1072 matches found
CVE-2026-86115 Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...
CVE-2026-86115
Sim (an open-source tool by SimStudio) before 0.8.14 contains a confused deputy flaw in tool URL routing. Requests are classified as internal via URL prefix matching without scheme normalization , causing SSRF validation to be skipped and internal authentication tokens to be minted for user-suppl...
CVE-2026-86115: Unintended Proxy or Intermediary
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...
PT-2026-86386
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...
ossec-hids v4.3.0
OSSEC v4.2.0 Information about OSSEC OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS host-based intrusion detection, log monitoring and SIM/SIEM together in a simple, powerful and open source solution. Visit our website for the latest...
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices
A malicious SIM card can order the device it sits in to run commands of the attacker's choosing. On the cellular modules built into electric-vehicle chargers, industrial routers, and car telematics units, that is enough to take the whole device over. Researchers at the University of Birmingham an...
PT-2026-73233
damn so check this out... basically some crazy smart researchers found out that a bad SIM card can straight up hijack IoT devices like EV chargers and industrial routers using this sneaky old command called RUN AT. if an attacker gets physical access to stick a malicious card in there, it gives...
CATana: On the Dangers of SIM-Originating AT Commands
Hostile SIMs have been discussed as an attack vector against Mobile Equipment ME connected to cellular networks. One main attack path are proactive commands sent from the SIM to the victim device. In this work, the authors examine the threats posed by the RUN AT command which are SIM-originating...
CVE-2026-21061
Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...
CVE-2026-21061
Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...
EUVD-2026-55086
Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...
CVE-2026-21061
Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...
CVE-2026-21061
Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...
CVE-2026-21061: Improper Input Validation
Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...
PT-2026-69387
Name of the Vulnerable Software and Affected Versions Samsung Dialer versions prior to SMR Aug-2026 Release 1 Description Improper input validation in the Samsung Dialer allows remote attackers to access SIM related functions. This issue requires user interaction to be triggered. Recommendations...
An analysis of incidents at Brazilian educational institutions
Introduction Because of the amount of data that can be obtained and the high impact that successful attacks may have, educational institutions are frequent targets of cybercriminals. Both public and private schools and universities rely on software for managing personally identifiable information...
CVE-2026-18584
A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...
CVE-2026-67596
CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the configuration backup file. Attackers can...
CVE-2026-67596 CSL 1010 M2M 3G WiFi Module 2.2.1.4 Weak Encryption via Router.cfg
CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the configuration backup file. Attackers can...
CSL 1010 M2M 3G WiFi Module 2.2.1.4 (Router.cfg) Weak XOR Encryption
Summary The CSL 1010 M2M 3G WiFi Module is a portable 3G/LTE router that stores its configuration in a backup file Router.cfg. Description The device protects its configuration file Router.cfg with a weak/insecure obfuscation single-byte XOR cipher using a static key 0xEC instead of real...