulnerability exists in Open edX openedx-translations, which stems from the fact that the validation mechanism in the openedx-translations repository does not include the same protections against malformed translations as...

BIT-KEYDB-2022-24735 Lua scripts can be manipulated to overcome ACL rules in Redis

Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. The Lua scri...

GO-2022-0878 Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone in github.com/rclone/rclone

Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone in github.com/rclone/rclone...

CVE-2024-41699

Priority – CWE-552: Files or Directories Accessible to External Parties...

CVE-2022-33162

IBM Security Directory Integrator 7.2.0 and Security Verify Directory Integrator 10.0.0 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources, at the privilege level of a standard unprivileged user. IBM X-Force I...

The vulnerability of the User Management component of the Oracle iStore system, which is used for creating, managing, and personalizing online stores. This vulnerability exists in the Oracle E-Business Suite, a business automation system that allows attackers to gain unauthorized access to protected information.

The vulnerability of the User Management component of the Oracle iStore system, which is used for creating, managing, and personalizing online stores, and of the Oracle E-Business Suite system, which is used for automating business operations, is related to insufficient validation of input data...

edk2: Use of a Weak PseudoRandom Number Generator

A security flaw has been identified in the cryptographic system of EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized remote attacker to potentially expose sensitive information...

CVE-2024-39591 Missing Authorization check in SAP Document Builder

SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact on confidentiality of the application...

CVE-2024-5800

CVE-2024-5800 affects B&R Automation Runtime: Diffie-Hellman groups with insufficient strength are used in the SSL/TLS stack in versions before 6.0.2, enabling a network attacker to decrypt traffic. The vulnerability is tied to weak DH parameters in the TLS implementation, with impact limited to ...

The vulnerability of the PowerShell command line interface on Windows operating systems, which allows attackers to exploit their privileges

The vulnerability of the PowerShell command line interface on Windows operating systems is related to insufficient validation of entered data. Exploiting this vulnerability can allow an attacker to gain increased privileges...

The vulnerability of the restapi.service (/lib/systemd/system/restapi.service) software for creating wireless routers based on Debian RaspAP allows a attacker to escalate their privileges and execute arbitrary commands.

The vulnerability of the restapi.service file /lib/systemd/system/restapi.service in the software for creating wireless routers based on Debian RaspAP is related to the lack of measures taken to neutralize special elements used in commands, due to insufficient access control for users belonging t...

The vulnerability of the CI/CD system’s continuous integration and delivery capabilities in JetBrains TeamCity, related to deficiencies in the authentication process due to time differences, allows attackers to compromise the confidentiality of the protected information.

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of JetBrains TeamCity is related to deficiencies in the authentication process due to time differences when comparing tokens. Exploiting this vulnerability could allow a malicious actor to compromise...

USN-6948-1 salt vulnerabilities

It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary commands. CVE-2020-16846 It was discovered that Salt incorrectly created certificates with weak file permissions. CVE-2020-17490 It was discovered that Salt...

The vulnerability of the adminPushRules function in the Project-level Deploy Token Handler component of the software platform based on Git, which facilitates collaborative code development in GitLab. This vulnerability allows a malicious user to create deployment tokens at the project level.

The vulnerability of the adminPushRules function in the Project-level Deploy Token Handler component of the software platform based on Git for collaborative code development on GitLab is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to crea...

CVE-2024-40719 CHANGING Information Technology TCBServiSign Windows Version - Inadequate Encryption Strength

The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a remote attacker tricks a victim into visiting a malicious website, TCBServiSign will treat that website as a legitimate server and interact with it...

Changing TCBServiSign 加密问题漏洞

Changing TCBServiSign is a cross-platform security control component from China-based Changing. An encryption issue vulnerability exists in versions prior to Changing TCBServiSign 1.0.24.0318, which stems from insufficient encryption strength of the authorization key, and can be exploited by a...

PT-2024-29956 · Elliptic +1 · Elliptic +1

Name of the Vulnerable Software and Affected Versions: Elliptic package version 6.5.6 Description: The issue concerns ECDSA signature malleability due to a missing check for whether the leading bit of r and s is zero. This results in a cryptographic weakness. There is no information provided abou...

PT-2024-29954

Name of the Vulnerable Software and Affected Versions Elliptic package version 6.5.6 Description The issue concerns EDDSA signature malleability due to a missing signature length check, allowing zero-valued bytes to be removed or appended. This is a cryptographic weakness that can be exploited...

Over 1 Million Domains at Risk of 'Sitting Ducks' Domain Hijacking Technique

Over a million domains are susceptible to takeover by malicious actors by means of what has been called a Sitting Ducks attack. The powerful attack vector, which exploits weaknesses in the domain name system DNS, is being exploited by over a dozen Russian-nexus cybercriminal actors to stealthily...