CTF-2021

CTF-2021 참고 사항 이 CTF는 인증에 DB를 사용하지 않습니다. 또한, 다음의 이유로 이 CTF는 정적 토큰을 생성합니다: 1. 사용자가 다른 방식으로 이 CTF를 해결할 가능성을 최소화합니다. 2. 사용자가 웹 페이지/토큰을 수정하거나 우회하여 힌트를 놓칠 가능성을 최소화합니다. 3. 적은 트래픽 4. 이 CTF를 해결하는 사용자에게 더 높은 신뢰성. LPE 부분에는 ubuntu 20.04를 권장합니다. 이것을 클론하는 경우, 이 README.md 파일은 힌트를 포함하고 있으므로 삭제해 주십시오...

Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries

Summary Aggregate functions min, max applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy, any authenticated user with read access to the affected collection can extract concealed field values, includi...

CVE-2024-47822

CVE-2024-47822 – Directus : The issue arises from access tokens in query strings not being redacted when LOG_STYLE is set to raw, allowing potential exposure of long‑lived tokens in system logs. This could enable an attacker with log access to gain administrative control or perform unauthorized d...

SUSE CVE-2013-3712

SUSE Studio Onsite 1.3.x before 1.3.6 and SUSE Studio Extension for System z 1.3 uses "static" secret tokens, which has unspecified impact and vectors...

CVE-2019-10176

A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain static during a user's session. An attacker with the ability to observe the value of this token would be able to re-use the token to perfo...

CVE-2013-3712

SUSE Studio Onsite 1.3.x before 1.3.6 and SUSE Studio Extension for System z 1.3 uses "static" secret tokens, which has unspecified impact and vectors...