474 matches found
dnsrecon
DNSRecon DNSRecon is a Python port of a Ruby script that I wrote to learn the language and about DNS in early 2007. This time I wanted to learn about Python and extend the functionality of the original tool and in the process re-learn how DNS works and how could it be used in the process of a...
CVE-2025-62819
Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA Registration Authority User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status...
CVE-2025-62819
Keyfactor EJBCA through version 9.3.3 contains an authorization flaw in the RA (Registration Authority) User Interface . The system performs insufficient checks when a remote user self-renews a client certificate, allowing them to bypass end entity status or profile settings that should otherwise...
EUVD-2025-211240
Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA Registration Authority User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status...
CVE-2025-62819
Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA Registration Authority User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status...
PT-2026-135437
Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA Registration Authority User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status...
CVE-2025-62819: n/a: Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via…
Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA Registration Authority User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status...
SolarWinds Web Help Desk Ticket Read (CVE-2024-28987)
Horizon3 PoC: default helpdeskIntegrationUser Basic auth on /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets — data read only. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2024-28987 — SolarWinds Web Help Desk hardcoded API credentials Horizon3. Auxiliary: reads Orion tickets via Basic auth...
Cross-site Scripting (XSS)
Overview org.webjars.npm:ra-core is a Core components of react-admin, a frontend Framework for building admin applications on top of REST services, using ES6, React Affected versions of this package are vulnerable to Cross-site Scripting XSS via UrlField and FileField, which pass user-supplied UR...
peacetrue-gojs (0.1.0) potentially affected by CVE-2026-113350 via ra-core (5.1.1)
ra-core NPM version 5.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on ra-core and may be impacted: - peacetrue-gojs 0.1.0 Source cves: CVE-2026-113350 Source advisory: SNYK:JS-RACORE-21369627...
Cross-site Scripting (XSS)
Overview ra-core is a Core components of react-admin, a frontend Framework for building admin applications on top of REST services, using ES6, React Affected versions of this package are vulnerable to Cross-site Scripting XSS via UrlField and FileField, which pass user-supplied URL values directl...
Linux Distros Unpatched Vulnerability : CVE-2026-108266
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel- binding support. Prior to privasys-v0.8.1, the fork emitt...
ESAU: Expeditious Swarm Remote Attestation for Pub-Sub IoT Networks with Untrusted Cloud-Based Proxy Verifier
As Internet of Things IoT devices collect and process data, security is essential. IoT devices often combine with other emerging technologies, such as artificial intelligence AI and fifth-generation 5G communications, to support applications such as smart grids and internet-of-vehicles IoV. Becau...
UBUNTU-CVE-2026-108266
Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...
CVE-2026-108266
Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...
AZL-107982 CVE-2026-108267 affecting package golang 1.26.7-1
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who...
AZL-107985 CVE-2026-108267 affecting package golang 1.27.1-1
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who...
CVE-2026-108268
Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to th...
AZL-107973 CVE-2026-108267 affecting package gcc 13.2.0-7
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who...
AZL-107997 CVE-2026-108267 affecting package python-tensorboard 2.16.2-6
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who...