7734 matches found
Tp-link TL-WR841N Trust Management Issues Vulnerability
The Tp-link TL-WR841N is a wireless router from China P&L Tp-link. The Tp-link TL-WR841N is vulnerable to a trust management issue, which can be exploited by a remote attacker to intercept credentials and subsequently perform management operations on an affected device via the web-based managemen...
GHSA-XHQQ-X44F-9FGG Authentication Bypass in github.com/russellhaering/gosaml2
Impact Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed. Depending on the implementation of the Service Provider this enables a variety of attacks, including users...
PHPGurukul Dairy Farm Shop Management System 信任管理问题漏洞
Dairy Farm Shop Management System is a PHP and MySQL based dairy farm management system . A hard-coded vulnerability exists in the Dairy Farm Shop Management System, which stems from hard-coded credentials in the code that can be exploited by an attacker to access the control panel...
Sealevel Systems SeaConnect 370W Trust Management Issue Vulnerability
Sealevel Systems SeaConnect 370W is an Industrial Internet of Things Iiot edge device from Sealevel Systems, Inc. The Sealevel Systems SeaConnect 370W is vulnerable to a trust management issue stemming from a misconfiguration of the product's MQTTS functionality, which could be exploited by an...
Advantech Trust Management Issues Vulnerabilities
Advantech, an application of Advantech China, provides intelligent electric bus management systems. A trust management issue vulnerability exists in Advantech ADAM-3600, which stems from a hard-coded private key available in the project folder, and can be exploited by an attacker to achieve Web...
Cybersecurity threats are always changing—staying on top of them is vital, getting ahead of them is paramount
With a 1,070 percent increase in ransomware attacks year-over-year between July 2020 and June 2021, staying on top of attack trends—such as ransomware and supply chain threats—is more important than ever.1 To successfully detect and defend against security threats, we need to come together as a...
Cybersecurity threats are always changing—staying on top of them is vital, getting ahead of them is paramount
With a 1,070 percent increase in ransomware attacks year-over-year between July 2020 and June 2021, staying on top of attack trends—such as ransomware and supply chain threats—is more important than ever.1 To successfully detect and defend against security threats, we need to come together as a...
Siemens Sicam Toolbox II 信任管理问题漏洞
Siemens SICAM TOOLBOX II is an engineering solution for plants and systems of all sizes.An incorrect access control vulnerability exists in Siemens SICAM TOOLBOX II, which could be exploited by an attacker to gain access to the database...
Tp-link TL-WR841N 安全漏洞
The Tp-link TL-WR841N is a wireless router from China P&L Tp-link. The Tp-link TL-WR841N is vulnerable to a trust management issue, which can be exploited by a remote attacker to intercept credentials and subsequently perform management operations on an affected device via the web-based managemen...
EcoStruxure Geo SCADA Expert 信任管理问题漏洞
EcoStruxure Geo SCADA Expert is an integrated, scalable, and reliable surveillance and data acquisition SCADA software A trust management issue vulnerability exists in EcoStruxure Geo SCADA Expert, which stems from a possible man-in-the-middle attack when communication between a client and the Ge...
Schneider Electric Easergy P40 信任管理问题漏洞
The Schneider Electric Easergy P40 is a series of protective relays for Mv, Hv, and Ehv protection from Schneider Electric, France. The Schneider Electric Easergy P40 suffers from a trust management issue vulnerability that stems from the fact that if an attacker could exploit the vulnerability t...
EcoStruxure Geo SCADA Expert 信任管理问题漏洞
EcoStruxure Geo SCADA Expert is an integrated, scalable, and reliable supervisory control and data acquisition SCADA software A trust management issue vulnerability exists in EcoStruxure Geo SCADA Expert that stems from a possible man-in-the-middle attack when communication between a client and t...
Shadow Credentials
Microsoft has introduced Windows Hello for Business WHfB to replace traditional password based authentication with a key based trust model. This implementation uses PIN or… Continue reading - Shadow Credentials...
Shadow Credentials
Microsoft has introduced Windows Hello for Business WHfB to replace traditional password based authentication with a key based trust model. This implementation uses PIN or… Continue reading - Shadow Credentials...
Schneider Electric Modicon Controllers Trust Boundary Violation (CVE-2018-7846)
A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller. This plugi...
GHSA-Q5RX-8C2H-5Q7J Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service
Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions = 0.15.0. Users should update to version 0.16.0 which addresses this issue...
Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service
Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions = 0.15.0. Users should update to version 0.16.0 which addresses this issue...
tokenOut is only required on finalize
Lines of code Vulnerability details Impact I thought of a potential rug pull from the owner: when users buy tokenOut, it is not required that the contract has already escrowed enough tokenOut. It is only required when finalizing the sale: require tokenOut.balanceOfaddressthis = totalTokenOutBough...
Users should be allowed to control accepted tokenOutPrice
Lines of code Vulnerability details Impact Users should be able to control the accepted price. The owner can anytime invoke function setTokenOutPrice and thus change the ratio of token in/out. Users have to trust the owner not to front-run them and make the tokens more expensive. Recommended...
