PT-2023-5295 · Digi · Digi Realport

Name of the Vulnerable Software and Affected Versions: Digi RealPort affected versions not specified Description: The issue is related to the use of a password hash instead of the password itself for authentication, which can be exploited by an attacker to compromise the target system. It is also...

node-saml 代码问题漏洞

node-saml is a SAML library that does not depend on any framework running in Node.js. A code issue vulnerability exists in Node-SAML versions prior to 4.0.5 that stems from not checking the current timestamp, and LogoutRequest XML can be reused multiple times...

vulnerability due to the nonce rolling over and generating duplicate salts

Lines of code Vulnerability details Impact An attacker could take the transaction data from the original proposal and re-submit it to the L2 timelock with the same salt. This would get executed again since the salt matches, allowing the attacker to replay the state change. Proof of Concept The...

Security council election are vulnerable to signature replay attack

Lines of code Vulnerability details Impact SecurityCouncilNomineeElectionGovernor and SecurityCouncilMemberElectionGovernor contracts both inherit castVoteWithReasonAndParamsBySig function from the base GovernorUpgradeable contract, but implement custom countVote function respectively. The...

EulerOS Virtualization 3.0.6.6 : kernel (EulerOS-SA-2023-2444)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : roccatreportevent in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free...

Replay Attack Vulnerability Due to Uniqueness Invariant Violation in AxelarServiceGovernance Contract's Proposal Hash Generation

Lines of code Vulnerability details Impact The current implementation of the AxelarServiceGovernance contract relies solely on the Keccak256 algorithm to generate proposal hashes, using only the target contract's address, encoded function call data, and the native token transfer value as...

CVE-2023-34625

ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. The implementation of the lock opening mechanism via Bluetooth Low Energy BLE is vulnerable to replay attacks. A malicious user is able to intercept BLE requests and replicate them to open the lock at any time...

MojoBox BLE Replay Attack

Exploit Title: MojoBox v1.4 BLE replay attack Exploit Author: Matteo Mandolini Date : 15/03/2023 Vendor Homepage: https://hello.showmojo.com/mojobox/ Version: 1.4 CVE: CVE-2023-34625 BLE Replay attack ShowMojo MojoBox Digital Lockbox with firmware versione prior to 1.4 is vulnerable to...

The vulnerabilities of the Ethernet modules FX3U-ENET-ADP and Ethernet FX3U-ENET(-L) of the microprogrammable logic controllers MELSEC iQ-F series, such as FX3U, FX3UC, FX3G, FX3GC-32MT, FX3GE, FX3GA, FX3S, and FX3SA, allow attackers to circumvent security restrictions and reset system settings.

The vulnerability of the Ethernet modules FX3U-ENET-ADP and Ethernet FX3U-ENET-L of the microprogrammable logic controllers MELSEC iQ-F series, such as FX3U, FX3UC, FX3G, FX3GC-32MT, FX3GE, FX3GA, FX3S, and FX3SA, stems from the ability to bypass authentication by using capture-replay techniques...

Mitsubishi Electric MELSEC iQ-F series 安全漏洞

The Mitsubishi Electric MELSEC iQ-F series is a programmable logic controller from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric MELSEC iQ-F series, which stems from a capture replay vulnerability that bypasses authentication and allows an unauthenticated,...

CVE-2023-34553

An issue was discovered in WAFU Keyless Smart Lock v1.0 allows attackers to unlock a device via code replay attack...

CVE-2023-34553

An issue was discovered in WAFU Keyless Smart Lock v1.0 allows attackers to unlock a device via code replay attack...

CVE-2023-34553

An issue was discovered in WAFU Keyless Smart Lock v1.0 allows attackers to unlock a device via code replay attack...

Code injection

An issue was discovered in WAFU Keyless Smart Lock v1.0 allows attackers to unlock a device via code replay attack...

PT-2023-24920 · Wafu · Wafu Keyless Smart Lock

Name of the Vulnerable Software and Affected Versions: WAFU Keyless Smart Lock version 1.0 Description: An issue was discovered that allows attackers to unlock a device via a code replay attack. Recommendations: For WAFU Keyless Smart Lock version 1.0, at the moment, there is no information about...

CVE-2023-34553

An issue was discovered in WAFU Keyless Smart Lock v1.0 allows attackers to unlock a device via code replay attack...

WAFU Keyless Smart Lock 安全漏洞

WAFU Keyless Smart Lock is a series of smart locks from the Chinese company WAFU. A security vulnerability exists in WAFU Keyless Smart Lock v1.0, which stems from a vulnerability that allows an attacker to unlock a device via a code replay attack...

CVE-2023-34553

An issue was discovered in WAFU Keyless Smart Lock v1.0 allows attackers to unlock a device via code replay attack...

CVE-2023-34553

The CVE-2023-34553 entry concerns WAFU Keyless Smart Lock v1.0, where a vulnerability allows unlocking the device via a code replay attack. The issue affects the Keyless Smart Lock software component; underlying cause details are not explicitly provided beyond the replay mechanism described in mu...

An agent without permission has the ability to update, add, or delete FAQ items

Description I discovered a vulnerability in the osticket application. When an administrator creates a category and adds some FAQ items, they have the ability to grant update, delete, and add permissions to agents. Once granted access, an agent can login and edit, delete, or add FAQs and record...