4712 matches found
CVE-2023-28432
CVE-2023-28432 Vulnerabilidad de divulgación de información sensible en la interfaz verify de MiniO CVE-2023-28432 Nombre chino: MinIO verify 接口敏感信息泄露漏洞（CVE-2023-28432） Descripción : MinIO es un servicio de almacenamiento de objetos de código abierto compatible con la API de Amazon S3 que puede...
jarm
JARM Please read the initial JARM blog post for more information. JARM is an active Transport Layer Security TLS server fingerprinting tool. JARM fingerprints can be used to: Quickly verify that all servers in a group have the same TLS configuration. Group disparate servers on the internet by...
org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation
A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...
CVE-2023-28432
CVE-2023-28432 Minio es un servicio de almacenamiento de objetos basado en el lenguaje Go. Implementa la mayoría de las interfaces del servicio de almacenamiento en la nube Amazon S3, y puede considerarse como la versión de código abierto de S3, muy adecuado para almacenar grandes volúmenes de...
PoC--CVE-2019-10149_Exim
PoC-CVE-2019-10149Exim MNEMO-CERT ha desarrollado una PoC que permite ejecutar comandos con permisos elevados mediante el aprovechamiento de la vulnerabilidad CVE-2019-10149, que afecta distintas versiones de Exim 4.87 - 4.91. Para realizar el aprovechamiento local de esta vulnerabilidad es...
CVE-2022-22954
CVE-2022-22954 Atención Por favor, úsalo bajo tu propio riesgo. Este repositorio es solo con fines educativos y estamos estrictamente en contra de cualquier intención ilegal, y no seremos responsables de ninguna actividad ilegal asociada con este repositorio. ¡Sé ético! Ejemplo root@kitploit:...
cve-2022-22954
CVE-2022-22954 Este paquete detecta un subconjunto de intentos y explotaciones de CVE-2022-22954, genera un aviso, e incluye la URI de explotación y los primeros 4KB de los datos que se enviaron de vuelta al atacante como respuesta. Aunque detectar este ataque es más directo mediante análisis de...
FortiClient EMS - Authentication Bypass
Detects whether Fortinet hotfix FG-IR-26-099 for CVE-2026-35616 is missing by comparing behavioral responses from a certificate-authenticated endpoint. The template sends X-SSL-CLIENT-VERIFY: SUCCESS without certificate material and checks whether this spoofed header changes server behavior. id:...
cve-2024-7646
CVE-2024-7646 Descripción Por defecto, nginx.ingress.kubernetes.io/server-snippet está deshabilitado, pero debido a este CVE, nginx.ingress.kubernetes.io/auth-tls-verify-client puede aún insertar fragmentos personalizados, o incluso se puede incluir código lua. Versión corregida controlador...
ch55x_firmware_extractor
CH55x 固件提取器 CH55x 固件提取器用于从 CH55x 集成电路中读取固件。这些器件本身并不支持通过引导加载程序直接读取固件。然而，它提供了一种功能，可以一次 8 字节地将固件内容与提供的数据进行验证。该功能容易受到教科书式的时间攻击，这正是本文所利用的方法，从而允许从这些设备中提取固件。引导加载程序可以通过 USB 或 UART 访问。此固件提取器仅适用于 UART，因为 USB 的较高延迟会使这种攻击变得困难。已测试的芯片为 CH552 和 CH554，引导加载程序版本为 2.4 和 2.5。固件提取器的硬件方案基于 STM32 Blue...
Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials
Summary Security vulnerabilities have been addressed in IBM Verify Identity Access Digital Credentials Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a secon...
CVE-2026-77522
MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback,...
CVE-2023-28432
CVE-2023-28432 Plantillas de nuclei para CVE-2023-28432 Descripción Minio es un framework de almacenamiento de objetos Multi-Cloud. En un despliegue en clúster, a partir de RELEASE.2019-12-17T23-16-33Z y antes de RELEASE.2023-03-20T20-16-18Z, MinIO devuelve todas las variables de entorno, incluid...
Rejetto HTTP File Server - Template injection
This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...
EulerOS Virtualization 2.10.0 : python-requests (EulerOS-SA-2026-3884)
According to the versions of the python-requests packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made...
ROS-20260921-73-0112
The vulnerability of the Verify function in the Go programming language is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
IBM-Security-Verify-oAuth_Token_Steal-CVE-2024-35133
IBM Security Verify Access - Open Redirect during OAuth Flow CVE-2024-35133 Table of Contents 1. Overview 2. Detailed Description 3. Proof of Concept 4. Solution 5. Disclosure Timeline 6. References 7. Credits 8. Legal Notices Overview Revision : 1.0 Impact : By persuading a victim to visit a...
EulerOS 2.0 SP10 : python-requests (EulerOS-SA-2026-3717)
According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with...
golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
A flaw was found in golang.org/x/crypto/ssh. The Verify method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially...