128 matches found
CVE-2026-79782
rclone before version 1.74.4 does not strip the X-Amz-Security-Token header when an S3 redirect changes the scheme from HTTPS to HTTP on the same host. An attacker positioned to intercept the resulting plaintext HTTP traffic can capture AWS STS session tokens transmitted in request headers, poten...
CVE-2026-39944
A flaw was found in Ceph RGW's STS Security Token Service session token implementation. The STS tokens use the same unauthenticated AES-128-CBC encryption as CephX, which lacks message authentication and uses a hardcoded initialization vector. Because there is no integrity protection on the token...
GHSA-XC2P-8GGW-6CR5 vulnerabilities
Vulnerabilities for packages: nri-mssql, prometheus-alertmanager-fips, rancher-fleet-fips, rke2-runtime-fips, docker-machine-driver-linode, crossplane-provider-aws-detective, opensearch-k8s-operator, nri-haproxy, kubeflow-fips, tbot, ksops-fips, sftpgo-plugin-geoipfilter, buildah-fips,...
GO-2025-3779 vulnerabilities
Vulnerabilities for packages: octo-sts...
GO-2025-3779 vulnerabilities
Vulnerabilities for packages: octo-sts...
GO-2026-5039 vulnerabilities
Vulnerabilities for packages: apisix-ingress-controller, gatus, gostatsd, rancher-webhook, dapr, bento, kubescape-operator, tekton-chains, crossplane-provider-aws-cloudfront, argo-events, prometheus-adapter, zarf, timoni, aws-node-termination-handler, istio, kube-bench, step-issuer, flannel,...
CVE-2026-54203
The CVE describes a memory leak in Tobit Laboratories AG TeamDavid’s Webbox. The vulnerability is triggered by accessing the endpoint /.well-known/mta-sts, allowing an unauthenticated attacker to repeatedly request the URL and potentially read sensitive information (including user passwords). It ...
CVE-2026-54203 TeamDavid: Memory Leak leaking sensitive information
Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds with memory. By repeatedly requesting this endpoint, an attacker can access sensitive...
GHSA-W8RR-5GCM-PP58 vulnerabilities
Vulnerabilities for packages: gitaly-fips, grafana-rollout-operator, tkn, opa-fips, prometheus-alertmanager, tkn-fips, octo-sts, opentelemetry-collector-contrib, gatekeeper, gitlab-cng, hydra, gitaly, zitadel, buildkitd, headlamp-fips, prometheus-alertmanager-fips, cloudprober, datadog-agent,...
CVE-2026-39882 vulnerabilities
Vulnerabilities for packages: gitaly-fips, grafana-rollout-operator, tkn, opa-fips, prometheus-alertmanager, tkn-fips, octo-sts, opentelemetry-collector-contrib, gatekeeper, gitlab-cng, hydra, gitaly, zitadel, buildkitd, headlamp-fips, prometheus-alertmanager-fips, cloudprober, datadog-agent,...
BIT-MINIO-2026-33419 MinIO: LDAP login brute-force via user enumeration and missing rate limit
MinIO is a high-performance object storage system. Prior to 2026.03.17, MinIO AIStor's STS Security Token Service AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: 1 distinguishable error responses that enable username enumeration,...
CVE-2026-33419
MinIO AIStor STS endpoint AssumeRoleWithLDAPIdentity is vulnerable to LDAP credential brute-forcing due to username enumeration via distinguishable error responses and no rate limiting. An unauthenticated attacker can enumerate LDAP usernames and perform unlimited password guesses to obtain tempo...
GHSA-JV87-32HW-HH99 MinIO LDAP login brute-force via user enumeration and missing rate limit
Impact What kind of vulnerability is it? Who is impacted? MinIO AIStor's STS Security Token Service AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: 1 distinguishable error responses that enable username enumeration, and 2 absence ...
CVE-2026-23759
Perle IOLAN STS/SCS terminal server models with firmware versions prior to 6.0 allow authenticated OS command injection via the restricted shell accessed over Telnet or SSH. The shell 'ps' command does not perform proper argument sanitization and passes user-supplied parameters into an 'sh -c'...
CVE-2026-23759
Perle IOLAN STS/SCS terminal server models with firmware versions prior to 6.0 allow authenticated OS command injection via the restricted shell accessed over Telnet or SSH. The shell 'ps' command does not perform proper argument sanitization and passes user-supplied parameters into an 'sh -c'...
CVE-2026-23759
CVE-2026-23759 affects Perle IOLAN STS/SCS terminal server models with firmware earlier than 6.0. The issue is an authenticated OS command injection via the restricted shell accessed over Telnet or SSH. The shell's handling of the ps subcommand does not sanitize arguments, passing user-supplied p...
CVE-2019-16791
In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy...
Exploit for CVE-2025-62506
CVE-2025-62506 Vulnerability Verification Script !中文https...
