60 matches found
CVE-2024-1052
Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...
Session fixation
Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...
CVE-2024-1052 Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering
Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...
CVE-2024-1052
Boundary and Boundary Enterprise are affected by CVE-2024-1052: session hijacking via TLS certificate tampering. The issue occurs when an attacker who can enumerate active/pending sessions, obtain a session private key, and possess a valid TOFU token can craft a TLS certificate to hijack an activ...
CVE-2023-20965
In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2023-20965
In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Design/Logic Flaw
In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2023-20965
In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2023-20965
In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2023-20965
CVE-2023-20965 is a high-severity Android issue in the WiFi stack (ClientModeImpl.java TOFU flow) that could disclose credentials and enable remote elevation of privilege without user interaction. The NVD notes a 9.8 CVSS v3.1 score (Network, None PR, high impact). Public references in the provid...
ASB-A-250574778
In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
DEBIAN-CVE-2009-4404
Unspecified vulnerability in t-prot TOFU Protection before 2.8 allows remote attackers to cause a denial of service via unspecified vectors related to the "--maxlines" option and a crafted email message. NOTE: some of these details are obtained from third party information...
CVE-2009-4404
Unspecified vulnerability in t-prot TOFU Protection before 2.8 allows remote attackers to cause a denial of service via unspecified vectors related to the "--maxlines" option and a crafted email message. NOTE: some of these details are obtained from third party information...
CVE-2009-4404
Unspecified vulnerability in t-prot TOFU Protection before 2.8 allows remote attackers to cause a denial of service via unspecified vectors related to the "--maxlines" option and a crafted email message. NOTE: some of these details are obtained from third party information...
CVE-2009-4404
CVE-2009-4404 concerns the TOFU Protection feature, specifically a vulnerability in t-prot before version 2.8. The issue is described as an unspecified vulnerability that allows remote attackers to cause a denial of service, related to the "--maxlines" option and a crafted email message. The conn...
CVE-2009-4404
Unspecified vulnerability in t-prot TOFU Protection before 2.8 allows remote attackers to cause a denial of service via unspecified vectors related to the "--maxlines" option and a crafted email message. NOTE: some of these details are obtained from third party information...
CVE-2005-3008
Tofu 0.2 allows remote attackers to execute arbitrary Python code via crafted pickled objects, which Tofu unpickles and executes...
CVE-2005-3008
CVE-2005-3008 affects Tofu 0.2, where remote attackers can cause arbitrary Python code execution by sending crafted pickled objects that Tofu unpickles and executes. Root cause is untrusted unpickling of serialized data. The provided documents describe the vulnerability and its impact as remote c...
CVE-2005-3008
Tofu 0.2 allows remote attackers to execute arbitrary Python code via crafted pickled objects, which Tofu unpickles and executes...
Tofu Server Detection
The remote host is running a Tofu server. Tofu is a network gaming engine. Make sure this service has been installed in accordance to your security policy. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid19758;...