817558 matches found
CVE-2026-108268
Enclave OS Virtual contains a vulnerability where the TDX/GPU RA-TLS certificate issuer fails to include a value bound to the active TLS session within the quote ReportData . This omission allows an attacker who possesses an enclave TLS private key to relay a genuine quote to a different connecti...
CVE-2026-108268
Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to th...
CVE-2026-108268 enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session
Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to th...
CVE-2026-108267 Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who...
CVE-2026-108267
The Privasys Go programming language fork, which provides RA-TLS support for crypto/tls , is vulnerable in versions prior to privasys-v0.5.1-go1.26.5 . In challenge-mode RA-TLS, certificates failed to bind quote ReportData to the active TLS session, binding it only to the certificate public key a...
CVE-2026-108267 Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who...
EUVD-2026-96017
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who...
CVE-2026-108267
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who...
CVE-2018-16341
CVE-2018-16341 Nuxeo 인증 우회 원격 코드 실행 10.3 - SSTI를 이용한 CVE-2018-16341 상세 분석 영어 아님 : https://www.freebuf.com/vuls/193000.html https://blog.riskivy.com/nuxeo-rce-analysis-cve-2018-16341/ 보안 권고 :...
GoBfuscator
🛡️ GoBfuscator - 고급 Go 코드 난독화 도구 🔍 개요 GoBfuscator는 Go Golang 소스 코드를 위해 특별히 설계된 전문가급 난독화 도구입니다. 100% 런타임 기능을 유지하면서 리버스 엔지니어링을 어렵게 만들기 위해 여러 계층의 보호 기능을 제공합니다. 주요 기능: ✨ 런타임 복호화를 지원하는 AES-256 암호화 문자열 🔀 포괄적인 식별자 이름 변경 함수, 변수, 타입 🧹 코드 정리 및 주석 제거 🛡️ 일반적인 리버스 엔지니어링 기법에 대한 보호 ⚡ 초기 복호화 이후 런타임 성능 오버헤드 제로 🚀 빠른...
EUVD-2026-95997
Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...
CVE-2026-108266
The Privasys rustls library, a fork of rustls providing RA-TLS challenge and channel-binding support, is vulnerable in versions prior to privasys-v0.8.1 . The root cause is that RA-TLS challenge certificates emitted by the library bound quote ReportData to the certificate public key and client no...
CVE-2026-108266 Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session
Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...
CVE-2026-108266
Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...
CVE-2026-108266 Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session
Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...
CVE-2021-22192
CVE-2021-22192 CVE-2021-22192 실습 환경: 인증되지 않은 사용자 RCE 취약점 0x10 실습 환경 0x20 디렉터리 구조 CVE-2021-22192 ├── README.md ............... 이 README 설명 ├── imgs .................... README 설명 보조 이미지 ├── gitlab .................. Gitlab 컨테이너의 마운트 디렉터리 │ ├── Dockerfile .......... Gitlab의 Docker 빌드 파일 │ ├── confi...
GHSA-M687-P538-R5HP Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
Summary Vikunja ships with cors.origins defaulting to http://127.0.0.1: and http://localhost:, and sends Access-Control-Allow-Credentials: true, so a page served from any port on the user's own machine may make credentialed cross-origin requests to the API and read the responses. The mandatory...
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
Summary Vikunja ships with cors.origins defaulting to http://127.0.0.1: and http://localhost:, and sends Access-Control-Allow-Credentials: true, so a page served from any port on the user's own machine may make credentialed cross-origin requests to the API and read the responses. The mandatory...
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project...
GHSA-FMMF-XQ98-G327 Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project...