PT-2020-14589

Name of the Vulnerable Software and Affected Versions Nim version 1.2.4 Description The standard library httpClient in Nim fails to properly validate the server response. For instance, httpClient.get.contentLength does not raise an error if a malicious server provides a negative Content-Length...

PT-2020-14588

Name of the Vulnerable Software and Affected Versions Nim version 1.2.4 Description The standard library httpClient in Nim is susceptible to a CR-LF injection in the target URL. This injection can occur if an attacker controls any part of the URL provided in a call, such as httpClient.get or...

CVE-2020-15694: Improper Input Validation

In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get.contentLength does not raise any error if a malicious server provides a negative Content-Length...

CVE-2020-15693: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call such as httpClient.get or httpClient.post, the User-Agent header value, or custom HTTP header names or value...

CVE-2020-15692: Improper Neutralization of Argument Delimiters in a Command

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system...

Unspecified vulnerability in HTTP authentication library for Nim

HTTP authentication library for Nim is an HTTP authentication library for the Nim language. A security vulnerability exists in versions of HTTP authentication library for Nim prior to 2019-12-27, which stems from the program failing to use the default algorithm used for the 'cryptopwhashstr'...

CVE-2019-20138

The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's cryptopwhashstr is not used...

CVE-2019-20138

The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's cryptopwhashstr is not used...

Authentication flaw

The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's cryptopwhashstr is not used...

CVE-2019-20138

The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's cryptopwhashstr is not used...

CVE-2019-20138

CVE-2019-20138 affects Nim’s HTTP Authentication library up to 2019-12-27. The root cause is failing to use libsodium’s default password-hash algorithm (crypto_pwhash_str), leading to weak password hashing. Impact is described as weak authentication security; CVSS notes show high severity (3.1) w...

PT-2019-16097

Name of the Vulnerable Software and Affected Versions HTTP Authentication library for Nim versions prior to 2019-12-27 Description The issue is related to weak password hashing. The default algorithm for libsodium's crypto pwhash str is not used in the affected versions. Recommendations For...

CVE-2019-20138: Use of a Broken or Risky Cryptographic Algorithm

The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's cryptopwhashstr is not used...

Zebrocy Retools for New Political Attacks

The APT known as the Sednit threat group also known as Sofacy, APT28 and Fancy Bear has kicked off a fresh spearphishing campaign, that was spotted targeting government entities with the Zebrocy backdoor. The malware features a rewritten and newly-improved backdoor and downloader, indicating an...

DrMITM - Program Designed To Globally Log All Traffic Of A Website

DrMITM is a program designed to globally log all traffic. How it works DrMITM sends a request to website and returns the IP of the website just in case the server of the website is designed to rely on the website IP for requests, and the request that goes to the website also ends up being sent to...

nim-khi.edu.pk XSS vulnerability

Open Bug Bounty ID: OBB-673395 Description| Value ---|--- Affected Website:| nim-khi.edu.pk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Novell GroupWise Messenger Client <= 2.1.0 Unicode Stack Overflow

No description provided by source. Luigi Auriemma Application: Novell GroupWise Messenger client http://www.novell.com/products/groupwise/ Versions: = 2.1.0 Platforms: Windows, Linux, NetWare Bug: unicode stack overflow Exploitation: remote, versus server Date: 16 Feb 2012 found 09 May 2011 Autho...

PT-2013-1327

Name of the Vulnerable Software and Affected Versions Nim versions prior to 1.4.2 Description The issue is related to the Nim standard library, where SSL/TLS certificate verification for the httpClient is disabled by default. This could potentially allow a remote attacker to impact data integrity...

CVE-2013-1085

CVE-2013-1085 affects the nim protocol handler in Novell GroupWise Messenger (GroupWise Messenger 2.04 and earlier) and Novell Messenger 2.1.x/2.2.x before 2.2.2. It is a stack-based buffer overflow triggered by an import command with a long filename parameter, allowing remote code execution. Exp...

CVE-2013-1085: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the nim: protocol handler in Novell GroupWise Messenger 2.04 and earlier, and Novell Messenger 2.1.x and 2.2.x before 2.2.2, allows remote attackers to execute arbitrary code via an import command containing a long string in the filename parameter...