7260 matches found
CVE-2024-47557 Pre-Auth RCE via Path Traversal
Pre-Auth RCE via Path Traversal...
CVE-2024-47556 Pre-Auth RCE via Path Traversal
Pre-Auth RCE via Path Traversal...
CVE-2024-47556
CVE-2024-47556 relates to Xerox FreeFlow Core and is described as a Pre-Auth RCE via Path Traversal. The provided documents indicate: affected product is Xerox FreeFlow Core (vague on specific versions) and the underlying issue is a path traversal condition enabling pre-auth remote code execution...
CVE-2024-47556 Pre-Auth RCE via Path Traversal
Pre-Auth RCE via Path Traversal...
Timing Attack
basic-auth-connect is vulnerable to Timing Attack. The vulnerability is due to improper implementation of the equality comparison, where the comparison function reveals differences in the time taken to process incorrect versus correct input, allowing an attacker to infer sensitive information bas...
CVE-2024-47178
A flaw was found in the basic-auth-connect package. Affected versions use a timing-unsafe equality comparison that can potentially leak timing information. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...
20231122-npm (=1.0.0), @3dr/potree (=1.6.0) +3221 more potentially affected by CVE-2024-47178 via basic-auth-connect (=1.0.0)
basic-auth-connect NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on basic-auth-connect and may be impacted: - 20231122-npm =1.0.0 - @3dr/potree =1.6.0 - @inlimbo/nativeui =0.0.1, =0.0.0, =0.20.0, =0.0.1, =0.0.1, =0.0.1, =1.0.1, =0.0.1...
basic-auth-connect's callback uses time unsafe string comparison
Impact basic-auth-connect 1.1.0 uses a timing-unsafe equality comparison that can leak timing information Patches this issue has been fixed in basic-auth-connect 1.1.0 References...
CVE-2024-47178
basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0...
CVE-2024-47178 basic-auth-connect's callback uses time unsafe string comparison
basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0...
CVE-2024-47178
The CVE-2024-47178 issue affects basic-auth-connect (
CVE-2024-47178 basic-auth-connect's callback uses time unsafe string comparison
basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0...
PT-2024-32459 · Unknown · Basic-Auth-Connect
Name of the Vulnerable Software and Affected Versions: basic-auth-connect versions prior to 1.1.0 Description: The issue concerns a timing-unsafe equality comparison in basic-auth-connect that can leak timing information. This comparison can potentially allow an attacker to observe differences in...
basic-auth-connect 安全漏洞
basic-auth-connect is an expressjs open source basic authentication middleware for nodes and connections. A security vulnerability exists in basic-auth-connect versions prior to 1.1.0, which stems from the use of timing insecure equality comparisons, which can leak timing information...
Responsive Binary mlm 3.2.0 SQL Injection
==================================================================================================================================== | Title : Responsive Binary mlm 3.2.0 Auth By PAss Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 130.0.0 64 bits...
CVE-2024-6593 WatchGuard Firebox Single Sign-On Agent Management Interface Authentication Bypass
Incorrect Authorization vulnerability in WatchGuard Authentication Gateway aka Single Sign-On Agent on Windows allows an attacker with network access to execute restricted management commands. An attacker that has already gained network access could exploit this vulnerability to retrieve...
Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)
A stored cross-site scripting has been found in the image upload functionality that can be used by normal registered users: It is possible to upload a SVG image containing JavaScript and it's also possible to upload a HTML document when the format parameter is manually changed to documents1 or a...
Online Food Management System 1.0 SQL Injection
==================================================================================================================================== | Title : Online Food Management System 1.0 Auth By Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 130.0.0 6...
