Session Hijacking

github.com/hashicorp/boundary is vulnerable to Session Hijacking. The vulnerability is due to improper certificate validation. An attacker with privileges to enumerate the active active or pending sessions can obtain a session key and obtain a valid trust on the token. This results in an attacker...

CLSA-2024-1707226462 grub2: Fix of CVE-2023-4692

CVE-2023-4692: ntfs: checks to ensure that NTFS drive's sector numbers are never written beyond the boundary...

Boundary vulnerable to session hijacking through TLS certificate tampering

Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...

GHSA-VH73-Q3RW-QX7W Boundary vulnerable to session hijacking through TLS certificate tampering

Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...

CVE-2024-1052

Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...

Session fixation

Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...

CVE-2024-1052 Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering

Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...

CVE-2024-1052 Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering

Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...

CVE-2024-1052 Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering

Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...

CVE-2024-1052

Boundary and Boundary Enterprise are affected by CVE-2024-1052: session hijacking via TLS certificate tampering. The issue occurs when an attacker who can enumerate active/pending sessions, obtain a session private key, and possess a valid TOFU token can craft a TLS certificate to hijack an activ...

Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering

Summary Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a...

MediaTek Chip Security Breach

MediaTek chips are a variety of chips from MediaTek, a Chinese company. A security vulnerability exists in the MediaTek chips, which stems from a lack of boundary checking in the TVAPI module, which may result in out-of-bounds writes...

Unisoc Chipsets Security Vulnerability

UNISOC Chipsets is a chipset from China's Unisoc Corporation UNISOC. A security vulnerability exists in Unisoc Chipsets, which stems from a lack of boundary checking in the cp dump driver, resulting in out-of-bounds reads...

HashiCorp Boundary Security Vulnerability

HashiCorp Boundary is an open source solution from the US-based HashiCorp Inc. It automates secure identity-based user access to hosts and services across environments. A security vulnerability exists in HashiCorp Boundary and Boundary Enterprise versions prior to 0.15.0 that stems from...

MediaTek Chip Security Breach

MediaTek chips are a variety of chips from MediaTek, a Chinese company. A security vulnerability exists in the MediaTek chips due to a lack of boundary checking in the keyInstall module, which may result in out-of-bounds writes...

MediaTek Chip Security Breach

MediaTek chips are a variety of chips from MediaTek, a Chinese company. A security vulnerability exists in the MediaTek chips due to a lack of boundary checking in the da module, which may result in out-of-bounds writes...

Unisoc Chipsets Security Vulnerability

UNISOC Chipsets is a chipset from China's Unisoc Corporation UNISOC. A security vulnerability exists in Unisoc Chipsets, which stems from a lack of boundary checking in the cp dump driver, resulting in out-of-bounds reads...

MediaTek Chip Security Breach

MediaTek chips are a variety of chips from MediaTek, a Chinese company. A security vulnerability exists in the MediaTek chips, which stems from a lack of boundary checking in the TVAPI module, which may result in out-of-bounds writes...

MediaTek Chip Security Breach

MediaTek chips are a variety of chips from MediaTek, a Chinese company. A security vulnerability exists in the MediaTek chips that stems from an incorrect boundary check in the alac decoder module, which could lead to information disclosure...

The vulnerability of the jas_image_decode() function in the JPC library, which allows an attacker to execute arbitrary code.

The vulnerability of the jasimagedecode function in the JPC library for the JasPer set is related to the issue where the operation exits the buffer boundaries during the processing of ICC profiles. Exploiting this vulnerability could allow an attacker to execute arbitrary code...