Windows Hello Remote Code Execution Vulnerability

...

Microsoft Windows Hello 安全漏洞

Microsoft Windows Hello is a biometric-based login from Microsoft Corporation USA that allows you to sign in using your face, fingerprint or PIN. A security vulnerability exists in Microsoft Windows Hello. An attacker could exploit this vulnerability to remotely execute code. The following produc...

PT-2023-3124 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient input validation in the Windows Hello biometric authentication function of Windows operating systems. This can be exploited to execute arbitrary code...

fizz 安全漏洞

fizz is a TLS implementation written in C++. A security vulnerability exists in versions prior to fizz v2023.01.30.00, which stems from a client-supported password advertisement that changes between the original ClientHello and a second ClientHello, causing a process crash...

PT-2023-19183 · Unknown · Fizz Library

Name of the Vulnerable Software and Affected Versions: fizz library versions prior to v2023.01.30.00 Description: The issue is related to a CHECK failure that can be triggered remotely in the fizz library. This behavior occurs when the client-supported cipher advertisement changes between the...

Malicious Package

Overview @bjoern.bg/hello is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

hello-hawaii.com Cross Site Scripting vulnerability OBB-3304314

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for CVE-2021-46703

CVE-2021-46703 Simple payload builder based on POC in: https:/...

How Microsoft can help you go passwordless this World Password Day

It’s that time of year again. World Password Day is May 4, 2023.1 There’s a reason it’s still going strong 10 years after being created by cybersecurity professionals. A recent study that analyzed more than 15 billion passwords found that the top 10 most popular passwords still include...

How Microsoft can help you go passwordless this World Password Day

It’s that time of year again. World Password Day is May 4, 2023.1 There’s a reason it’s still going strong 10 years after being created by cybersecurity professionals. A recent study that analyzed more than 15 billion passwords found that the top 10 most popular passwords still include...

SUSE CVE-2008-0227

yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allows remote attackers to cause a denial of service crash via a Hello packet containing a large size value, which triggers a buffer over-read in the HASHwithTransform::Update function in hash.cpp...

SUSE CVE-2008-0891

Double free vulnerability in OpenSSL 0.9.8f and 0.9.8g, when the TLS server name extensions are enabled, allows remote attackers to cause a denial of service crash via a malformed Client Hello packet. NOTE: some of these details are obtained from third party information...

SUSE CVE-2008-1949

The gnutlsrecvclientkxmessage function in lib/gnutlskx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service NULL dereference and crash v...

SUSE CVE-2008-1948

The gnutlsservernamerecvparams function in lib/extservername.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service crash or...

SUSE CVE-2008-1950

Integer signedness error in the gnutlsciphertext2compressed function in lib/gnutlscipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service buffer over-read and crash via a certain integer value in the Random field in an encrypted Client Hello message withi...

SUSE CVE-2009-1386

ssl/s3pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a DTLS ChangeCipherSpec packet that occurs before ClientHello...

SUSE CVE-2011-3325

ospfpacket.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service daemon crash via 1 a 0x0a type field in an IPv4 packet header or 2 a truncated IPv4 Hello packet...

SUSE CVE-2013-2222

Multiple stack-based buffer overflows in GNU ZRTPCPP before 3.2.0 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted ZRTP Hello packet to the 1 ZRtp::findBestSASType, 2 ZRtp::findBestAuthLen, 3 ZRtp::findBestCipher, 4 ZRtp::findBestHash, or...

SUSE CVE-2014-3466

Buffer overflow in the readserverhello function in lib/gnutlshandshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service memory corruption or possibly execute arbitrary code via a long session id in a ServerHello message...

SUSE CVE-2014-3569

The ssl23getclienthello function in s23srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via an unexpected handshake, as demonstrated by...