19740 matches found
AZL-54320 CVE-2024-45337 affecting package moby-engine for versions less than 24.0.9-13
Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...
UBUNTU-CVE-2024-45337
Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...
forgejo -- multiple vulnerabilities
Problem Description: When Forgejo is configured to run the internal ssh server with server.STARTSSHSERVER=true, it was possible for a registered user to impersonate another user. The rootless container image uses the internal ssh server by default and was vulnerable. A Forgejo instance running fr...
forgejo -- unauthorized user impersonation
Problem Description: When Forgejo is configured to run the internal ssh server with server.STARTSSHSERVER=true, it was possible for a registered user to impersonate another user. The rootless container image uses the internal ssh server by default and was vulnerable. A Forgejo instance running fr...
Virtuozzo Hybrid Server 7.5 Update 7 Hotfix 1 (7.5.7-151)
The Hotfix 1 for Virtuozzo Hybrid Server 7.5 Update 7 provides new features, as well as stability and usability bug fixes. Vulnerability id: PSBM-159866 Fixed an issue with the 'c2v-convert' tool failing while creating a filesystem for a virtual machine's disk. Vulnerability id: PSBM-159824 The...
CVE-2024-45337: Undefined Security Weakness
Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...
GHSA-V778-237X-GJRC Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate."...
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate."...
CVE-2024-45337 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...
CVE-2024-45337
Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...
CVE-2024-12286
MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials...
CVE-2024-12286
CVE-2024-12286 affects the MOBATIME Network Master Clock – DTS 4801. The issue is use of default SSH credentials that allow attackers to gain initial access over the network. Exploitation could enable full OS control with high impact on confidentiality, integrity, and availability (per ICS/CTI as...
CVE-2024-12286 MOBATIME Network Master Clock has a use of default credentials vulnerability
MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials...
CVE-2024-12286 MOBATIME Network Master Clock has a use of default credentials vulnerability
MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials...
CVE-2024-12286: Use of Default Credentials
MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials...
PT-2024-17527
Name of the Vulnerable Software and Affected Versions MOBATIME Network Master Clock - DTS 4801 affected versions not specified Description The issue allows attackers to gain initial access using default credentials via SSH. Recommendations At the moment, there is no information about a newer...
CVE-2024-55560
MailCleaner before 28d913e has default values of sshhostdsakey, sshhostrsakey, and sshhosted25519key that persist after installation...
CVE-2024-55560
MailCleaner before 28d913e has default values of sshhostdsakey, sshhostrsakey, and sshhosted25519key that persist after installation...