Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven) Full Disclosuremailing list archivesFrom: theknell--- via Fulldisclosure <fulldi... 2026-11-13 01:45:11 | 阅读: 11 | 收藏 | Full Disclosure - seclists.org backup knell 2026 lived

InfiniteWP Client: the NOSSL signing key has 31 bits of secret — recovered live in 291.9 seconds Full Disclosuremailing list archivesFrom: theknell--- via Fulldisclosure <fulldi... 2026-11-13 01:45:10 | 阅读: 10 | 收藏 | Full Disclosure - seclists.org knell nossl recovered infinitewp

Open WebUI: the Windows installer mints the master key from the install second — CVE-2025-15603 was rejected; here is the measurement Full Disclosuremailing list archivesFrom: theknell--- via Fulldisclosure <fulldi... 2026-11-13 01:45:8 | 阅读: 7 | 收藏 | Full Disclosure - seclists.org knell webui 2026 windows

APPLE-SA-11-12-2026-1 HomeView Software Version 27.2 Full Disclosuremailing list archivesFrom: Apple Product Security via Fulldisclos... 2026-11-13 01:29:16 | 阅读: 7 | 收藏 | Full Disclosure - seclists.org homeview 2026 addressed security software

APPLE-SA-11-09-2026-9 visionOS 27.2.1 Full Disclosuremailing list archivesFrom: Apple Product Security via Fulldisclos... 2026-11-13 01:29:15 | 阅读: 9 | 收藏 | Full Disclosure - seclists.org 2026 addressed security pgp

APPLE-SA-11-09-2026-8 watchOS 26.6.1 Full Disclosuremailing list archivesFrom: Apple Product Security via Fulldisclos... 2026-11-13 01:29:13 | 阅读: 10 | 收藏 | Full Disclosure - seclists.org security 2026 ultra pgp addressed

APPLE-SA-11-09-2026-7 watchOS 27.2.1 Full Disclosuremailing list archivesFrom: Apple Product Security via Fulldisclos... 2026-11-13 01:29:12 | 阅读: 10 | 收藏 | Full Disclosure - seclists.org 2026 addressed security attacker pgp

APPLE-SA-11-09-2026-6 macOS Sequoia 15.8.3 Full Disclosuremailing list archivesFrom: Apple Product Security via Fulldisclos... 2026-11-13 01:29:11 | 阅读: 2 | 收藏 | Full Disclosure - seclists.org sequoia 2026 addressed security attacker

SEC Consult SA-20261104-0 :: Improper device certificate validation enables AiTM attacks in Siemens SICAM Toolbox II device communication Full Disclosuremailing list archivesFrom: SEC Consult Vulnerability Lab via Full... 2026-11-5 04:30:30 | 阅读: 31 | 收藏 | Full Disclosure - seclists.org siemens toolbox sicam security software

Apache Struts2 Tiles Plugin <=7.4.0 and >=6.3.0 Preparer Cache Vulnerabilities Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-5 04:29:58 | 阅读: 34 | 收藏 | Full Disclosure - seclists.org tiles preparers preparer

unixODBC <=2.3.14 Rude Truncation via Narrowing Conversion Causes Out-of-Bounds `memcpy` Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-5 04:29:57 | 阅读: 27 | 收藏 | Full Disclosure - seclists.org sqllen bcol sqlbindcol rowset cbuf

unixODBC <=2.3.14 Multiple Races Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-5 04:29:55 | 阅读: 18 | 收藏 | Full Disclosure - seclists.org pooling pthread

unixODBC <=2.3.14 Multiple Heap Buffer Overflows, Underflows, and Over-Reads Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-5 04:29:54 | 阅读: 23 | 收藏 | Full Disclosure - seclists.org hdbc overflow sqlchar henv

Apache Struts2 Core Arbitrary Code Execution via OGNL Sandbox Escape Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:55 | 阅读: 35 | 收藏 | Full Disclosure - seclists.org beans attackers protections cursory

Apache Struts2 Core TokenHelper Token Cryptographic Timing Side-Channel Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:54 | 阅读: 28 | 收藏 | Full Disclosure - seclists.org tokenname tokenhelper invocation dispatcher

Apache Struts2 Spring Plugin Uses a Previously Closed Resource Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:52 | 阅读: 28 | 收藏 | Full Disclosure - seclists.org struts reloading appcontext

Apache Struts2 Core Integer Overflow Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:51 | 阅读: 26 | 收藏 | Full Disclosure - seclists.org urlencode showcase grouped overflow totype

Apache Struts2 Core Cross-Origin Protection Exemption Miskeyed to a Deployment-Wide Path Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:50 | 阅读: 23 | 收藏 | Full Disclosure - seclists.org invocation

Apache Struts2 REST Plugin Fails to Properly Parse Chunked Requests Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:48 | 阅读: 23 | 收藏 | Full Disclosure - seclists.org chunked orders showcase clientname

Apache Struts2 REST Plugin Untrimmed `Accept` Header Tokens Break Content Negation Fallback Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:47 | 阅读: 23 | 收藏 | Full Disclosure - seclists.org findhandler fallback