255 matches found
ForgeCert
ForgeCert ForgeCertは、BouncyCastle C APIと、侵害した認証局（CA）の証明書と秘密鍵を使用して、Active Directoryに対して認証可能な任意のユーザーの証明書を偽造します。 この攻撃は、私たちの「Certified Pre-Owned」ホワイトペーパーにおいてDPERSIST1として体系化されています。このコードベースは、ホワイトペーパー公開から約45日後にリリースされました。 @tifkinはForgeCertの主な作者です。 @tifkinと@harmj0yは、関連するActive...
ecapture
한자 | 영어 eCapture旁观者: eBPF를 사용하여 CA 인증서 없이 SSL/TLS 텍스트 콘텐츠 캡처 !IMPORTANT Linux/Android의 x8664커널 4.18+ 및 aarch64커널 5.5+를 지원합니다. 커널 버전 요구 사항은 Linux와 Android 모두 CPU 아키텍처별로 적용됩니다. ROOT 권한 또는 특정 Linux capabilities가 필요합니다. Windows 및 macOS 시스템을 지원하지 않습니다. 소개 시작하기 다운로드 ELF 바이너리 파일 Docker 이미지 OpenSSL 텍스트 콘...
CVE-2026-29114
CVE-2026-29114 — 다후아 장치 CA 루트 인증서 노출 권고 유형: 벤더 협력 보안 공개 CVE ID: CVE-2026-29114 벤더: 다후아 테크놀로지Dahua Technology 게시일: 2026-06-10T05:44:50 UTC 최종 수정일: 2026-06-10T05:44:50 UTC 출처: 다후아 제품 보안 사고PSI 트러스트 센터 목차 요약 한눈에 보기 관련 CVE와의 관계 취약점 타임라인 설명 기술 분석 영향받는 제품 CVSS 점수 취약점 점수 세부 정보 CWE 분류 공격 전제 조건 악용 시나리오 영향 ...
certsync
certsync certsync is a new technique in order to dump NTDS remotely, but this time without DRSUAPI : it uses golden certificate and UnPAC the hash. It works in several steps: 1. Dump user list, CA informations and CRL from LDAP 2. Dump CA certificate and private key 3. Forge offline a certificate...
CVE-2026-78616 Dimension Stored XSS via Trusted CA Certificate Configuration
A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...
PYSEC-2026-3677 Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
Summary Repo under test: https://github.com/Netflix/lemur When ADMINONLYAUTHORITYCREATION=False an explicitly supported and documented configuration, POST /api/1/authorities with type=subca never verifies that the caller holds AuthorityPermission on the supplied parent authority. The parent field...
CVE-2026-16543
Kong Operator's embedded Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector...
CVE-2026-16543
Kong Operator’s embedded Kong Kubernetes Ingress Controller (KIC) is vulnerable. A user with namespace-scoped Secret creation privileges can cause a cluster-wide denial of service by collecting CA-certificate Secrets across watched namespaces using only a label selector, with no ingress-class or ...
EUVD-2026-50394
Kong Operator's embedded Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector...
EUVD-2026-50353
Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace...
CVE-2026-15228
Kong Kubernetes Ingress Controller (KIC) is affected by CVE-2026-15228: a user with namespace-scoped Secret creation privileges can trigger a cluster-wide Denial of Service in ingress configuration. KIC collects CA-certificate Secrets across all watched namespaces using a label selector with no i...
CVE-2026-15228 Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision
Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace...
GHSA-WVMP-6R4V-J6CV kuma-dp connects to control plane without verifying TLS certificate when no CA is configured
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled. The dataplane authentication token is sent over this unverified connection Impact An on-path attacker can intercept the dataplane...
kumactl connects to control plane without verifying TLS certificate when no CA is configured
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection Impact An attacker on the network path between the operator and the control plane can intercept user or admin A...
Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2026-1899)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1899 advisory. If the certificate auto-enrollment GPO is enabled on domain membersboth in Samba's smb.conf and using Windows GPME tool, a CAcertificate may be fetched using a plain HTTP connection and installedin the...
erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation
A flaw was found in Erlang OTP's publickey module. This vulnerability CWE-295, related to improper certificate validation, allows a non-Certificate Authority CA certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can...
PYSEC-2026-1893 Salt's salt.auth.pki module does not properly authenticate callers
The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication...
AZL-90123 CVE-2026-48860 affecting package erlang for versions less than 26.2.5.21-2
Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl inettlsdist module allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inettlsdist:checkip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead...
OESA-2026-2575 samba security update
Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and...
