CVE-2021-27651

요약 공격자는 비밀번호 재설정 흐름의 모든 단계를 우회하고 Pega Infinity에서 임의 사용자의 계정을 재설정할 수 있습니다. 이는 1 비밀번호 재설정 흐름을 시작하고 피해자의 이메일을 입력한 다음, 2 HTTP POST 요청이 통과하도록 강제하여 비밀번호를 업데이트하는 방식으로 이루어집니다. 공격자는 새로 변경된 계정으로 로그인한 후, 허용되는 다양한 인증 후 코드 실행 벡터동적 페이지 수정, 템플릿 등를 통해 Pega 인스턴스를 완전히 장악할 수 있습니다. 재현 단계 1. 아무 Pega 인스턴스의 로그인 페이지로...

CVE-2021-27651

CVE-2021-27651 Сброс пароля Pega Infinity Видео Подпишитесь Youtube Twitter Telegram...

bedaisy-bypass

bedaisy-bypass 설명 bedaisy-bypass는 BEDaisy.sys에서 BEService.exe로 전송되는 리포트를 차단하도록 설계된 커널 드라이버입니다. UEFI를 사용하지 않는 사용자의 경우 프로젝트에서 Infinity Hook을 활용합니다. 이 드라이버는 두 서비스 간 명명된 파이프named pipe를 통해 전달되는 데이터를 가로챕니다. 요청을 수신하면 드라이버는 요청 유형을 검사하고 반환된 데이터를 복호화한 후 적절히 처리합니다. 보고 버퍼에 예상 데이터가 없다는 점메인 사용자 모드 셸코드와 달리 때문에 ...

research

연구 — Bertoldi Cybersecurity Alessandro Bertoldi와 협력자들이 발표한 보안 연구. 논문 제목| 행사| 연도| 링크 ---|---|---|--- Infinity-Day at Scale: Hijacking Registrars, Defeating 2FA and Spoofing 17,000+ Domains| DeepSec Vienna 2025| 2025| PDF 저자 Infinity-Day at Scale DeepSec Vienna 2025 주 저자: Alessandro Bertoldi 공동 저자:...

Pega Infinity - Authentication Bypass

Pega Infinity versions 8.2.1 through 8.5.2 contain an authentication bypass vulnerability because the password reset functionality for local accounts can be used to bypass local authentication checks. id: CVE-2021-27651 info: name: Pega Infinity - Authentication Bypass author: idealphase,daffainf...

DEBIAN-CVE-2026-87733

An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions P256,P384,P521.Dsa.pubofoctets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key...

CVE-2026-87733

An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions P256,P384,P521.Dsa.pubofoctets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key...

CVE-2026-87733

mirage-crypto-ec for OCaml , versions before 2.2.0 , contains a flaw in the ECDSA functions {P256, P384, P521}.Dsa.pub_of_octets. The function accepts 0x00 —the encoding of the point at infinity —as a valid public key, allowing an attacker to forge ECDSA signatures without knowledge of the privat...

CVE-2026-87733

An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions P256,P384,P521.Dsa.pubofoctets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key...

EUVD-2026-74619

An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions P256,P384,P521.Dsa.pubofoctets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key...

Linux Distros Unpatched Vulnerability : CVE-2026-87733

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions P256,P384,P521.Dsa.pubofoctets accept 0x00, the encoding of...

CVE-2026-82734 Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value. Ash.Type.Decimal cast input through Ecto's decimal cast in castinput/2 and...

CVE-2026-82734

CVE-2026-82734 affects ash-project ash (Elixir), versions 1.28.0 through 3.32.1 . The vulnerability is in Ash.Type.Decimal (lib/ash/type/decimal.ex), which casts input via Ecto's decimal cast without verifying the result is finite. Because Elixir's Decimal module treats Infinity and NaN as valid ...

ANT-2026-7R9KHDAS · cloudflare/circl · Signature Verification Bypass / Universal Forgery

other critical Severity Claude critical · Security research firm - · Maintainer - REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-7R9KHDAS: CIRCL sign/bls: universal signature forgery in KeyG2SigG1 via G1-infinity point In the KeyG2SigG1 configuration of...

Improper Encoding Or Escaping Of Output

Apache Log4j API is vulnerable to Improper Encoding or Escaping of Output. The vulnerability is due to improper encoding of non-finite floating-point values during MapMessage JSON serialization, which allows an attacker to inject NaN or Infinity values that produce malformed JSON and disrupt...

OSEC-2026-13 ECDSA accepts the point at infinity as a P256, P384, P521 public key

P256,P384,P521.Dsa.pubofoctets accepts 0x00, the encoding of the point at infinity, as a public key. The Diffie-Hellman path rejects that point pointofoctets; the ECDSA path skips the same check. Under such a key a signature can be forged with no private key, as the repro shows. The same class is...

PYSEC-2026-3405 vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

Summary All temperature validation gates use comparison operators , which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce undefined behavior or CUDA errors tha...

EUVD-2026-42409

libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays...

CVE-2026-49866

CVE-2026-49866 affects the JavaScript libp2p implementation, specifically the @libp2p/gossipsub component. The root cause is defaultDecodeRpcLimits allowing maxIhaveMessageIDs and maxIwantMessageIDs to be Infinity prior to v16.0.0, enabling oversized IHAVE/IWANT control message arrays in message/...

CVE-2026-54886

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Erlang OTP ssh sshsftpd module allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handledata/4 function in sshsftpd contains a catch-all clause that accepts channel data of any type. When...