CVE-2024-28820

CVE-2024-28820 concerns the Three Rings OpenVPN LDAP plugin (openvpn-auth-ldap) 2.0.4. The flaw is a buffer overflow in extract_openvpn_cr (openvpn-cr.c) when handling the challenge/response password field; an attacker with a valid LDAP username who can control that field can supply input with mo...

CVE-2024-28820

Buffer overflow in the extractopenvpncr function in openvpn-cr.c in openvpn-auth-ldap aka the Three Rings Auth-LDAP plugin for OpenVPN 2.0.4 allows attackers with a valid LDAP username and who can control the challenge/response password field to pass a string with more than 14 colons into this...

CVE-2024-28820

Buffer overflow in the extractopenvpncr function in openvpn-cr.c in openvpn-auth-ldap aka the Three Rings Auth-LDAP plugin for OpenVPN 2.0.4 allows attackers with a valid LDAP username and who can control the challenge/response password field to pass a string with more than 14 colons into this...

CVE-2024-38272 Auth Bypass in Quick Share

There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We...

CVE-2024-38272

CVE-2024-38272 affects Google's Quick Share (Windows) where an attacker can bypass the Accept File dialog, enabling a transfer without recipient consent. The vulnerability is described as an auth bypass in Quick Share for Windows; the issue is fixed in version 1.0.1724.0 and later. Connected sour...

GO-2024-2947 Leak of sensitive information to log files in github.com/hashicorp/go-retryablehttp

URLs were not sanitized when writing them to log files. This could lead to writing sensitive HTTP basic auth credentials to the log file...

MAL-2024-6722 Malicious code in auth-client (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in auth-client (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-5293 Malicious code in killskids-auth (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in killskids-auth (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlаanderen.Basisregisters.Auth.AcmIԁm (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlаandеren.Basisrеgisters.Auth.AcmIԁm (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in en-conduit-electron-auth (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2296 Malicious code in en-conduit-electron-auth (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in driverless-acquisition-blue-auth-token-validator (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2268 Malicious code in driverless-acquisition-blue-auth-token-validator (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1779 Malicious code in aspnet-webapi-auth (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2788 Malicious code in @ks-radar/olap-auth (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-6104

A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information. Mitigation Mitigation for this issue is either not available or the currently...

AZL-42936 CVE-2024-6104 affecting package influxdb for versions less than 2.6.1-15

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...