TNT Sécurité – Page 6 – TNT Sécurité

Archives de l'Auteur : TNT

Site Web: https://www.tntsecurite.ca
Enregistré: 2013-11-18 23:28:12

Article récent

29 août 2014 La fin de Windows XP: CatégoriesFailles de sécurités, Microsoft; Étiquette :
27 août 2014 Empoisonnement du cache DNS: CatégoriesFailles de sécurités; Étiquette :
18 décembre 2013 Attaque sur une clé WPA2 à l’aide de Reaver: CatégoriesEncryption routeur; Étiquette :
30 novembre 2013 Est-ce que votre navigateur est sécuritaire ?: CatégoriesFailles de sécurités; Étiquette :
29 novembre 2013 Vulnérablité UPnP: CatégoriesFailles de sécurités; Étiquette :

CVE-2025-4038 28 avril 2025

Medium Severity Description A vulnerability was found in code-projects Train Ticket Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is the function Reservation of the component Ticket Reservation. The manipulation of the argument Name leads to stack-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to […]

CVE-2025-4037 28 avril 2025

Medium Severity Description A vulnerability was found in code-projects ATM Banking 1.0. It has been classified as critical. Affected is the function moneyDeposit/moneyWithdraw. The manipulation leads to business logic errors. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Read more at https://www.tenable.com/cve/CVE-2025-4037

CVE-2024-10635 28 avril 2025

Medium Severity Description Enterprise Protection contains an improper input validation vulnerability in attachment defense that allows an unauthenticated remote attacker to bypass attachment scanning security policy by sending a malicious S/MIME attachment with an opaque signature. When opened by a recipient in a downstream email client, the malicious attachment could cause partial loss of integrity […]

CVE-2024-11922 28 avril 2025

Medium Severity Description Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email. Read more at https://www.tenable.com/cve/CVE-2024-11922

CVE-2025-0049 28 avril 2025

Low Severity Description When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0. Read more at https://www.tenable.com/cve/CVE-2025-0049

[IWCC 2025] CfP: 14th International Workshop on Cyber Crime - Ghent, Belgium, Aug 11-14, 2025 27 avril 2025

Posted by Artur Janicki via Fulldisclosure on Apr 26[APOLOGIES FOR CROSS-POSTING] CALL FOR PAPERS 14th International Workshop on Cyber Crime (IWCC 2025 - https://2025.ares-conference.eu/program/iwcc/) to be held in conjunction with the 20th International Conference on Availability, Reliability and Security (ARES 2025 - http://2025.ares-conference.eu) August 11-14, 2025, Ghent, Belgium IMPORTANT DATES Submission Deadline May 12, 2025 […]

Inedo ProGet Insecure Reflection and CSRF Vulnerabilities 27 avril 2025

Posted by Daniel Owens via Fulldisclosure on Apr 26Inedo ProGet 2024.22 and below are vulnerable to unauthenticated denial of service and information disclosure attacks (among other things) because the information system directly exposes the C# reflection used during the request-action mapping process and fails to properly protect certain pathways. These are amplified by cross-site request […]

Ruby on Rails Cross-Site Request Forgery 27 avril 2025

Posted by Daniel Owens via Fulldisclosure on Apr 26Good morning. All current versions and all versions since the 2022/2023 "fix" to the Rails cross-site request forgery (CSRF) protections continue to be vulnerable to the same attacks as the 2022 implementation. Currently, Rails generates "authenticity tokens" and "csrf tokens" using a random "one time pad" (OTP). […]

Microsoft ".library-ms" File / NTLM Information Disclosure (Resurrected 2025) 27 avril 2025

Posted by hyp3rlinx on Apr 26[-] Microsoft ".library-ms" File / NTLM Information Disclosure Spoofing (Resurrected 2025) / CVE-2025-24054 [+] John Page (aka hyp3rlinx) [+] x.com/hyp3rlinx [+] ISR: ApparitionSec Back in 2018, I reported a ".library-ms" File NTLM information disclosure vulnerability to MSRC and was told "it was not severe enough", that being said I post […]

HNS-2025-10 - HN Security Advisory - Local privilege escalation in Zyxel uOS 24 avril 2025

Posted by Marco Ivaldi on Apr 23Hi, Please find attached a security advisory that describes some vulnerabilities we discovered in the Zyxel uOS Linux-based operating system. * Title: Local privilege escalation via Zyxel fermion-wrapper * Product: USG FLEX H Series * OS: Zyxel uOS V1.31 (and potentially earlier versions) * Author: Marco Ivaldi * Date: […]