BIT-MARIADB-2023-22084

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Serve...

CVE-2023-37822

The Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network for its ecosystem, which serves as a proxy to the end user's primary network. The WPA2-PSK generation of this dedicated network is flawed and solely based on the serial number. Due to the flawed generation...

USN-7055-1: FreeRADIUS vulnerability

Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl discovered that FreeRADIUS incorrectly authenticated certain responses. An attacker able to intercept communications between a RADIUS client and server could possibly use this issue to forge responses,...

GitHub Enterprise 3.10.x < 3.10.16 / 3.11.x < 3.11.14 / 3.12.x < 3.12.8 / 3.13.x < 3.13.3 (ghsa_5wm9_5344_qrrj)

The version of GitHub Enterprise installed on the remote host is prior to 3.10.16, 3.11.14, 3.12.8, or 3.13.3. It is, therefore, affected by a vulnerability as referenced in the ghsa5wm95344qrrj advisory. - An XML signature wrapping vulnerability was present in GitHub Enterprise Server GHES when...

CVE-2024-47616 Pomerium's service account access token may grant unintended access to databroker API

Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON Web Token JWT signed by a key known by all Pomerium servic...

PT-2024-32675 · Pomerium +1 · Pomerium +1

Name of the Vulnerable Software and Affected Versions: Pomerium versions prior to 0.27.1 Description: Pomerium is an identity and context-aware access proxy. The Pomerium databroker service manages all persistent Pomerium application state. Requests to the databroker service API are authorized by...

Deep Dive into the Latest API Security Vulnerabilities in Envoy

Envoy has carved out a critical role in cloud-native computing, becoming increasingly prevalent as the default ingress controller for Kubernetes. This high-performance proxy, developed by Lyft and now part of the Cloud Native Computing Foundation’s arsenal, is integral for companies scaling up...

CVE-2024-6593

Incorrect Authorization vulnerability in WatchGuard Authentication Gateway aka Single Sign-On Agent on Windows allows an attacker with network access to execute restricted management commands. An attacker that has already gained network access could exploit this vulnerability to retrieve...

CVE-2024-6594

Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash while handling malformed commands. An attacker with network access to the client could create a denial of service condition for the Single Sign-On service by...

CVE-2024-6592

An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway aka Single Sign-On Agent on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker with network access to forge communications to affected...

CVE-2024-6594 WatchGuard Firebox Single Sign-On Client Denial-of-Service

Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash while handling malformed commands. An attacker with network access to the client could create a denial of service condition for the Single Sign-On service by...

CVE-2024-6594 WatchGuard Firebox Single Sign-On Client Denial-of-Service

Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash while handling malformed commands. An attacker with network access to the client could create a denial of service condition for the Single Sign-On service by...

CVE-2024-6593 WatchGuard Firebox Single Sign-On Agent Management Interface Authentication Bypass

Incorrect Authorization vulnerability in WatchGuard Authentication Gateway aka Single Sign-On Agent on Windows allows an attacker with network access to execute restricted management commands. An attacker that has already gained network access could exploit this vulnerability to retrieve...

CVE-2024-6593

CVE-2024-6593 describes an Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) for Windows, affecting versions up to 12.10.2. The underlying issue allows an attacker with network access to execute restricted management commands, indicating a privi...

WatchGuard Authentication Gateway 安全漏洞

WatchGuard Authentication Gateway WatchGuard Single Sign-On Agent is an authentication gateway from WatchGuard USA. A security vulnerability exists in WatchGuard Authentication Gateway version 12.10.2 and earlier, which stems from improper authorization checking and allows an attacker with networ...

VMware vCenter Server 7.x < 7.0 U3t / 8.x < 8.0.3 U3d Multiple Vulnerabilities (VMSA-2024-0019)

The version of VMware vCenter Server installed on the remote host is 7.x prior to 7.0 U3t or 8.x prior to 8.0 U3d. It is, therefore, affected by multiple vulnerabilities as referenced in the VMSA-2024-0019 advisory: - The vCenter Server contains a heap-overflow vulnerability in the implementation...

VulnCheck KEV: CVE-2024-38812

VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet...

CVE-2024-8890

An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions due to the fact that the device only implements the HTTP protocol. This fact prevents a secure communication channel from being establish...

CVE-2024-8890

CVE-2024-8890 affects CIRCUTOR Q-SMT devices running firmware 1.0.4. The root issue is that the device only implements the HTTP protocol, preventing a secure channel and enabling an attacker with network access to obtain legitimate credentials or steal sessions. The exploitation context is networ...

CVE-2024-8888

An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network...