CLSA-2021-1632262184 Fix of CVE: CVE-2021-2388

Fix CVE-2021-2388 OpenJDK: Incorrect comparison during range check elimination...

CVE-2020-16630: Incorrect Authorization

TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairin...

Facebook’s own research reveals the harm that Instagram can inflict

For years, people have accused social media, and particularly image-driven sites like Instagram, of being bad for young people, particularly young women. It turns that Instagrams owner, Facebook, agrees. Thirty-two percent of teen girls said that when they felt bad about their bodies, Instagram...

CVE-2021-3797

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

CVE-2021-3797

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

Design/Logic Flaw

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

CVE-2021-3797

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

CVE-2021-3797 Use of Wrong Operator in String Comparison in hestiacp/hestiacp

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

CVE-2021-3797

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

CVE-2021-3797

The CVE-2021-3797 entry for hestiacp has concrete technical details in connected data: in huntr’s description of hestiacp/hestiacp, a CSRF token check uses the != operator to compare $_SESSION["token"] with $_GET["token"] in index.php. This type juggling can bypass the CSRF token, enabling CSRF a...

CVE-2021-3797: Use of Wrong Operator in String Comparison

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

PT-2021-21935

Name of the Vulnerable Software and Affected Versions: hestiacp affected versions not specified Description: The issue is related to the use of a wrong operator in string comparison. There is no information provided about the estimated number of potentially affected devices worldwide or real-worl...

in hestiacp/hestiacp

✍️ Description $SESSION"token" is a csrf token which is a md5 hash generated based on system time. It has been discovered that $SESSION"token" compares with $GET"token" using comparison operator != in file index.php. This might cause unexpected behavior due to type juggling. It is possible to...

Authorization Policy Bypass Due to Case Insensitive Host Comparison

Impact According to RFC 4343, Istio authorization policy should compare the hostname in the HTTP Host header in a case insensitive way, but currently the comparison is case sensitive. The Envoy proxy will route the request hostname in a case-insensitive way which means the authorization policy...

CVE-2021-40147

EmTec ZOC before 8.02.2 allows \e201 pastes, a different vulnerability than CVE-2021-32198...

Privilege Escalation

github.com/istio/istio is vulnerable to privilege escalation. Lack of case-sensitive comparison of hostname in the HTTP Host header allows an attacker to bypass the authorization policy as it causes the Envoy proxy to route the request hostname in a case-insensitive way...

Incorrect Comparison in sodiumoxide

An issue was discovered in the sodiumoxide crate starting with 0.2.0 and prior to 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties...

GHSA-WRVC-72W7-XPMJ Incorrect Comparison in sodiumoxide

An issue was discovered in the sodiumoxide crate starting with 0.2.0 and prior to 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties...

CVE-2021-39155

Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. According to "RFC 4343" https://datatracker.ietf.org/doc/html/rfc4343, Istio authorization policy should compare the...

CVE-2021-39155

An authorization bypass vulnerability was found in istio/istio. The case insensitive host comparison incorrectly works when evaluating rules specified with host or notHost. This flaw allows an attacker to bypass an Istio authorization policy that uses hosts in the rules, potentially gaining acces...