You get a passkey, you get a passkey, everyone should get a passkey

Microsoft is rolling out passkey support for all consumer accounts. Passkeys are a very secure replacement for passwords that cant be cracked, guessed or phished, and let you log in easily, without having to type a password every time. After enabling them in Windows 11 last year, Microsoft accoun...

CVE-2022-48700

In the Linux kernel, the following vulnerability has been resolved: vfio/type1: Unpin zero pages There's currently a reference count leak on the zero page. We increment the reference via pinuserpagesremote, but the page is later handled as an invalid/reserved page, therefore it's not accounted...

CVE-2022-48700

CVE-2022-48700 affects the Linux kernel VFIO (type1) path, specifically an issue titled “Unpin zero pages.” The connected Nessus entry explicitly references “vfio/type1: Unpin zero pages (CVE-2022-48700),” indicating the vulnerability resides in the VFIO code path and is tied to unpinning of zero...

CVE-2022-48700

Removed by vendor...

Google Announces Passkeys Adopted by Over 400 Million Accounts

Google on Thursday announced that passkeys are being used by over 400 million Google accounts, authenticating users more than 1 billion times over the past two years. "Passkeys are easy to use and phishing resistant, only relying on a fingerprint, face scan or a pin making them 50% faster than...

CVE-2023-51629

D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DCS-8300LHV2 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2023-51629

D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DCS-8300LHV2 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2023-51629

The CVE-2023-51629 entry concerns the D-Link DCS-8300LHV2 ONVIF API, where a hardcoded PIN in the configuration enables authentication bypass. The vulnerability affects the DCS-8300LHV2 IP camera and allows network-adjacent attackers to bypass authentication without user interaction. The issue is...

CVE-2023-51629 D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability

D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DCS-8300LHV2 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2023-51629 D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability

D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DCS-8300LHV2 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2024-27027

In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpllxarefdel for multiple registrations Currently, if there are multiple registrations of the same pin on the same dpll device, following warnings are observed: WARNING: CPU: 5 PID: 2212 at drivers/dpll/dpllcore.c:143...

CVE-2024-27027

In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpllxarefdel for multiple registrations Currently, if there are multiple registrations of the same pin on the same dpll device, following warnings are observed: WARNING: CPU: 5 PID: 2212 at drivers/dpll/dpllcore.c:143...

kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack

A vulnerability was found in Linux Kernel, where Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack. When an attacker connects to a victim device using the address of the device and the victim initiates a Pairing, the attacker can reflect the encrypted nonce even...

kernel: usb: typec: altmodes/displayport: fix pin_assignment_show

An out-of-bounds array access was found in the USB Type-C DisplayPort altmode driver. When no compatible pin assignments are found, the code performs negative array indexing, causing a use-after-free or out-of-bounds read...

RHEL 9 : kernel (RHSA-2024:2394)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2394 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: GSM multiplexing race conditio...

Fedora 40 : clevis-pin-tpm2 / keyring-ima-signer / python-cryptography / etc (2023-af8489dc5b)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-af8489dc5b advisory. Affected applications were rebuilt against version 0.10.60 of the the openssl crate the Rust bindings for OpenSSL to address two security advisories: -...

CentOS 9 : opensc-0.23.0-3.el9

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the opensc-0.23.0-3.el9 build changelog. - Potential PIN bypass CVE-2023-40660 - Dynamic analyzers reports in pkcs15init CVE-2023-40661 - Out-of-bounds read in MyEID driver handlin...

RHEL 5 : pki (RHSA-2010:0838)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0838 advisory. Red Hat Certificate System is an enterprise software system designed to manage enterprise public key infrastructure PKI deployments. Simple...

CVE-2024-3871

CVE-2024-3871 affects Delta Electronics DVW-W02W2-E2 web administration interface, with versions up to 2.5.2. The issue stems from command injections and stack overflows in the web UI, enabling remote attackers to achieve remote code execution with elevated privileges. The NVD entry states this c...

CVE-2024-29840

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOPEDITUSERGETPINFIELDS, allowing for an unauthenticated attacker to return the pin value of any user...