CVE-2018-15473

CVE-2018-15473 成因 OpenSSH服务器在对包含了请求的数据包完全解析之前，不会延迟处理一个验证无效的用户。该漏洞和auth2-gss.c,auth2-hostbased.c,auth2-pubkey.c有关。 利用 尽管该漏洞不能用来生成有效的用户名列表，但依旧可以拿来枚举猜测用户名。 受影响的版本 OpenSSH = 7.7 不受影响的版本 openssh-7.8p1-1.fc28 openssh-7.6p1-6.fc27 poc安装 您可能需要安装发行版的等效openssl-dev软件包...

CVE-2026-42400

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user can send a specially crafted compressed request payload that is processed prior to authorization checks, causing excessive memory and CPU resource consumptio...

Incorrect Behavior Order: Early Validation

Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to Incorrect Behavior Order: Early Validation. Go Vulnerability Report: During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level...

CLSA-2024-1709548308 openssl: Fix of CVE-2023-5363

CVE-2023-5363: process key length and iv length early if present...