14164 matches found
Design/Logic Flaw
Headscale through 0.22.3 writes bearer tokens to info-level logs...
CVE-2023-47390
Headscale through 0.22.3 writes bearer tokens to info-level logs...
CVE-2023-47390
Headscale up to 0.22.3 stores bearer tokens in info‑level logs via the HTTP API, exposing credentials in logs. Multiple connected sources corroborate that tokens are written to logs when accessing the API, with the root cause described as logging sensitive data. Affected: Headscale; component: HT...
CVE-2023-47390
Headscale through 0.22.3 writes bearer tokens to info-level logs...
CVE-2023-47390
Headscale through 0.22.3 writes bearer tokens to info-level logs...
GHSA-CFC2-WR2V-GXM5 AsyncSSH Rogue Extension Negotiation
Summary An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack. Details The rogue extension negotiation attack targets an AsyncSSH client connecting to any SSH server sending an extension info message. The attack...
AsyncSSH Rogue Extension Negotiation
Summary An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack. Details The rogue extension negotiation attack targets an AsyncSSH client connecting to any SSH server sending an extension info message. The attack...
PT-2023-30426 · Unknown · Nagaoka Taxi Line
Name of the Vulnerable Software and Affected Versions: nagaoka taxi Line version 13.6.1 Description: The issue allows remote attackers to send malicious notifications to victims due to the leakage of channel access token. Recommendations: For version 13.6.1, consider restricting access to the...
PT-2023-9800
Name of the Vulnerable Software and Affected Versions AsyncSSH versions prior to 2.14.1 Description The issue in AsyncSSH allows attackers to control the extension info message via a man-in-the-middle attack, enabling them to conduct algorithm downgrade attacks during user authentication. This ca...
Threat Actors Leverage File-Sharing Service and Reverse Proxies for Credential Harvesting
We analyzed a phishing campaign involving malicious emails containing a link to a file-sharing solution, which further leads to a PDF document with a secondary link designed to steal login info and session cookies...
kernel: KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache
In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or refresh inactive gfntopfncache Reject kvmgpccheck and kvmgpcrefresh if the cache is inactive. Not checking the active flag during refresh is particularly egregious, as KVM can end up with a vali...
kernel: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
A flaw was found in the libata module in the Linux kernel. A NULL pointer dereference can be triggered in the unlikely case that the PPI, an array of ATA portinfo, argument of the atahostallocpinfo function is NULL. This issue causes a crash and results in a denial of service...
kernel: usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
In the Linux kernel, the following vulnerability has been resolved: usb: host: xhci: Fix potential memory leak in xhciallocstreaminfo xhciallocstreaminfo allocates stream context array for streaminfo -streamctxarray with xhciallocstreamctx. When some error occurs, streaminfo-streamctxarray is not...
kernel: power: supply: fix null pointer dereferencing in power_supply_get_battery_info
In the Linux kernel, the following vulnerability has been resolved: power: supply: fix null pointer dereferencing in powersupplygetbatteryinfo when kmalloc fail to allocate memory in kasprintf, propname will be NULL, strcmp called by ofgetproperty will cause null pointer dereference. So return...
CVE-2023-28566
Information disclosure in WLAN HAL while handling the WMI state info command...
Command injection
Information disclosure in WLAN HAL while handling the WMI state info command...
CVE-2023-28566 Buffer Over-read in WLAN HAL
Information disclosure in WLAN HAL while handling the WMI state info command...
CVE-2023-28566 Buffer Over-read in WLAN HAL
Information disclosure in WLAN HAL while handling the WMI state info command...
PT-2023-18480
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue involves memory corruption in a multi-mode call processor when processing a bit mask API. Recommendations At the moment, there is no information about a newer version that...
