812 matches found
Nomad's mTLS Authorization Mechanism Susceptible to Privilege Escalation
Summary Nomad and Nomad Enterprise “Nomad” up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Assigned CVE-2020-7956, this vulnerability was fixed in Nomad 0.10.3. Background Securing Nomad’s cluster...
Information Disclosure
nat.js is vulnerable to information disclosure. The vulnerability exists as it leaks options to the NATS server, including TLS private credentials, when Mutual TLS is used, where the credentials for the TLS client keys are included in the connection configuration options...
Sensitive data exposure in NATS
Overview Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials. The connection configuration options in these JavaScript-based implementatio...
Sensitive data exposure in NATS
Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials. The connection configuration options in these JavaScript-based implementations were...
CVE-2020-17473
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to obtain a long-lasting token by impersonating the server...
CVE-2020-17473
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to obtain a long-lasting token by impersonating the server...
CVE-2020-17473
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to obtain a long-lasting token by impersonating the server...
CVE-2019-20894
Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...
CVE-2019-20894
Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...
PT-2020-10858 · Containous · Traefik
Name of the Vulnerable Software and Affected Versions: Traefik versions 2.x Description: The issue allows HTTPS sessions to proceed without mutual TLS verification in certain configurations, where an error should have occurred due to a bad SSL client authentication certificate. This situation can...
CVE-2019-18246
BIOTRONIK CardioMessenger II, The affected products do not properly enforce mutual authentication with the BIOTRONIK Remote Communication infrastructure...
CVE-2019-18246
BIOTRONIK CardioMessenger II, The affected products do not properly enforce mutual authentication with the BIOTRONIK Remote Communication infrastructure...
Authentication flaw
BIOTRONIK CardioMessenger II, The affected products do not properly enforce mutual authentication with the BIOTRONIK Remote Communication infrastructure...
CVE-2019-18246
BIOTRONIK CardioMessenger II, The affected products do not properly enforce mutual authentication with the BIOTRONIK Remote Communication infrastructure...
CVE-2019-18246
The connected sources confirm CVE-2019-18246 affects BIOTRONIK CardioMessenger II (home monitoring unit). The root issue is improper authentication with the BIOTRONIK Remote Communication infrastructure (CWE-287), enabling an attacker with adjacent access to interact with or intercept communicati...
SAyHello - Capturing Audio (.Wav) From Target Using A Link
Capturing audio .wav from target using a link How it works? After the user grants microphone permissions, a website redirect button of your choice is released to distract the target while small audio files about 4 seconds in wav format are sent to the attacker. It uses Recorderjs, plugin for...
Improper Authentication in requests-kerberos
python-requests-Kerberos through 0.5 does not handle mutual authentication...
The vulnerability of the PRNG component of the FortiOS operating system allows a hacker to gain unauthorized access to protected information.
The vulnerability of the PRNG component in the FortiOS operating system relates to the use of a weak entropy source during key generation. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information, when FortiOS acts as a client...
New LTE Network Flaw Could Let Attackers Impersonate 4G Mobile Users
A group of academics from Ruhr University Bochum and New York University Abu Dhabi have uncovered security flaws in 4G LTE and 5G networks that could potentially allow hackers to impersonate users on the network and even sign up for paid subscriptions on their behalf. The impersonation attack —...