ADZero

설명 취약한 암호화 프로토콜이 netlogon 프로토콜의 인증 메커니즘 대신 적용됩니다. 인증되지 않은 공격자는 Zerologon 취약점을 사용하여 도메인 컨트롤러 컴퓨터의 컴퓨터 계정 비밀번호를 빈 값null으로 생성할 수 있습니다 NT hash = 31d6cfe0d16ae931b73c59d7e0c089c0. 이렇게 공격자는 생성한 자격 증명으로 도메인 컨트롤러에 접근하여 다른 사용자의 자격 증명을 획득할 수 있습니다. 권한 있는 사용자의 자격 증명이 획득되면 도메인 컨트롤러에서 높은 권한으로 세션을 얻을 수 있습니다. 설치...

cve-2026-43512-poc

CVE-2026-43512 — Apache Tomcat DIGEST 인증 우회 익스플로잇 가능성 분석 결과: 근본 원인이 확인되었습니다. 표준 UserDatabaseRealm 배포에 대한 종단 간 익스플로잇은 재현되지 않습니다. 자세한 내용은 분석을 참조하세요. 목차 개요 영향받는 버전 근본 원인 분석 저장소 구조 요구 사항 사용법 예상 출력 참고 자료 면책 조항 개요 CVE-2026-43512는 Apache Tomcat의 HTTP DIGEST 인증 메커니즘의 취약점입니다. RealmBase.getDigest 메서드는 A1 해...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

GO-2026-5557 Note Mark: OIDC-registered users authenticated by submitting password "null" in github.com/enchant97/note-mark/backend

Note Mark: OIDC-registered users authenticated by submitting password "null" in github.com/enchant97/note-mark/backend...

PT-2026-47648

Name of the Vulnerable Software and Affected Versions Spring LDAP versions 2.4.0 through 2.4.4 Spring LDAP versions 3.2.0 through 3.2.17 Spring LDAP versions 3.3.0 through 3.3.7 Spring LDAP versions 4.0.0 through 4.0.3 Description DirContextAuthenticationStrategy implementations fail to reject bi...

Exploit for CVE-2026-43512

CVE-2026-43512 — Apache Tomcat DIGEST Authentication Bypass...

CVE-2026-32965

Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc. When the affected device is connected to the network with the initial factory-default configuration, the device can be configured with the null string password...

CVE-2026-43512

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls. Mitigation To mitigate this issue, disable DIGEST...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the IsPasswordMatch function. An attacker can gain unauthorized access to accounts registered through OIDC by submitting the password "null" to the internal login endpoint, which results in a valid session...

GHSA-PXF8-6WQM-R6HH Note Mark: OIDC-registered users authenticated by submitting password "null"

Summary IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt"null" placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for...

PT-2026-35503

Name of the Vulnerable Software and Affected Versions Note Mark versions prior to 0.19.3 Description An authentication bypass exists in the internal login endpoint. The IsPasswordMatch function in backend/db/models.go uses a hard-coded bcrypt"null" placeholder when a user has no stored password...

EUVD-2026-23758

Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc. When the affected device is connected to the network with the initial factory-default configuration, the device can be configured with the null string password...

CVE-2026-32965

Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc. When the affected device is connected to the network with the initial factory-default configuration, the device can be configured with the null string password...

CVE-2026-32965

Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc. When the affected device is connected to the network with the initial factory-default configuration, the device can be configured with the null string password...

CVE-2026-32965

Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc. When the affected device is connected to the network with the initial factory-default configuration, the device can be configured with the null string password...

CVE-2026-32965

CVE-2026-32965 affects silex technology SD-330AC and AMC Manager. The vulnerability arises from initializing a resource with an insecure default configuration, allowing a device on factory-default settings to be configured with a null string password upon network connection. This has potential im...