Posted by Martin Heiland via Fulldisclosure on Feb 13
Dear subscribers,
We’re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs for OX App Suite, Dovecot and PowerDNS at YesWeHack.
*INTRODUCTION*
Passkeys on Android are stored in Google Password Manager by default. The user cannot make their own backups of them.
Note: although the user can export a CSV file with both passkeys and passwords, the lines representing passkeys will
not contain any secrets, rendering them useless.
Also note that Google Passkey Manager appears to primarily be a CLOUD-based password manager (with copies of passwords
and passkeys usually cached…
Posted by Austin DeFrancesco via Fulldisclosure on Feb 13
Command Injection Vulnerability in KiTTY Get Remote File Through SCP Input (CVE-2024-23749)
===========================================================================================
Contents:
———
Summary
Analysis
Exploitation
Acknowledgments
Timeline
Additional Advisory
Summary:
——–
Austin A. DeFrancesco (DEFCESCO) discovered a command injection vulnerability in KiTTY
(https://github.com/cyd01/KiTTY/). This vulnerability:…
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker could possibly
use this issue to corrupt memory. (CVE-2022-31117)
