CVE-2019-17627

The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy BLE traffic during one authorized unlock action, and then calculating the authentication key via simple computations on the hex digits of a valid authentication request. This...

CVE-2019-15878

In FreeBSD 12.1-STABLE before r352509, 11.3-STABLE before r352509, and 11.3-RELEASE before p9, an unprivileged local user can trigger a use-after-free situation due to improper checking in SCTP when an application tries to update an SCTP-AUTH shared key...

Checkmk 安全漏洞

Checkmk is an IT monitoring platform from Checkmk, Inc. Checkmk has a security vulnerability that originates from a remote site authentication key being written to a log file...

CVE-2023-53008

CVE-2023-53008 (Linux kernel): CIFS session setup fix to prevent memory leaks by freeing cifs_ses::auth_key.response before allocating it. This addresses potential memory leaks during reconnect or mounting. The advisory states the fix in the CIFS session setup path; no exploit specifics are provi...

RAGFlow 代码问题漏洞

RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. A code issue vulnerability exists in RAGFlow version v0.12.0, which stems from hard-coded AuthKey and pickle deserialization and could lead to remote code execution...

GO-2022-0635 In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...

CGA-GPJ7-899C-2322

Bulletin has no description...

PT-2024-35137

Name of the Vulnerable Software and Affected Versions berriai/litellm repository affected versions not specified Description An SQL Injection issue exists due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an...

Intumit SmartRobot Security Vulnerability

Intumit SmartRobot is a web development framework from Intumit, Inc. A security vulnerability exists in Intumit SmartRobot, which stems from the use of a fixed cryptographic key for authentication, and can be exploited by an attacker to gain administrator privileges and execute arbitrary code on ...

kernel: sctp: handle the error returned from sctp_auth_asoc_init_active_key

In the Linux kernel, the following vulnerability has been resolved: sctp: handle the error returned from sctpauthasocinitactivekey When it returns an error from sctpauthasocinitactivekey, the activekey is actually not updated. The old shkey will be freeed while it's still used as active key in...

UBUNTU-CVE-2023-38324

An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence and directly authenticate when it is using the default FAS key and OpenNDS is configured as FAS. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and...

sd-webui-infinite-image-browsing security vulnerability

sd-webui-infinite-image-browsing is an image browser by zanllp personal developer. A security vulnerability exists in versions prior to sd-webui-infinite-image-browsing 977815a, which stems from a vulnerability that allows a remote attacker to obtain local files if Gradio authentication is enable...

Baker Hughes Bently Nevada 3500 Security Breach

The Baker Hughes Bently Nevada 3500 is a machinery and equipment monitoring and protection system from Baker Hughes USA. A security vulnerability exists in the Bently Nevada 3500 Rack TDI Firmware version 5.05, which stems from an authentication key being used in conjunction with a connection...

CVE-2023-37287

SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes...

PT-2023-25885

Name of the Vulnerable Software and Affected Versions SmartBPM.NET affected versions not specified Description The issue concerns a path traversal vulnerability within the file download function of SmartBPM.NET, allowing an unauthenticated remote attacker to access arbitrary system files...

kernel: sctp: handle the error returned from sctp_auth_asoc_init_active_key

In the Linux kernel, the following vulnerability has been resolved: sctp: handle the error returned from sctpauthasocinitactivekey When it returns an error from sctpauthasocinitactivekey, the activekey is actually not updated. The old shkey will be freeed while it's still used as active key in...

kernel: sctp: handle the error returned from sctp_auth_asoc_init_active_key

In the Linux kernel, the following vulnerability has been resolved: sctp: handle the error returned from sctpauthasocinitactivekey When it returns an error from sctpauthasocinitactivekey, the activekey is actually not updated. The old shkey will be freeed while it's still used as active key in...

WhatsApp introduces new security features

WhatsApp has announced several new security features which include an extra check when an account is transferred to a new device. This check asks that users confirm the transfer on their old device. This should warn users in case there is a transfer in progress started by somebody trying to hijac...

CVE-2023-25077

Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script...

CVE-2023-25077

Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script...