TNT Sécurité – Page 3 – TNT Sécurité

Archives de l'Auteur : TNT

Site Web: https://www.tntsecurite.ca
Enregistré: 2013-11-18 23:28:12

Article récent

20 octobre 2017 L’exploit KRACK affecte tous les périphériques Wi-Fi utilisant le protocole WPA2: CatégoriesDifférentes attaques, Encryption routeur, Failles de sécurités, Information; Étiquette :
27 juin 2017 Comment hacker Windows à l’aide d’un « Malware »: CatégoriesDifférentes attaques, Metasploit; Étiquette :
6 juin 2017 Forcer le débranchement d’un périphérique sur votre réseau: CatégoriesDifférentes attaques; Étiquette :
21 février 2017 Le « Dark Web » vous connaissez ?: CatégoriesDivers, Information; Étiquette :
3 novembre 2016 Comment installer TAILS et accéder le ¨Darknet¨ à l’aide de TOR: CatégoriesDivers, Information; Étiquette :

CVE-2025-25305 18 février 2025

High Severity Description Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past, `aiohttp-session`/`request` had the parameter `verify_ssl` to control SSL certificate verification. […]

CVE-2025-26465 18 février 2025

Medium Severity Description A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the […]

CVE-2025-26603 18 février 2025

Medium Severity Description Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to […]

CVE-2025-24895 18 février 2025

Critical Severity Description CIE.AspNetCore.Authentication is an AspNetCore Remote Authenticator for CIE 3.0. Authentication using Spid and CIE is based on the SAML2 standard which provides two entities: 1. Identity Provider (IDP): the system that authenticates users and provides identity information (SAML affirmation) to the Service Provider, in essence, is responsible for the management of the […]

CVE-2025-24894 18 février 2025

Critical Severity Description SPID.AspNetCore.Authentication is an AspNetCore Remote Authenticator for SPID. Authentication using Spid and CIE is based on the SAML2 standard which provides two entities: Identity Provider (IDP): the system that authenticates users and provides identity information (SAML affirmation) to the Service Provider, in essence, is responsible for the management of the credentials and […]

Re: Netgear Router Administrative Web Interface Lacks Transport Encryption By Default 18 février 2025

Posted by Gynvael Coldwind on Feb 17Hi, This isn't really a problem a vendor can solve in firmware (apart from offering configuration via cloud, which has its own issues). Even if they would enable TLS/SSL by default, it would just give one a false sense of security, since: - the certificates would be invalid (public […]

Monero 18.3.4 zero-day DoS vulnerability has been dropped publicly on social network. 16 février 2025

Posted by upper.underflow via Fulldisclosure on Feb 16Hello, About an hour ago, a group appearing to be named WyRCV2 posted a note on the nostr social network, which can be found at the following link: https://primal.net/e/note1vzh0mj9rcxax9cgcdapupyxeehjprd68gd9kk9wrv939m8knulrs4780x7 Save, share, use. The paste link includes a list of nodes that the attacker has instructed to target, along […]

Netgear Router Administrative Web Interface Lacks Transport Encryption By Default 16 février 2025

Posted by Ryan Delaney via Fulldisclosure on Feb 16

[CVE-2024-54756] GZDoom <= 4.13.1 Arbitrary Code Execution via Malicious ZScript 16 février 2025

Posted by Gabriel Valachi via Fulldisclosure on Feb 15In GZDoom 4.13.1 and below, there is a vulnerability involving array sizes in ZScript, the game engine's primary scripting language. It is possible to dynamically allocate an array of 1073741823 dwords, permitting access to the rest of the heap from the start of the array and causing […]

Re: Text injection on https://www.google.com/sorry/index via ?q parameter (no XSS) 16 février 2025

Posted by David Fifield on Feb 15Today at about 2025-02-13 19:00 I noticed the "≠" is back, but now the type 0x12 payload of the ?q query parameter gets formatted into the string representation of an IP address, rather than being copied almost verbatim into the page. If the payload length is 4 bytes, it […]