Apache Roller: WSSE digest authentication headers can be replayed
CVE-2026-82379
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authe
#cwe-294
共收录 108 条相关情报。
← 返回所有主题http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0...
CVE-2026-100834
http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.
http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.D...
CVE-2026-100834
http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.
The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately...
CVE-2026-77967
The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshnes
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs ...
CVE-2026-87119
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation cre
mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed
CVE-2026-87119
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation cre
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing...
CVE-2026-94112
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen...
CVE-2026-94112
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured
mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack
CVE-2026-94112
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the ...
CVE-2026-54148
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvid
http4k: `DigestAuthProvider.verify` did not bind to request URI
CVE-2026-54148
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvid
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go check...
CVE-2026-45720
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application log...
CVE-2026-90997
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics b
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is runnin...
CVE-2026-73443
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it h...
CVE-2026-69206
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records last
Http4s: DigestAuth allows replay of captured requests
CVE-2026-69206
The `DigestAuth` replay defence stores `lastNc + 1` rather than the nonce-count (`nc`) value it just accepted. When a le
GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent...
CVE-2026-88278
GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a ca
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as con...
CVE-2026-73312
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multi
XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authoriz...
CVE-2026-73311
XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthor
PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corres...
CVE-2022-51016
PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify