105 matches found
TwoMillion-Machine-Writeup
マシンについて...
Rocky Linux 8 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc Multiple Vulnerabilities (crlsa-2022_5313)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225313 advisory. curl: OAUTH2 bearer bypass in connection re-use CVE-2022-22576 curl: credential leak on redirect CVE-2022-27774 curl: auth/cookie leak on redirect...
ROS-20260821-73-0017
The vulnerabilities of the functions freeirqcpurmap, irqcpurmaprelease, and irqcpurmapadd in the lib/cpurmap.c module of the Linux operating system are related to the re-use of previously freed memory. Exploiting these vulnerabilities could allow an attacker to compromise the confidentiality,...
EUVD-2013-3309
Malware in sbrugna...
EUVD-2014-0197
Malware in sbrugna...
EUVD-2022-29293
Malicious code in bioql PyPI...
EUVD-2024-24975
Malicious code in bioql PyPI...
EUVD-2023-34751
Malicious code in bioql PyPI...
CVE-2022-24401
Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner. An active adversary can manipulate the view of...
RHEL 5 : curl (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - curl: NTLM password overflow via integer overflow CVE-2018-14618 - cURL and libcurl 7.10.6 through 7.34.0...
CVE-2024-35050
A security vulnerability exists in SurveyKing v1.3.1 , where an attacker can escalate privileges by reusing a session ID belonging to a user who was previously deleted by an administrator. This flaw is attributed to insufficient session expiration (CWE-613). The vulnerability allows for high impa...
BIT-ENVOY-2022-21654 Incorrect configuration handling allows TLS session re-use without re-validation in Envoy
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised...
CVE-2024-24823 graylog2-server Session Fixation vulnerability through cookie injection
Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session cookie would re-use that session id, even if for different user credentials. In this case, the pre-existing session could be used to gain...
CVE-2024-24823: Session Fixation
Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session cookie would re-use that session id, even if for different user credentials. In this case, the pre-existing session could be used to gain...
CVE-2023-49443
DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerability allows attackers to gain access to the application via a bruteforce attack...
CVE-2023-49443
CVE-2023-49443 affects DoraCMS v2.1.8. The root cause is re-use of the same code to verify usernames and passwords, enabling brute-force access to the application. Documents describe impact as attacker access via brute force over the network (no user interaction). Mitigation in the sources includ...
CVE-2022-46480
Incorrect Session Management and Credential Re-use in the Bluetooth LE stack of the Ultraloq UL3 2nd Gen Smart Lock Firmware 02.27.0012 allows an attacker to sniff the unlock code and unlock the device whilst within Bluetooth range...
CVE-2022-46480: Authentication Bypass by Capture-replay
Incorrect Session Management and Credential Re-use in the Bluetooth LE stack of the Ultraloq UL3 2nd Gen Smart Lock Firmware 02.27.0012 allows an attacker to sniff the unlock code and unlock the device whilst within Bluetooth range...
CVE-2022-46480
Incorrect Session Management and Credential Re-use in the Bluetooth LE stack of the Ultraloq UL3 2nd Gen Smart Lock Firmware 02.27.0012 allows an attacker to sniff the unlock code and unlock the device whilst within Bluetooth range...