CVE-2019-19751

Versions of easyMINE prior to 2019-12-05 are vulnerable because SSH host keys are baked into the installation image. This configuration enables man-in-the-middle attacks and allows for the trivial identification of all public IPv4 nodes using Shodan.io . To remediate this, it is recommended to re...

SimpleMiningOS 安全漏洞

SimpleMiningOS is a mining operating system open-sourced by SimpleMining Poland. A security vulnerability exists in SimpleMiningOS version v1259, which stems from the inclusion of SSH host keys in the installation image, allowing man-in-the-middle attacks and enabling Shodan.io to easily identify...

PT-2024-10727 · Unknown · Simpleminingos

Name of the Vulnerable Software and Affected Versions: SimpleMiningOS versions through v1259 Description: The issue allows man-in-the-middle attacks due to SSH host keys being baked into the installation image. This also makes it trivial to identify all public IPv4 nodes using Shodan.io. The vend...

CVE-2019-19753

SimpleMiningOS versions through v1259 are affected by a vulnerability where SSH host keys are baked into the installation image. This oversight enables man-in-the-middle (MITM) attacks and allows for the trivial identification of all public IPv4 nodes using Shodan.io . The vendor has stated they ...

CVE-2020-5200

Minerbabe through V4.16 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io...

CVE-2019-19753

SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: the vendor indicated that they have no plans to fix this, and discourage deployment using...

CVE-2019-19754

HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-09-26, the vendor indicated that they would consider fixing this...

CVE-2019-19752

nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated plans to fix this in the next image build...

CVE-2020-5200

Minerbabe through V4.16 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io...

CVE-2019-19754

HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-09-26, the vendor indicated that they would consider fixing this...

CVE-2019-19752

The nvOC narrowband speech coding scheme (versions 3.2 and earlier ) is vulnerable because SSH host keys are baked directly into the installation image. This use of hard-coded cryptographic keys enables man-in-the-middle attacks and allows for the trivial identification of all public IPv4 nodes u...

CVE-2019-19755

The ethOS operating system (versions 1.3.3 and earlier ) is vulnerable because SSH host keys are baked into the installation image. This security flaw enables man-in-the-middle attacks and allows for the easy identification of all public IPv4 nodes using Shodan.io . To mitigate this risk, users s...

WordPress ACF On-The-Go Plugin <= 1.0.1 is vulnerable to Broken Access Control

Software ACF On-The-Go Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3071 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6d532a3fc713 Credits Francesco Carlucci Required...

PT-2024-23586 · WordPress · Acf On-The-Go

Name of the Vulnerable Software and Affected Versions: ACF On-The-Go plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to a missing capability check on the acfg update fields function, allowing authenticated attackers with subscriber-level access and abov...

RHEL 9 : Image builder components (RHSA-2024:2119)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2119 advisory. Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security...

CVE-2019-19754

HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-09-26, the vendor indicated that they would consider fixing this...

Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability

Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web MotW feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file...

CVE-2023-46270

MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items...

shim: RCE in http boot support may lead to Secure Boot bypass

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete...

ACF On-The-Go <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update

Description The ACF On-The-Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the acfgupdatefields function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access an...