Design/Logic Flaw

Weak encryption mechanisms in RFID Tags in Yale Keyless Lock v1.0 allows attackers to create a cloned tag via physical proximity to the original...

Design/Logic Flaw

Weak encryption mechanisms in RFID Tags in Yale Conexis L1 v1.1.0 allows attackers to create a cloned tag via physical proximity to the original...

PT-2023-20863 · Yale · Yale Ia-210 Alarm

Name of the Vulnerable Software and Affected Versions: Yale IA-210 Alarm version 1.0 Description: The issue is related to weak encryption mechanisms in RFID Tags, allowing attackers to create a cloned tag via physical proximity to the original. Recommendations: For Yale IA-210 Alarm version 1.0,...

CVE-2023-26941

Weak encryption mechanisms in RFID Tags in Yale Conexis L1 v1.1.0 allows attackers to create a cloned tag via physical proximity to the original...

Yale IA-210 Alarm Security Vulnerability

The Yale IA-210 Alarm is a residential alarm from Yale. The Yale IA-210 Alarm v1.0 version suffers from a security vulnerability that stems from a weak encryption mechanism in the RFID tag, which allows an attacker to create a cloned tag by physically approaching the original tag...

Yale Keyless Lock Security Vulnerability

Yale Keyless Lock is a keyless connected smart lock from Yale. A security vulnerability exists in Yale Keyless Lock v1.0, which stems from a weak encryption mechanism in the RFID tags, leading to an attacker being able to create a clone of the original tag by getting physically close to it...

CVE-2023-26941

CVE-2023-26941 involves weak encryption in RFID tags used by Yale Conexis L1 v1.1.0, enabling a cloned tag via close proximity to the original. Red Hat records corroborate the same description. No explicit exploit details or remediation are provided in the supplied documents.

CVE-2023-26943

CVE-2023-26943 describes weak encryption in RFID tags across Yale Lock family products (Keyless Lock v1.0; Conexis L1 v1.1.0; IA-210 Alarm v1.0), enabling tag cloning with physical proximity. Root cause: weak encryption in RFID tags. Red Hat advisories corroborate the same CVE across the Yale dev...

PT-2023-20862 · Yale · Yale Conexis L1

Name of the Vulnerable Software and Affected Versions: Yale Conexis L1 version 1.1.0 Description: The issue is related to weak encryption mechanisms in RFID Tags, allowing attackers to create a cloned tag via physical proximity to the original. Recommendations: For Yale Conexis L1 version 1.1.0,...

PT-2023-20864 · Yale · Yale Keyless Lock

Name of the Vulnerable Software and Affected Versions: Yale Keyless Lock version v1.0 Description: The issue is related to weak encryption mechanisms in RFID Tags, which allows attackers to create a cloned tag via physical proximity to the original. Recommendations: For Yale Keyless Lock version...

League Table < 1.14 - Tables Cloning/Update/Deletion via CSRF

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation in the view/tables.php file. This makes it possible for unauthenticated attackers to clone, edit, update, and delete tables via a forged request granted they can trick a site...

FTC’s Voice Cloning Challenge

The Federal Trade Commission is running a competition "to foster breakthrough ideas on preventing, monitoring, and evaluating malicious voice cloning."...

kernel: net/mlx5e: Don't clone flow post action attributes second time

A use-after-free flaw was discovered in the Linux kernel’s mlx5e networking driver. The code erroneously cloned flow post action attributes a second time in mlx5etcpostactadd despite an earlier clone in mlx5ecloneflowattrforpostact. This second clone is not properly updated during neighbor update...

kernel: Linux kernel: Network subsystem memory leak

A flaw was found in the Linux kernel. This vulnerability allows an attacker to cause a denial of service via a memory leak caused by improper handling of skb socket buffer cloning in the network subsystem...

CVE-2023-46235

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the log...

Design/Logic Flaw

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the log...

CVE-2023-46237 FOG path traversal via unauthenticated endpoint

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their...

CVE-2023-46236 FOG SSRF via unauthenticated endpoint(s)

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery SSRF vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote...

CVE-2023-46235

CVE-2023-46235 affects the FOG project prior to version 1.5.10.15, where a lack of request sanitization in log handling allows a malicious request containing XSS to be stored in a log file. When an administrator views the logs in the dashboard, the content is parsed as HTML, enabling XSS exposure...

AZL-31289 CVE-2023-38546 affecting package curl for versions less than 8.3.0-2

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a functio...