7298 matches found
LaborOfficeFree 19.10 MySQL Root Password Calculator
Exploit Title: LaborOfficeFree 19.10 MySQL Root Password Calculator - CVE-2024-1346 Google Dork: N/A Date: 09/02/2023 Exploit Author: Peter Gabaldon - https://pgj11.com/ Vendor Homepage: https://www.laborofficefree.com/ Software Link: https://www.laborofficefree.com/plans Version: 19.10 Tested on...
CVE-2024-22361: Use of a Broken or Risky Cryptographic Algorithm
IBM Semeru Runtime 8.0.302.0 through 8.0.392.0, 11.0.12.0 through 11.0.21.0, 17.0.1.0 - 17.0.9.0, and 21.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 281222...
commonground-api-common unexploitable privilege escalation in JWT authentication middleware
Impact This is a privilege escalation vulnerability. The impact is negligible and entirely theoretical. A non-exploitable weakness was found in how the client-supplied JWTs are verified. Because an explicit allow-list of known algorithms is used in the PyJWT library, user-supplied invalid...
GHSA-C4CM-R9FH-JGJ9 commonground-api-common unexploitable privilege escalation in JWT authentication middleware
Impact This is a privilege escalation vulnerability. The impact is negligible and entirely theoretical. A non-exploitable weakness was found in how the client-supplied JWTs are verified. Because an explicit allow-list of known algorithms is used in the PyJWT library, user-supplied invalid...
CVE-2022-0931
3scale's gateway usage of JWT does not properly handle verification of algorithm claims in the token header. An attacker could use this flaw to create a signed token with improper claims and thus to bypass security restrictions for the user...
Red Hat 3scale Security Vulnerability
Red Hat 3scale is a suite of API Application Programming Interface lifecycle management software from Red Hat. A security vulnerability exists in Red Hat 3scale that stems from the use of JWT to incorrectly handle the validation of algorithmic declarations in token headers. An attacker could use...
SUSE-SU-2024:0411-1 Security update for the Linux Kernel (Live Patch 30 for SLE 15 SP3)
This update for the Linux Kernel 5.3.18-15030059115 fixes several issues. The following security issues were fixed: - CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation bsc1218255. - CVE-2023-6176: Fixed a denial of service...
SUSE SLES15: kernel-livepatch-5_14_21-150400_24_74-default / etc (SUSE-SU-2024:0395-1)
The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0395-1 advisory. This update for the Linux Kernel 5.14.21-1504002474 fixes several issues. The following security issues were fixed: - CVE-2023-6932: Fixed a...
SUSE SLES15 Security Update : kernel (Live Patch 3 for SLE 15 SP5) (SUSE-SU-2024:0352-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0352-1 advisory. This update for the Linux Kernel 5.14.21-1505005519 fixes several issues. The following security issues were fixed: - CVE-2023-6932: Fixed a...
SUSE-SU-2024:0389-1 Security update for the Linux Kernel (Live Patch 31 for SLE 15 SP3)
This update for the Linux Kernel 5.3.18-15030059118 fixes several issues. The following security issues were fixed: - CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation bsc1218255. - CVE-2023-6176: Fixed a denial of service...
SUSE-SU-2024:0358-1 Security update for the Linux Kernel (Live Patch 36 for SLE 15 SP3)
This update for the Linux Kernel 5.3.18-15030059133 fixes several issues. The following security issues were fixed: - CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation bsc1218255. - CVE-2023-6176: Fixed a denial of service...
SUSE-SU-2024:0352-1 Security update for the Linux Kernel (Live Patch 3 for SLE 15 SP5)
This update for the Linux Kernel 5.14.21-1505005519 fixes several issues. The following security issues were fixed: - CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation bsc1218255. - CVE-2023-6176: Fixed a denial of service...
SUSE SLES15 Security Update : kernel RT (Live Patch 5 for SLE 15 SP5) (SUSE-SU-2024:0348-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0348-1 advisory. This update for the Linux Kernel 5.14.21-1505001318 fixes several issues. The following security issues were fixed: - CVE-2023-6932: Fixed a...
Design/Logic Flaw
Use of a Broken or Risky Cryptographic Algorithm vulnerability in B&R Industrial Automation Automation Runtime SDM modules. The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws...
SUSE-SU-2024:0344-1 Security update for the Linux Kernel RT (Live Patch 7 for SLE 15 SP5)
This update for the Linux Kernel 5.14.21-1505001324 fixes several issues. The following security issues were fixed: - CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation bsc1218255. - CVE-2023-6176: Fixed a denial of service...
Insecure Cryptographic Algorithm
Ylianst MeshCentral is vulnerable to the use of an Insecure Cryptographic Algorithm. The vulnerability is due to the usage of the HMAC-MD5 algorithm, which allows an attacker to brute force the encrypted content...
CVE-2024-24559: Use of a Broken or Risky Cryptographic Algorithm
Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the IR for sha364. Concretely, the height variable is miscalculated. The vulnerability can't be triggered without writing the IR by hand that is, it cannot be triggered from regular...
IBM PowerSC Encryption Issue Vulnerability
IBM PowerSC is an International Business Machines IBM security and compliance solution for IBM Power Systems servers. IBM PowerSC suffers from an encryption issue vulnerability that stems from the use of a weaker-than-expected encryption algorithm, which could be exploited by an attacker to decry...
